------------[ cut here ]------------
WARNING: CPU: 1 PID: 11993 at mm/gup.c:2121 is_valid_gup_args+0x1dc/0x230
Modules linked in:
CPU: 1 PID: 11993 Comm: syz-executor.4 Not tainted 6.2.0-rc7-next-20230207 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:is_valid_gup_args+0x1dc/0x230
Code: dd ff 48 83 3c 24 00 0f 85 76 ff ff ff e8 5c 50 dd ff 0f 0b 45 31 e4 eb c9 e8 50 50 dd ff 0f 0b 45 31 e4 eb bd e8 44 50 dd ff <0f> 0b 45 31 e4 eb b1 e8 38 50 dd ff 0f 0b 45 31 e4 eb a5 e8 2c 50
RSP: 0018:ffff88803f087508 EFLAGS: 00010216
RAX: 0000000000009c79 RBX: 0000000000040000 RCX: ffffc9001291d000
RDX: 0000000000040000 RSI: ffffffff816e127c RDI: 0000000000000005
RBP: ffff88803f087568 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000040000 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000040000 R15: 0000000000040000
FS:  00007fba6eea0700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555562263bc CR3: 00000000158f0000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 pin_user_pages_fast+0x83/0x100
 iov_iter_extract_pages+0x2b9/0x1e90
 bio_iov_iter_get_pages+0x341/0x13c0
 iomap_dio_bio_iter+0x78e/0x1350
 __iomap_dio_rw+0xe22/0x1ce0
 iomap_dio_rw+0x40/0xa0
 ext4_file_write_iter+0xb5d/0x1930
 vfs_write+0x9b4/0xdc0
 ksys_write+0x12b/0x260
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7fba7192ab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fba6eea0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fba71a3df60 RCX: 00007fba7192ab19
RDX: 0000000000140000 RSI: 0000000020000200 RDI: 0000000000000005
RBP: 00007fba71984f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffdfa68da8f R14: 00007fba6eea0300 R15: 0000000000022000
 </TASK>
irq event stamp: 7153
hardirqs last  enabled at (7195): [<ffffffff8460144a>] asm_sysvec_apic_timer_interrupt+0x1a/0x20
hardirqs last disabled at (7224): [<ffffffff8446523f>] sysvec_apic_timer_interrupt+0xf/0x90
softirqs last  enabled at (3378): [<ffffffff8118cdec>] __irq_exit_rcu+0xcc/0x110
softirqs last disabled at (3107): [<ffffffff8118cdec>] __irq_exit_rcu+0xcc/0x110
---[ end trace 0000000000000000 ]---
Bluetooth: hci6: command 0x0406 tx timeout
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
device lo left promiscuous mode
device lo entered promiscuous mode
device lo left promiscuous mode
device lo left promiscuous mode
device lo entered promiscuous mode
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12349 comm=syz-executor.7
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.6'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.7'.
netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
audit: type=1326 audit(1675767267.852:12): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=12555 comm="syz-executor.3" exe="/syz-executor.3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f45a6e9fb19 code=0x0