Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 5322 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: events vidtv_mux_tick RIP: 0010:vidtv_psi_ts_psi_write_into+0x615/0xcb0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197 Code: 00 00 e8 0e 11 a2 f9 48 8b 44 24 60 42 80 3c 20 00 48 8b 5c 24 68 74 08 48 89 df e8 75 ee 0b fa 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 e6 02 00 00 0f b6 03 0f b6 8c 24 a3 00 RSP: 0018:ffffc9000c727300 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88800084a4c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000c727410 R08: 0000000000000006 R09: 0000000000000002 R10: ffffc9000c727582 R11: fffff520018e4eb2 R12: dffffc0000000000 R13: ffffc9000c727508 R14: 0000000000000178 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88808ccea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056251a497660 CR3: 000000001a695000 CR4: 0000000000352ef0 Call Trace: vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline] vidtv_psi_pmt_write_into+0x3cf/0xaf0 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231 vidtv_mux_push_si drivers/media/test-drivers/vidtv/vidtv_mux.c:196 [inline] vidtv_mux_tick+0x1007/0x24b0 drivers/media/test-drivers/vidtv/vidtv_mux.c:408 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:vidtv_psi_ts_psi_write_into+0x615/0xcb0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197 Code: 00 00 e8 0e 11 a2 f9 48 8b 44 24 60 42 80 3c 20 00 48 8b 5c 24 68 74 08 48 89 df e8 75 ee 0b fa 48 8b 1b 48 89 d8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 e6 02 00 00 0f b6 03 0f b6 8c 24 a3 00 RSP: 0018:ffffc9000c727300 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000002 RCX: ffff88800084a4c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000c727410 R08: 0000000000000006 R09: 0000000000000002 R10: ffffc9000c727582 R11: fffff520018e4eb2 R12: dffffc0000000000 R13: ffffc9000c727508 R14: 0000000000000178 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88808ccea000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6487e17ad0 CR3: 0000000030ed9000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: e8 0e 11 a2 f9 call 0xf9a21115 7: 48 8b 44 24 60 mov 0x60(%rsp),%rax c: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) 11: 48 8b 5c 24 68 mov 0x68(%rsp),%rbx 16: 74 08 je 0x20 18: 48 89 df mov %rbx,%rdi 1b: e8 75 ee 0b fa call 0xfa0bee95 20: 48 8b 1b mov (%rbx),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 e6 02 00 00 jne 0x31d 37: 0f b6 03 movzbl (%rbx),%eax 3a: 0f .byte 0xf 3b: b6 8c mov $0x8c,%dh 3d: 24 a3 and $0xa3,%al