8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=83d95003, *pmd=fb654003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 18337 Comm: syz-executor.1 Not tainted 6.9.0-rc3-syzkaller #0 Hardware name: ARM-Versatile Express PC is at dev_map_enqueue+0x10/0xb8 kernel/bpf/devmap.c:539 LR is at __xdp_do_redirect_frame net/core/filter.c:4384 [inline] LR is at xdp_do_redirect_frame+0x114/0x34c net/core/filter.c:4438 pc : [<803f2c1c>] lr : [<8140418c>] psr: 60000013 sp : dfad9bb0 ip : dfad9bc8 fp : dfad9bc4 r10: 00000000 r9 : 5b92f000 r8 : 000000bd r7 : 84754000 r6 : 0000000e r5 : 856ce040 r4 : 824b4568 r3 : 00000000 r2 : 84754000 r1 : 856ce040 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 84b93640 DAC: 00000000 Register r0 information: NULL pointer Register r1 information: non-slab/vmalloc memory Register r2 information: slab kmalloc-cg-2k start 84754000 pointer offset 0 size 2048 Register r3 information: NULL pointer Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: non-paged memory Register r7 information: slab kmalloc-cg-2k start 84754000 pointer offset 0 size 2048 Register r8 information: non-paged memory Register r9 information: non-paged memory Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdfad8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdfad8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.1 (pid: 18337, stack limit = 0xdfad8000) Stack: (0xdfad9bb0 to 0xdfada000) 9ba0: 824b4568 856ce040 dfad9c0c dfad9bc8 9bc0: 8140418c 803f2c18 20000000 00000000 00000008 00000000 856ce000 df8e1000 9be0: 824b4568 856ce000 00000004 824b4568 00000000 df8e1000 856ce020 dfad9cc0 9c00: dfad9ddc dfad9c10 814c4080 81404084 00000000 00753800 dfad9d50 824b4568 9c20: 824b4568 dfad9e10 df8e1000 00000001 ddde3568 85520600 00000000 00000000 9c40: 8260ca3c 000002bf dfad9c70 38e38e39 8261d060 828aadc0 00000001 856ce040 9c60: 84513280 006fe000 00000001 00000000 527fc721 0000013d 00000000 00000000 9c80: 00000000 00000000 00000040 ffffffff 00000000 00000000 00000000 00000000 9ca0: 00000000 00000000 814c3680 dfad9cc0 00000253 ddde4480 dfad9cfc dfad9cc8 9cc0: dfad9e14 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9ce0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9d00: 84754000 00000000 00000001 00000002 00000007 00000000 00000000 00000000 9d20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9d40: 84754000 85567400 85520600 85520000 00000002 00000007 00000040 00000001 9d60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000140 00000000 dfad9da4 dfad9d98 8089aa38 8089a854 dfad9db4 dfad9da8 9da0: 8089aa58 83689140 00000000 9f5b30e8 00001000 dfad9ec0 00000000 83689f00 9dc0: df8e1000 00000000 00000040 84514800 dfad9e64 dfad9de0 814c5a74 814c3b88 9de0: dfad9e10 00000000 dfad9e14 dfad9df8 dfad9e2c 00000dc0 83689000 20000240 9e00: 00000002 00000000 00000000 00000000 00000000 83689140 83689140 83689140 9e20: 83689000 84719600 00000000 00001000 00000000 9f5b30e8 803952e0 df8e1000 9e40: 0000004c dfad9e98 0000000a 20000240 0000004c 00000000 dfad9f8c dfad9e68 9e60: 8039c964 814c5834 00000000 ffffffff 00000000 00000000 80000013 84514800 9e80: dfad9ee0 dfad9fb0 dfad9ea4 dfad9e98 8089aa38 dfad9ee0 20000240 00000000 9ea0: 84514800 dfad9ed0 00000008 00000000 00000008 80426f48 00000000 00000000 9ec0: 00000003 70000000 00000000 00000000 00000000 00000000 00000000 00000000 9ee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9f00: 00000002 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9f40: 00000000 00000000 00000000 00000000 00000000 00000000 8020316c 9f5b30e8 9f60: 8261ca0c 00000000 00000000 0014c2c8 00000182 80200288 84514800 00000182 9f80: dfad9fa4 dfad9f90 8039dea4 8039ba40 20000240 00000000 00000000 dfad9fa8 9fa0: 80200060 8039de84 00000000 00000000 0000000a 20000240 0000004c 00000000 9fc0: 00000000 00000000 0014c2c8 00000182 7ee9e32e 7ee9e32f 003d0f00 76b5f0fc 9fe0: 76b5ef08 76b5eef8 000168a0 00050c70 60000010 0000000a 00000000 00000000 Call trace: [<803f2c0c>] (dev_map_enqueue) from [<8140418c>] (__xdp_do_redirect_frame net/core/filter.c:4384 [inline]) [<803f2c0c>] (dev_map_enqueue) from [<8140418c>] (xdp_do_redirect_frame+0x114/0x34c net/core/filter.c:4438) r5:856ce040 r4:824b4568 [<81404078>] (xdp_do_redirect_frame) from [<814c4080>] (xdp_test_run_batch net/bpf/test_run.c:336 [inline]) [<81404078>] (xdp_do_redirect_frame) from [<814c4080>] (bpf_test_run_xdp_live+0x504/0x828 net/bpf/test_run.c:384) r10:dfad9cc0 r9:856ce020 r8:df8e1000 r7:00000000 r6:824b4568 r5:00000004 r4:856ce000 [<814c3b7c>] (bpf_test_run_xdp_live) from [<814c5a74>] (bpf_prog_test_run_xdp+0x24c/0x610 net/bpf/test_run.c:1267) r10:84514800 r9:00000040 r8:00000000 r7:df8e1000 r6:83689f00 r5:00000000 r4:dfad9ec0 [<814c5828>] (bpf_prog_test_run_xdp) from [<8039c964>] (bpf_prog_test_run kernel/bpf/syscall.c:4269 [inline]) [<814c5828>] (bpf_prog_test_run_xdp) from [<8039c964>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5678) r10:00000000 r9:0000004c r8:20000240 r7:0000000a r6:dfad9e98 r5:0000004c r4:df8e1000 [<8039ba34>] (__sys_bpf) from [<8039dea4>] (__do_sys_bpf kernel/bpf/syscall.c:5767 [inline]) [<8039ba34>] (__sys_bpf) from [<8039dea4>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5765) r10:00000182 r9:84514800 r8:80200288 r7:00000182 r6:0014c2c8 r5:00000000 r4:00000000 [<8039de78>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdfad9fa8 to 0xdfad9ff0) 9fa0: 00000000 00000000 0000000a 20000240 0000004c 00000000 9fc0: 00000000 00000000 0014c2c8 00000182 7ee9e32e 7ee9e32f 003d0f00 76b5f0fc 9fe0: 76b5ef08 76b5eef8 000168a0 00050c70 Code: e1a0c00d e92dd830 e24cb004 e1a03000 (e5900000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e1a0c00d mov ip, sp 4: e92dd830 push {r4, r5, fp, ip, lr, pc} 8: e24cb004 sub fp, ip, #4 c: e1a03000 mov r3, r0 * 10: e5900000 ldr r0, [r0] <-- trapping instruction