8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 0000000e when read
[0000000e] *pgd=80000080004003, *pmd=00000000
Internal error: Oops: 207 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 5398 Comm: kworker/u6:16 Not tainted 6.6.0-rc3-syzkaller #0
Hardware name: ARM-Versatile Express
Workqueue: events_unbound io_ring_exit_work
PC is at __io_remove_buffers io_uring/kbuf.c:219 [inline]
PC is at __io_remove_buffers+0x38/0x184 io_uring/kbuf.c:209
LR is at io_destroy_buffers+0x48/0x138 io_uring/kbuf.c:264
pc : [<807c966c>]    lr : [<807c9c28>]    psr: 20000113
sp : e0609e48  ip : e0609e78  fp : e0609e74
r10: 827e4691  r9 : 8b8a2000  r8 : ffffffff
r7 : 8b8a234c  r6 : 00000001  r5 : 8b8a0000  r4 : 00000000
r3 : 00000000  r2 : 00000000  r1 : 8b8a0000  r0 : 8b8a2000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 8b815480  DAC: 00000000
Register r0 information: slab kmalloc-2k start 8b8a2000 pointer offset 0 size 2048
Register r1 information: slab kmalloc-2k start 8b8a0000 pointer offset 0 size 2048
Register r2 information: NULL pointer
Register r3 information: NULL pointer
Register r4 information: NULL pointer
Register r5 information: slab kmalloc-2k start 8b8a0000 pointer offset 0 size 2048
Register r6 information: non-paged memory
Register r7 information: slab kmalloc-2k start 8b8a2000 pointer offset 844 size 2048
Register r8 information: non-paged memory
Register r9 information: slab kmalloc-2k start 8b8a2000 pointer offset 0 size 2048
Register r10 information: non-slab/vmalloc memory
Register r11 information: 2-page vmalloc region starting at 0xe0608000 allocated at kernel_clone+0xac/0x424 kernel/fork.c:2909
Register r12 information: 2-page vmalloc region starting at 0xe0608000 allocated at kernel_clone+0xac/0x424 kernel/fork.c:2909
Process kworker/u6:16 (pid: 5398, stack limit = 0xe0608000)
Stack: (0xe0609e48 to 0xe060a000)
9e40:                   83ee0bc0 00000014 8b8a2000 8b8a2040 8b8a234c 82604d40
9e60: 8b8a23cc 827e4691 e0609e9c e0609e78 807c9c28 807c9640 00000000 018830db
9e80: 8b8a23bc 8b8a2000 8b8a2040 8b8a234c e0609f04 e0609ea0 818264d0 807c9bec
9ea0: e0609ebc e0609eb0 00037b02 8b8a2000 00000000 e0609ec0 00000000 81825000
9ec0: 00000000 00000000 e0609ec8 e0609ec8 8b8a2000 018830db e0609f48 8a1c3480
9ee0: 8b8a23bc 82c21600 82c0f200 00000180 83ee0bc0 82c21605 e0609f44 e0609f08
9f00: 80265fd4 81826134 e0609f2c e0609f18 e0609f44 e0609f20 8026196c 8a1c3480
9f20: 8a1c34ac 82c0f200 82604d40 82c0f220 83ee0bc0 61c88647 e0609f84 e0609f48
9f40: 80266520 80265e44 82604d40 82604d40 61c88647 8a1c34ac e0609f84 8a03b940
9f60: 83ee0bc0 802662e0 8a1c3480 8a17aa80 e0601e98 00000000 e0609fac e0609f88
9f80: 8026d8e0 802662ec 8a03b940 8026d7dc 00000000 00000000 00000000 00000000
9fa0: 00000000 e0609fb0 80200104 8026d7e8 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
Backtrace: 
[<807c9634>] (__io_remove_buffers) from [<807c9c28>] (io_destroy_buffers+0x48/0x138 io_uring/kbuf.c:264)
 r10:827e4691 r9:8b8a23cc r8:82604d40 r7:8b8a234c r6:8b8a2040 r5:8b8a2000
 r4:00000014 r3:83ee0bc0
[<807c9be0>] (io_destroy_buffers) from [<818264d0>] (io_ring_ctx_free io_uring/io_uring.c:2895 [inline])
[<807c9be0>] (io_destroy_buffers) from [<818264d0>] (io_ring_exit_work+0x3a8/0x5ec io_uring/io_uring.c:3151)
 r7:8b8a234c r6:8b8a2040 r5:8b8a2000 r4:8b8a23bc
[<81826128>] (io_ring_exit_work) from [<80265fd4>] (process_one_work+0x19c/0x4a8 kernel/workqueue.c:2630)
 r10:82c21605 r9:83ee0bc0 r8:00000180 r7:82c0f200 r6:82c21600 r5:8b8a23bc
 r4:8a1c3480
[<80265e38>] (process_one_work) from [<80266520>] (process_scheduled_works kernel/workqueue.c:2703 [inline])
[<80265e38>] (process_one_work) from [<80266520>] (worker_thread+0x240/0x48c kernel/workqueue.c:2784)
 r10:61c88647 r9:83ee0bc0 r8:82c0f220 r7:82604d40 r6:82c0f200 r5:8a1c34ac
 r4:8a1c3480
[<802662e0>] (worker_thread) from [<8026d8e0>] (kthread+0x104/0x134 kernel/kthread.c:388)
 r10:00000000 r9:e0601e98 r8:8a17aa80 r7:8a1c3480 r6:802662e0 r5:83ee0bc0
 r4:8a03b940
[<8026d7dc>] (kthread) from [<80200104>] (ret_from_fork+0x14/0x30 arch/arm/kernel/entry-common.S:134)
Exception stack(0xe0609fb0 to 0xe0609ff8)
9fa0:                                     00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8026d7dc r4:8a03b940
Code: 0a000022 e5913004 e1d120be e5d14013 (e1d380be) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	0a000022 	beq	0x90
   4:	e5913004 	ldr	r3, [r1, #4]
   8:	e1d120be 	ldrh	r2, [r1, #14]
   c:	e5d14013 	ldrb	r4, [r1, #19]
* 10:	e1d380be 	ldrh	r8, [r3, #14] <-- trapping instruction