bfc0: 00000000 00000000 00029734 00000036 7eec2312 76fa86d0 7eec24a4 76fa820c bfe0: 76fa8020 76fa8010 000163a0 0004bf80 r10:00000036 r9:8570b980 r8:802002a4 r7:00000036 r6:00029734 r5:00000000 r4:00000000 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 0000001c [0000001c] *pgd=85aa6003, *pmd=fe776003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 17317 Comm: syz-executor.1 Not tainted 5.17.0-rc8-syzkaller #0 Hardware name: ARM-Versatile Express PC is at atomic_read include/linux/atomic/atomic-instrumented.h:28 [inline] PC is at page_ref_count include/linux/page_ref.h:67 [inline] PC is at put_page_testzero include/linux/mm.h:717 [inline] PC is at __free_pages+0xc/0xd8 mm/page_alloc.c:5473 LR is at watch_queue_set_size+0x18c/0x1b8 kernel/watch_queue.c:275 pc : [<80444378>] lr : [<803d9bc4>] psr: 60000013 sp : 855bbea0 ip : 855bbec0 fp : 855bbebc r10: 854b06c0 r9 : 854b0880 r8 : 00000000 r7 : 854b0880 r6 : 00000001 r5 : 85886600 r4 : 00000001 r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 85494780 DAC: 00000000 Register r0 information: NULL pointer Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: non-paged memory Register r5 information: slab kmalloc-cg-128 start 85886600 pointer offset 0 size 128 Register r6 information: non-paged memory Register r7 information: slab kmalloc-64 start 854b0880 pointer offset 0 size 64 Register r8 information: NULL pointer Register r9 information: slab kmalloc-64 start 854b0880 pointer offset 0 size 64 Register r10 information: slab kmalloc-64 start 854b06c0 pointer offset 0 size 64 Register r11 information: non-slab/vmalloc memory Register r12 information: non-slab/vmalloc memory Process syz-executor.1 (pid: 17317, stack limit = 0x855ba000) Stack: (0x855bbea0 to 0x855bc000) bea0: 00000001 85886600 00000001 854b0880 855bbef4 855bbec0 803d9bc4 80444378 bec0: 00000020 854b0880 855bbeb8 00005760 00000012 85886600 00000012 85a8dcc0 bee0: 00000004 84a2b950 855bbf14 855bbef8 80497540 803d9a44 00005760 00000000 bf00: 85a8dcc1 00000012 855bbfa4 855bbf18 804a4910 804974ec 855bbf4c 855bbf28 bf20: 80280208 80330f18 8570b980 8570c0a0 820a55f0 00000036 820a55e8 8570b980 bf40: 820a55f0 00000036 855bbf64 855bbf58 816dafd0 816dae9c 855bbf84 855bbf68 bf60: 816dad58 816dafc0 60000013 00000000 00029734 e7cfbc9f 855bbf9c 00000000 bf80: 00000000 00029734 00000036 802002a4 8570b980 00000036 00000000 855bbfa8 bfa0: 80200060 804a480c 00000000 00000000 00000004 00005760 00000012 00000000 bfc0: 00000000 00000000 00029734 00000036 7eec2312 76fa86d0 7eec24a4 76fa820c bfe0: 76fa8020 76fa8010 000163a0 0004bf80 60000010 00000004 00000000 00000000 Backtrace: [<8044436c>] (__free_pages) from [<803d9bc4>] (watch_queue_set_size+0x18c/0x1b8 kernel/watch_queue.c:275) r7:854b0880 r6:00000001 r5:85886600 r4:00000001 [<803d9a38>] (watch_queue_set_size) from [<80497540>] (pipe_ioctl+0x60/0x100 fs/pipe.c:632) r10:84a2b950 r9:00000004 r8:85a8dcc0 r7:00000012 r6:85886600 r5:00000012 r4:00005760 [<804974e0>] (pipe_ioctl) from [<804a4910>] (vfs_ioctl fs/ioctl.c:51 [inline]) [<804974e0>] (pipe_ioctl) from [<804a4910>] (do_vfs_ioctl fs/ioctl.c:834 [inline]) [<804974e0>] (pipe_ioctl) from [<804a4910>] (__do_sys_ioctl fs/ioctl.c:872 [inline]) [<804974e0>] (pipe_ioctl) from [<804a4910>] (sys_ioctl+0x110/0xaa0 fs/ioctl.c:860) r7:00000012 r6:85a8dcc1 r5:00000000 r4:00005760 [<804a4800>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:64) Exception stack(0x855bbfa8 to 0x855bbff0) bfa0: 00000000 00000000 00000004 00005760 00000012 00000000 bfc0: 00000000 00000000 00029734 00000036 7eec2312 76fa86d0 7eec24a4 76fa820c bfe0: 76fa8020 76fa8010 000163a0 0004bf80 r10:00000036 r9:8570b980 r8:802002a4 r7:00000036 r6:00029734 r5:00000000 r4:00000000 Code: e7f001f2 e1a0c00d e92dd8f0 e24cb004 (e590301c) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e7f001f2 udf #18 4: e1a0c00d mov ip, sp 8: e92dd8f0 push {r4, r5, r6, r7, fp, ip, lr, pc} c: e24cb004 sub fp, ip, #4 * 10: e590301c ldr r3, [r0, #28] <-- trapping instruction