8<--- cut here --- Unable to handle kernel paging request at virtual address fee00140 when write [fee00140] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: a06 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 24783 Comm: syz.0.5284 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: ARM-Versatile Express PC is at __raw_writeb arch/arm/include/asm/io.h:99 [inline] PC is at parport_attach drivers/comedi/drivers/comedi_parport.c:243 [inline] PC is at parport_attach+0x5c/0x1e8 drivers/comedi/drivers/comedi_parport.c:231 LR is at parport_attach drivers/comedi/drivers/comedi_parport.c:243 [inline] LR is at parport_attach+0x50/0x1e8 drivers/comedi/drivers/comedi_parport.c:231 pc : [<81495cc8>] lr : [<81495cbc>] psr: 60000013 sp : dfac5d30 ip : dfac5d30 fp : dfac5d54 r10: 82d30eb4 r9 : 00000003 r8 : 842b79c0 r7 : dfac5d90 r6 : dfac5d90 r5 : 842b79c0 r4 : 00000000 r3 : fee00140 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 86694800 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: 0-page vmalloc region starting at 0xfee00000 allocated at pci_reserve_io+0x0/0x38 arch/arm/mm/mmu.c:1048 Register r4 information: NULL pointer Register r5 information: slab kmalloc-192 start 842b79c0 pointer offset 0 size 192 Register r6 information: 2-page vmalloc region starting at 0xdfac4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r7 information: 2-page vmalloc region starting at 0xdfac4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r8 information: slab kmalloc-192 start 842b79c0 pointer offset 0 size 192 Register r9 information: non-paged memory Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xdfac4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: 2-page vmalloc region starting at 0xdfac4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Process syz.0.5284 (pid: 24783, stack limit = 0xdfac4000) Stack: (0xdfac5d30 to 0xdfac6000) 5d20: ffffffff 00000004 82bd8ea4 81e2e468 5d40: 00000000 dfac5d90 dfac5d8c dfac5d58 81491958 81495c78 40946400 00000000 5d60: dfac5d7c 200003c0 842b79c0 b5403587 40946400 00000002 00000003 8413e200 5d80: dfac5e4c dfac5d90 8148d15c 8149185c 656d6f63 705f6964 6f707261 00007472 5da0: 00000000 00000140 00000000 0001000c 0000dddc 00000000 00010000 00007fff 5dc0: 00000006 00000007 00000004 02000004 0000000f 0000c000 00000008 000004d0 5de0: 00008e99 00000001 000000ed 00000006 00000008 00000004 00000000 0000000a 5e00: 00000009 00000ffd 00000009 000000af 00000002 00000281 00008001 00000009 5e20: 00000000 b599dbea 00000000 8596bf00 842b79c0 200003c0 40946400 00000002 5e40: dfac5f14 dfac5e50 8148e484 8148d09c 00000000 b599dbea 00000000 00000000 5e60: 8254a844 dfac5ea4 0000005f 843d9dd8 00000064 842b79f0 dfac5ee4 dfac5e88 5e80: 80806c94 807fd34c 00000064 00000001 00000000 dfac5ea4 85897c10 8342c198 5ea0: 00006400 0000000b dfac5e98 00000000 00000000 b599dbea 00000000 8596bf00 5ec0: 40946400 200003c0 200003c0 8596bf00 00000003 8413e200 dfac5ef4 dfac5ee8 5ee0: 80806dc8 b599dbea dfac5f14 00000000 8596bf01 40946400 200003c0 8596bf00 5f00: 00000003 8413e200 dfac5fa4 dfac5f18 805bb544 8148e13c ecac8b10 8413e200 5f20: dfac5f3c dfac5f30 81b5d520 81b5d3ec dfac5f54 dfac5f40 8025a7a8 8028e490 5f40: dfac5fb0 40000000 dfac5f84 dfac5f58 80220bdc 8025a764 00000000 82a1eb0c 5f60: dfac5fb0 0013eb70 ecac8b10 80220b30 00000000 b599dbea dfac5fac 00000000 5f80: 00000000 00356310 00000036 8020029c 8413e200 00000036 00000000 dfac5fa8 5fa0: 80200060 805bb30c 00000000 00000000 00000003 40946400 200003c0 00000000 5fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76f7c0dc 5fe0: 76f7be88 76f7be78 00018fa0 001309d0 60000010 00000003 00000000 00000000 Call trace: [<81495c6c>] (parport_attach) from [<81491958>] (comedi_device_attach+0x108/0x244 drivers/comedi/drivers.c:1101) r7:dfac5d90 r6:00000000 r5:81e2e468 r4:82bd8ea4 [<81491850>] (comedi_device_attach) from [<8148d15c>] (do_devconfig_ioctl+0xcc/0x218 drivers/comedi/comedi_fops.c:930) r10:8413e200 r9:00000003 r8:00000002 r7:40946400 r6:b5403587 r5:842b79c0 r4:200003c0 [<8148d090>] (do_devconfig_ioctl) from [<8148e484>] (comedi_unlocked_ioctl+0x354/0x1db8 drivers/comedi/comedi_fops.c:2302) r8:00000002 r7:40946400 r6:200003c0 r5:842b79c0 r4:8596bf00 [<8148e130>] (comedi_unlocked_ioctl) from [<805bb544>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<8148e130>] (comedi_unlocked_ioctl) from [<805bb544>] (do_vfs_ioctl fs/ioctl.c:551 [inline]) [<8148e130>] (comedi_unlocked_ioctl) from [<805bb544>] (__do_sys_ioctl fs/ioctl.c:595 [inline]) [<8148e130>] (comedi_unlocked_ioctl) from [<805bb544>] (sys_ioctl+0x244/0xb5c fs/ioctl.c:583) r10:8413e200 r9:00000003 r8:8596bf00 r7:200003c0 r6:40946400 r5:8596bf01 r4:00000000 [<805bb300>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfac5fa8 to 0xdfac5ff0) 5fa0: 00000000 00000000 00000003 40946400 200003c0 00000000 5fc0: 00000000 00000000 00356310 00000036 003562d8 00000000 00000001 76f7c0dc 5fe0: 76f7be88 76f7be78 00018fa0 001309d0 r10:00000036 r9:8413e200 r8:8020029c r7:00000036 r6:00356310 r5:00000000 r4:00000000 Code: ebb67bd6 e5953064 e7f33053 e2433612 (e5c34000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: ebb67bd6 bl 0xfed9ef60 4: e5953064 ldr r3, [r5, #100] @ 0x64 8: e7f33053 ubfx r3, r3, #0, #20 c: e2433612 sub r3, r3, #18874368 @ 0x1200000 * 10: e5c34000 strb r4, [r3] <-- trapping instruction