------------[ 
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in drivers/block/null_blk/zoned.c:21:14
shift exponent -1 is negative
CPU: 1 UID: 0 PID: 8159 Comm: syz.5.997 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:233
 __ubsan_handle_shift_out_of_bounds+0x224/0x264 lib/ubsan.c:494
 null_zone_no drivers/block/null_blk/zoned.c:21 [inline]
 null_process_zoned_cmd+0x5fc/0xd48 drivers/block/null_blk/zoned.c:728
 null_handle_cmd drivers/block/null_blk/main.c:1455 [inline]
 null_queue_rq+0x6b4/0xa88 drivers/block/null_blk/main.c:1703
 __blk_mq_issue_directly+0xfc/0x298 block/blk-mq.c:2694
 blk_mq_try_issue_directly+0xe0/0x22c block/blk-mq.c:2754
 blk_mq_submit_bio+0x1908/0x24c0 block/blk-mq.c:3208
 __submit_bio+0x94/0x2dc block/blk-core.c:673
 __submit_bio_noacct_mq block/blk-core.c:756 [inline]
 submit_bio_noacct_nocheck+0x288/0xaac block/blk-core.c:790
 submit_bio_noacct+0xd7c/0x17f0 block/blk-core.c:921
 submit_bio+0x38c/0x528 block/blk-core.c:962
 blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
 __bh_submit+0x4ac/0x588 fs/buffer.c:1225
 bh_submit fs/buffer.c:1239 [inline]
 block_read_full_folio+0x6a8/0x740 fs/buffer.c:2463
 blkdev_read_folio+0x28/0x38 block/fops.c:493
 filemap_read_folio+0xf0/0x2fc mm/filemap.c:2510
 do_read_cache_folio+0x35c/0x5a8 mm/filemap.c:4140
 read_cache_folio+0x68/0x88 mm/filemap.c:4172
 read_mapping_folio include/linux/pagemap.h:1015 [inline]
 read_part_sector+0xcc/0x708 block/partitions/core.c:724
 adfspart_check_ICS+0xa4/0x720 block/partitions/acorn.c:357
 check_partition block/partitions/core.c:143 [inline]
 blk_add_partitions block/partitions/core.c:591 [inline]
 bdev_disk_changed+0x6e4/0x1224 block/partitions/core.c:695
 blkdev_get_whole+0x15c/0x240 block/bdev.c:751
 bdev_open+0x2b4/0x880 block/bdev.c:960
 bdev_file_open_by_dev+0x180/0x1d8 block/bdev.c:1062
 disk_scan_partitions+0x1b4/0x2d4 block/genhd.c:387
 add_disk_final block/genhd.c:412 [inline]
 add_disk_fwnode+0x1dc/0x340 block/genhd.c:606
 device_add_disk+0x38/0x4c block/genhd.c:623
 add_disk include/linux/blkdev.h:800 [inline]
 null_add_dev+0xef8/0x1800 drivers/block/null_blk/main.c:2052
 nullb_device_power_store+0x160/0x398 drivers/block/null_blk/main.c:501
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x27c/0x354 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x84/0x98 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
---[ end trace ]---
Unable to handle kernel paging request at virtual address dfff800000000011
KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000011] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 8159 Comm: syz.5.997 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : null_process_zoned_cmd+0x610/0xd48 drivers/block/null_blk/zoned.c:729
lr : null_zone_no drivers/block/null_blk/zoned.c:21 [inline]
lr : null_process_zoned_cmd+0x5fc/0xd48 drivers/block/null_blk/zoned.c:728
sp : ffff800093e16ac0
x29: ffff800093e16ae0 x28: ffff0000d2839910 x27: ffff0000d2839918
x26: 1fffe0001a507322 x25: ffff0000f1ef5000 x24: 0000000000000000
x23: 000000000000008c x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000000008 x19: dfff800000000000 x18: 1fffe00034bbbe28
x17: 3a31323a632e6465 x16: 0000000000000001 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004
x11: ffff700011464e6c x10: 0000000000080000 x9 : 00000000000000a8
x8 : 0000000000000011 x7 : ffff80008048e8f8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f7cb4
x2 : 0000000000000001 x1 : ffff0000fa300000 x0 : 0000000000000001
Call trace:
 null_process_zoned_cmd+0x610/0xd48 drivers/block/null_blk/zoned.c:729 (P)
 null_handle_cmd drivers/block/null_blk/main.c:1455 [inline]
 null_queue_rq+0x6b4/0xa88 drivers/block/null_blk/main.c:1703
 __blk_mq_issue_directly+0xfc/0x298 block/blk-mq.c:2694
 blk_mq_try_issue_directly+0xe0/0x22c block/blk-mq.c:2754
 blk_mq_submit_bio+0x1908/0x24c0 block/blk-mq.c:3208
 __submit_bio+0x94/0x2dc block/blk-core.c:673
 __submit_bio_noacct_mq block/blk-core.c:756 [inline]
 submit_bio_noacct_nocheck+0x288/0xaac block/blk-core.c:790
 submit_bio_noacct+0xd7c/0x17f0 block/blk-core.c:921
 submit_bio+0x38c/0x528 block/blk-core.c:962
 blk_crypto_submit_bio include/linux/blk-crypto.h:203 [inline]
 __bh_submit+0x4ac/0x588 fs/buffer.c:1225
 bh_submit fs/buffer.c:1239 [inline]
 block_read_full_folio+0x6a8/0x740 fs/buffer.c:2463
 blkdev_read_folio+0x28/0x38 block/fops.c:493
 filemap_read_folio+0xf0/0x2fc mm/filemap.c:2510
 do_read_cache_folio+0x35c/0x5a8 mm/filemap.c:4140
 read_cache_folio+0x68/0x88 mm/filemap.c:4172
 read_mapping_folio include/linux/pagemap.h:1015 [inline]
 read_part_sector+0xcc/0x708 block/partitions/core.c:724
 adfspart_check_ICS+0xa4/0x720 block/partitions/acorn.c:357
 check_partition block/partitions/core.c:143 [inline]
 blk_add_partitions block/partitions/core.c:591 [inline]
 bdev_disk_changed+0x6e4/0x1224 block/partitions/core.c:695
 blkdev_get_whole+0x15c/0x240 block/bdev.c:751
 bdev_open+0x2b4/0x880 block/bdev.c:960
 bdev_file_open_by_dev+0x180/0x1d8 block/bdev.c:1062
 disk_scan_partitions+0x1b4/0x2d4 block/genhd.c:387
 add_disk_final block/genhd.c:412 [inline]
 add_disk_fwnode+0x1dc/0x340 block/genhd.c:606
 device_add_disk+0x38/0x4c block/genhd.c:623
 add_disk include/linux/blkdev.h:800 [inline]
 null_add_dev+0xef8/0x1800 drivers/block/null_blk/main.c:2052
 nullb_device_power_store+0x160/0x398 drivers/block/null_blk/main.c:501
 flush_write_buffer fs/configfs/file.c:207 [inline]
 configfs_write_iter+0x27c/0x354 fs/configfs/file.c:229
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x84/0x98 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590
Code: 52801509 9ba95d16 910232d7 d343fee8 (38f36908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	52801509 	mov	w9, #0xa8                  	// #168
   4:	9ba95d16 	umaddl	x22, w8, w9, x23
   8:	910232d7 	add	x23, x22, #0x8c
   c:	d343fee8 	lsr	x8, x23, #3
* 10:	38f36908 	ldrsb	w8, [x8, x19] <-- trapping instruction