8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 0000000e when read
[0000000e] *pgd=850ae003, *pmd=eacc0003
Internal error: Oops: 205 [#1] SMP ARM
Modules linked in:
CPU: 1 UID: 0 PID: 16235 Comm: syz.2.3533 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
PC is at io_ring_buffer_select io_uring/kbuf.c:163 [inline]
PC is at io_buffer_select+0x50/0x18c io_uring/kbuf.c:207
LR is at rcu_read_unlock include/linux/rcupdate.h:873 [inline]
LR is at xa_load+0x68/0xa4 lib/xarray.c:1621
pc : [<8088999c>]    lr : [<81a4c0b4>]    psr: 20000013
sp : e0499dd0  ip : e0499d90  fp : e0499dec
r10: 00000240  r9 : 80000001  r8 : 00000000
r7 : e0499e10  r6 : 00000000  r5 : 8570f900  r4 : 84fb5000
r3 : 00000001  r2 : 00000000  r1 : 85433a40  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 89888480  DAC: 00000000
Register r0 information: NULL pointer
Register r1 information: slab kmalloc-64 start 85433a40 pointer offset 0 size 64
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab io_kiocb start 84fb5000 pointer offset 0 size 192
Register r5 information: slab kmalloc-2k start 8570f800 pointer offset 256 size 2048
Register r6 information: NULL pointer
Register r7 information: 2-page vmalloc region starting at 0xe0498000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Register r8 information: NULL pointer
Register r9 information: non-slab/vmalloc memory
Register r10 information: non-paged memory
Register r11 information: 2-page vmalloc region starting at 0xe0498000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Register r12 information: 2-page vmalloc region starting at 0xe0498000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Process syz.2.3533 (pid: 16235, stack limit = 0xe0498000)
Stack: (0xe0499dd0 to 0xe049a000)
9dc0:                                     8368ca00 84fb5000 85546a00 00000000
9de0: e0499e54 e0499df0 80893204 80889958 00000000 e0499dd8 85546a00 6b603d7c
9e00: 00010001 00000001 8570f928 00000000 00000000 0000001b 00000000 8393ec00
9e20: e0499e4c 6b603d7c e0499e54 84fb5000 81cf0ca0 00000000 00000000 00000000
9e40: 80000001 8393ec00 e0499e7c e0499e58 8088214c 80892ec4 84fb5000 80000001
9e60: 0000001b 81cf0b5c 859fff00 00000000 e0499ebc e0499e80 80886c1c 8088210c
9e80: 84fb5240 84fb5300 84fb53c0 81cf0ca0 84fb5540 8570f800 84fb506c 84fb5000
9ea0: 857c0000 00000000 00000000 8393ec00 e0499f14 e0499ec0 80887734 80886be0
9ec0: 8088e0f0 81a4c058 e0499f24 e0499ed8 00000800 00000800 81cf0b5c 00000800
9ee0: 8570f800 6b603d7c 859ffc00 00000000 8570f800 00003516 859ffc00 00000000
9f00: 8393ec00 00000000 e0499fa4 e0499f18 808881dc 80887534 ecac8b10 8570f840
9f20: 00000000 00000000 81a4fe30 81a4fd00 e0499f54 e0499f40 8026b438 8029ce24
9f40: e0499fb0 40000000 e0499f84 e0499f58 802229dc 8026b3f4 00000000 8281d05c
9f60: e0499fb0 0014c490 ecac8b10 80222930 00000000 6b603d7c e0499fac 00000000
9f80: 00000000 002e63a4 000001aa 8020029c 8393ec00 000001aa 00000000 e0499fa8
9fa0: 80200060 808880b0 00000000 00000000 00000006 00003516 00000000 00000000
9fc0: 00000000 00000000 002e63a4 000001aa 002d0000 00000000 00006364 76b1e0bc
9fe0: 76b1dec0 76b1deb0 0001939c 00131f30 60000010 00000006 00000000 00000000
Call trace: 
[<8088994c>] (io_buffer_select) from [<80893204>] (io_recv_buf_select io_uring/net.c:1098 [inline])
[<8088994c>] (io_buffer_select) from [<80893204>] (io_recv+0x34c/0x46c io_uring/net.c:1138)
 r7:00000000 r6:85546a00 r5:84fb5000 r4:8368ca00
[<80892eb8>] (io_recv) from [<8088214c>] (__io_issue_sqe+0x4c/0x1c0 io_uring/io_uring.c:1734)
 r10:8393ec00 r9:80000001 r8:00000000 r7:00000000 r6:00000000 r5:81cf0ca0
 r4:84fb5000
[<80882100>] (__io_issue_sqe) from [<80886c1c>] (io_issue_sqe+0x48/0x59c io_uring/io_uring.c:1757)
 r9:00000000 r8:859fff00 r7:81cf0b5c r6:0000001b r5:80000001 r4:84fb5000
[<80886bd4>] (io_issue_sqe) from [<80887734>] (io_queue_sqe io_uring/io_uring.c:1963 [inline])
[<80886bd4>] (io_issue_sqe) from [<80887734>] (io_submit_sqe io_uring/io_uring.c:2219 [inline])
[<80886bd4>] (io_issue_sqe) from [<80887734>] (io_submit_sqes+0x20c/0x938 io_uring/io_uring.c:2336)
 r10:8393ec00 r9:00000000 r8:00000000 r7:857c0000 r6:84fb5000 r5:84fb506c
 r4:8570f800
[<80887528>] (io_submit_sqes) from [<808881dc>] (__do_sys_io_uring_enter io_uring/io_uring.c:3396 [inline])
[<80887528>] (io_submit_sqes) from [<808881dc>] (sys_io_uring_enter+0x138/0x780 io_uring/io_uring.c:3330)
 r10:00000000 r9:8393ec00 r8:00000000 r7:859ffc00 r6:00003516 r5:8570f800
 r4:00000000
[<808880a4>] (sys_io_uring_enter) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xe0499fa8 to 0xe0499ff0)
9fa0:                   00000000 00000000 00000006 00003516 00000000 00000000
9fc0: 00000000 00000000 002e63a4 000001aa 002d0000 00000000 00006364 76b1e0bc
9fe0: 76b1dec0 76b1deb0 0001939c 00131f30
 r10:000001aa r9:8393ec00 r8:8020029c r7:000001aa r6:002e63a4 r5:00000000
 r4:00000000
Code: e3130001 0a00002f e5910000 e1d120be (e1d030be) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e3130001 	tst	r3, #1
   4:	0a00002f 	beq	0xc8
   8:	e5910000 	ldr	r0, [r1]
   c:	e1d120be 	ldrh	r2, [r1, #14]
* 10:	e1d030be 	ldrh	r3, [r0, #14] <-- trapping instruction