Hello, syzbot found the following issue on: HEAD commit: 78e709522d2c Merge tag 'for_linus' of git://git.kernel.org.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=16029aed300000 kernel config: https://syzkaller.appspot.com/x/.config?x=2150ebd7e72fa695 dashboard link: https://syzkaller.appspot.com/bug?extid=219cc51510158a7d8290 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1 Unfortunately, I don't have any reproducer for this issue yet. IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+219cc51510158a7d8290@xxxxxxxxxxxxxxxxxxxxxxxxx BUG: unable to handle page fault for address: ffff88800010f038 #PF: supervisor write access in kernel mode #PF: error_code(0x0003) - permissions violation PGD 10801067 P4D 10801067 PUD 10802067 PMD 10803067 PTE 800000000010f161 Oops: 0003 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7973 Comm: kworker/0:4 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_power_efficient fb_flashcursor RIP: 0010:__writel arch/x86/include/asm/io.h:71 [inline] RIP: 0010:fast_imageblit drivers/video/fbdev/core/cfbimgblt.c:257 [inline] RIP: 0010:cfb_imageblit+0x648/0x1240 drivers/video/fbdev/core/cfbimgblt.c:300 Code: 42 0f b6 0c 3a 48 89 c2 83 e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 1f 0b 00 00 8b 7c 24 18 49 8d 5e 04 23 38 8b 44 24 10 31 f8 <41> 89 06 31 ff 44 89 e6 e8 ab 85 69 fd 45 85 e4 75 0f e8 61 7e 69 RSP: 0018:ffffc900171af970 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88800010f03c RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff840c8e86 RDI: 0000000000000000 RBP: ffff8880180a5359 R08: 000000000000001f R09: ffffffff840c8d14 R10: ffffffff840c8e77 R11: 0000000000000008 R12: 0000000000000004 R13: 0000000000000001 R14: ffff88800010f038 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88800010f038 CR3: 000000001e6a0000 CR4: 0000000000350ef0 Call Trace: vga_imageblit_expand drivers/video/fbdev/vga16fb.c:1207 [inline] vga16fb_imageblit+0x681/0x2200 drivers/video/fbdev/vga16fb.c:1260 soft_cursor+0x514/0xa30 drivers/video/fbdev/core/softcursor.c:74 bit_cursor+0xd07/0x1740 drivers/video/fbdev/core/bitblit.c:377 fb_flashcursor+0x38b/0x430 drivers/video/fbdev/core/fbcon.c:387 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: CR2: ffff88800010f038 ---[ end trace 3e2fb001e55b5406 ]--- RIP: 0010:__writel arch/x86/include/asm/io.h:71 [inline] RIP: 0010:fast_imageblit drivers/video/fbdev/core/cfbimgblt.c:257 [inline] RIP: 0010:cfb_imageblit+0x648/0x1240 drivers/video/fbdev/core/cfbimgblt.c:300 Code: 42 0f b6 0c 3a 48 89 c2 83 e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 1f 0b 00 00 8b 7c 24 18 49 8d 5e 04 23 38 8b 44 24 10 31 f8 <41> 89 06 31 ff 44 89 e6 e8 ab 85 69 fd 45 85 e4 75 0f e8 61 7e 69 RSP: 0018:ffffc900171af970 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88800010f03c RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff840c8e86 RDI: 0000000000000000 RBP: ffff8880180a5359 R08: 000000000000001f R09: ffffffff840c8d14 R10: ffffffff840c8e77 R11: 0000000000000008 R12: 0000000000000004 R13: 0000000000000001 R14: ffff88800010f038 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88800010f038 CR3: 000000001e6a0000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 42 0f b6 0c 3a movzbl (%rdx,%r15,1),%ecx 5: 48 89 c2 mov %rax,%rdx 8: 83 e2 07 and $0x7,%edx b: 83 c2 03 add $0x3,%edx e: 38 ca cmp %cl,%dl 10: 7c 08 jl 0x1a 12: 84 c9 test %cl,%cl 14: 0f 85 1f 0b 00 00 jne 0xb39 1a: 8b 7c 24 18 mov 0x18(%rsp),%edi 1e: 49 8d 5e 04 lea 0x4(%r14),%rbx 22: 23 38 and (%rax),%edi 24: 8b 44 24 10 mov 0x10(%rsp),%eax 28: 31 f8 xor %edi,%eax * 2a: 41 89 06 mov %eax,(%r14) <-- trapping instruction 2d: 31 ff xor %edi,%edi 2f: 44 89 e6 mov %r12d,%esi 32: e8 ab 85 69 fd callq 0xfd6985e2 37: 45 85 e4 test %r12d,%r12d 3a: 75 0f jne 0x4b 3c: e8 .byte 0xe8 3d: 61 (bad) 3e: 7e 69 jle 0xa9 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
