8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=8b070003, *pmd=fe676003
Internal error: Oops: a07 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 11531 Comm: syz-executor.1 Not tainted 6.9.0-rc1-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2399 [inline]
PC is at do_pagemap_scan+0x294/0x6b4 fs/proc/task_mmu.c:2445
LR is at kmalloc_array include/linux/slab.h:665 [inline]
LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2394 [inline]
LR is at do_pagemap_scan+0x260/0x6b4 fs/proc/task_mmu.c:2445
pc : [<8059d5d4>]    lr : [<8059d5a0>]    psr: 20000013
sp : e0831e18  ip : 00000000  fp : e0831f04
r10: e0831e50  r9 : 84693c00  r8 : 00000000
r7 : 00000000  r6 : 00000000  r5 : 20ff4000  r4 : 84edde00
r3 : 20ff7000  r2 : 00000000  r1 : 00000000  r0 : 00000010
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 852bb180  DAC: 00000000
Register r0 information: zero-size pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab mm_struct start 84edde00 pointer offset 0 size 712
Register r5 information: non-paged memory
Register r6 information: NULL pointer
Register r7 information: NULL pointer
Register r8 information: NULL pointer
Register r9 information: slab task_struct start 84693c00 pointer offset 0 size 3072
Register r10 information: 2-page vmalloc region starting at 0xe0830000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r11 information: 2-page vmalloc region starting at 0xe0830000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796
Register r12 information: NULL pointer
Process syz-executor.1 (pid: 11531, stack limit = 0xe0830000)
Stack: (0xe0831e18 to 0xe0832000)
1e00:                                                       00000000 00000000
1e20: 10000000 20000180 00000001 00000000 00000000 20ff4000 00000000 00000000
1e40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000
1e60: 20ff4000 00000000 20ff7000 00000000 00000000 00000000 20000100 00000000
1e80: 00000000 10000000 ffffffff 00000000 00000000 00000000 00000000 00000000
1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000
1ec0: 00000000 00000000 20000100 00000000 c0606610 78b5b1dc e0831ef4 c0606610
1ee0: 00000000 90a04f01 20000180 00000003 84693c00 90a04f00 e0831f14 e0831f08
1f00: 8059da1c 8059d34c e0831fa4 e0831f18 8050faf4 8059da00 84693c00 00000001
1f20: ecac8b10 84693c00 e0831f44 e0831f38 81897b50 81897a1c e0831f5c e0831f48
1f40: 8024c880 8027b094 40000000 e0831fb0 e0831f84 e0831f60 8020316c 8024c83c
1f60: 8261ca0c e0831fb0 0006b3f0 ecac8b10 80203054 78b5b1dc e0831fac 00000000
1f80: 00000000 0014c2c8 00000036 80200288 84693c00 00000036 00000000 e0831fa8
1fa0: 80200060 8050f9e8 00000000 00000000 00000003 c0606610 20000180 00000000
1fc0: 00000000 00000000 0014c2c8 00000036 7ef2d32e 7ef2d32f 003d0f00 76b910fc
1fe0: 76b90f08 76b90ef8 000167f8 00050bc0 60000010 00000003 00000000 00000000
Call trace: 
[<8059d340>] (do_pagemap_scan) from [<8059da1c>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2512)
 r10:90a04f00 r9:84693c00 r8:00000003 r7:20000180 r6:90a04f01 r5:00000000
 r4:c0606610
[<8059d9f4>] (do_pagemap_cmd) from [<8050faf4>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<8059d9f4>] (do_pagemap_cmd) from [<8050faf4>] (do_vfs_ioctl fs/ioctl.c:858 [inline])
[<8059d9f4>] (do_pagemap_cmd) from [<8050faf4>] (__do_sys_ioctl fs/ioctl.c:902 [inline])
[<8059d9f4>] (do_pagemap_cmd) from [<8050faf4>] (sys_ioctl+0x118/0xc24 fs/ioctl.c:890)
[<8050f9dc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xe0831fa8 to 0xe0831ff0)
1fa0:                   00000000 00000000 00000003 c0606610 20000180 00000000
1fc0: 00000000 00000000 0014c2c8 00000036 7ef2d32e 7ef2d32f 003d0f00 76b910fc
1fe0: 76b90f08 76b90ef8 000167f8 00050bc0
 r10:00000036 r9:84693c00 r8:80200288 r7:00000036 r6:0014c2c8 r5:00000000
 r4:00000000
Code: e51b309c e51b208c e50b203c e3a02000 (e1c060f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b309c 	ldr	r3, [fp, #-156]	@ 0xffffff64
   4:	e51b208c 	ldr	r2, [fp, #-140]	@ 0xffffff74
   8:	e50b203c 	str	r2, [fp, #-60]	@ 0xffffffc4
   c:	e3a02000 	mov	r2, #0
* 10:	e1c060f8 	strd	r6, [r0, #8] <-- trapping instruction