8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read [00000000] *pgd=8f438003, *pmd=fec61003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 1798 Comm: syz-executor.1 Not tainted 6.9.0-rc4-syzkaller #0 Hardware name: ARM-Versatile Express PC is at dev_map_enqueue+0x10/0xb8 kernel/bpf/devmap.c:539 LR is at __xdp_do_redirect_frame net/core/filter.c:4384 [inline] LR is at xdp_do_redirect_frame+0x114/0x34c net/core/filter.c:4438 pc : [<803f2bbc>] lr : [<814045e4>] psr: 60000013 sp : dfa45bb0 ip : dfa45bc8 fp : dfa45bc4 r10: 00000000 r9 : 5b91b000 r8 : 00000383 r7 : 85773800 r6 : 00000019 r5 : 8f3cc040 r4 : 824b4568 r3 : 00000000 r2 : 85773800 r1 : 8f3cc040 r0 : 00000000 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 8505c0c0 DAC: fffffffd Register r0 information: NULL pointer Register r1 information: non-slab/vmalloc memory Register r2 information: slab kmalloc-cg-2k start 85773800 pointer offset 0 size 2048 Register r3 information: NULL pointer Register r4 information: non-slab/vmalloc memory Register r5 information: non-slab/vmalloc memory Register r6 information: non-paged memory Register r7 information: slab kmalloc-cg-2k start 85773800 pointer offset 0 size 2048 Register r8 information: non-paged memory Register r9 information: non-paged memory Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdfa44000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdfa44000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.1 (pid: 1798, stack limit = 0xdfa44000) Stack: (0xdfa45bb0 to 0xdfa46000) 5ba0: 824b4568 8f3cc040 dfa45c0c dfa45bc8 5bc0: 814045e4 803f2bb8 20000000 00000000 00000005 00000000 8f3cc000 dfbf1000 5be0: 824b4568 8f3cc000 00000004 824b4568 00000000 dfbf1000 8f3cc020 dfa45cc0 5c00: dfa45ddc dfa45c10 814c44d8 814044dc 00000000 001fc000 dfa45d50 824b4568 5c20: 824b4568 dfa45e10 dfbf1000 00000001 dddcf568 85588f00 00000000 00000000 5c40: 8260ca3c 00000000 8f7c3e80 38e38e39 8261d060 828aadc0 00000001 8f3cc040 5c60: 84c33280 0016c400 00000001 00000000 7f62d720 000009c8 00000000 00000000 5c80: 00000000 00000000 00000040 ffffffff 00000000 00000000 00000000 00000000 5ca0: 00000000 00000000 814c3ad8 dfa45cc0 dfa45cd4 84718800 dfa45cfc dfa45cc8 5cc0: dfa45e14 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ce0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5d00: 85773800 00000000 00000001 00000002 0000000f 00000000 00000000 00000000 5d20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5d40: 85773800 844c1000 85588f00 85588500 00000002 0000000f 00000040 00000001 5d60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5d80: 00000140 00000000 dfa45da4 dfa45d98 8089a9e8 8089a804 dfa45db4 dfa45da8 5da0: 8089aa08 a078d140 00000000 5dd92ccf 00001000 dfa45ec0 00000000 a078df00 5dc0: dfbf1000 00000000 00000040 8f7c3c00 dfa45e64 dfa45de0 814c5ecc 814c3fe0 5de0: dfa45e10 00000000 dfa45e14 dfa45df8 dfa45e2c 00000dc0 a078d000 20000240 5e00: 00000002 00000000 00000000 00000000 00000000 a078d140 a078d140 a078d140 5e20: a078d000 856b3380 00000000 00001000 00000000 5dd92ccf 80395280 dfbf1000 5e40: 00000050 dfa45e98 0000000a 20000240 00000050 00000000 dfa45f8c dfa45e68 5e60: 8039c904 814c5c8c 00000000 ffffffff 00000000 00000000 80000013 8f7c3c00 5e80: dfa45ee0 dfa45fb0 dfa45ea4 dfa45e98 8089a9e8 dfa45ee0 20000240 00000000 5ea0: 8f7c3c00 dfa45ed0 00000008 00000000 00000008 80426ee8 00000000 00000000 5ec0: 00000003 00002100 00000000 00000000 00000000 00000000 00000000 00000000 5ee0: 00000000 0000c00d 00000000 00000000 00000000 00000000 00000000 00000000 5f00: 00000002 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5f40: 00000000 00000000 00000000 00000000 00000000 00000000 8020316c 5dd92ccf 5f60: 8261ca0c 00000000 00000000 0014c2c8 00000182 80200288 8f7c3c00 00000182 5f80: dfa45fa4 dfa45f90 8039de44 8039b9e0 20000240 00000000 00000000 dfa45fa8 5fa0: 80200060 8039de24 00000000 00000000 0000000a 20000240 00000050 00000000 5fc0: 00000000 00000000 0014c2c8 00000182 7ec0932e 7ec0932f 003d0f00 76baf0fc 5fe0: 76baef08 76baeef8 00016ab0 00050bf0 60000010 0000000a 00000000 00000000 Call trace: [<803f2bac>] (dev_map_enqueue) from [<814045e4>] (__xdp_do_redirect_frame net/core/filter.c:4384 [inline]) [<803f2bac>] (dev_map_enqueue) from [<814045e4>] (xdp_do_redirect_frame+0x114/0x34c net/core/filter.c:4438) r5:8f3cc040 r4:824b4568 [<814044d0>] (xdp_do_redirect_frame) from [<814c44d8>] (xdp_test_run_batch net/bpf/test_run.c:336 [inline]) [<814044d0>] (xdp_do_redirect_frame) from [<814c44d8>] (bpf_test_run_xdp_live+0x504/0x828 net/bpf/test_run.c:384) r10:dfa45cc0 r9:8f3cc020 r8:dfbf1000 r7:00000000 r6:824b4568 r5:00000004 r4:8f3cc000 [<814c3fd4>] (bpf_test_run_xdp_live) from [<814c5ecc>] (bpf_prog_test_run_xdp+0x24c/0x610 net/bpf/test_run.c:1267) r10:8f7c3c00 r9:00000040 r8:00000000 r7:dfbf1000 r6:a078df00 r5:00000000 r4:dfa45ec0 [<814c5c80>] (bpf_prog_test_run_xdp) from [<8039c904>] (bpf_prog_test_run kernel/bpf/syscall.c:4269 [inline]) [<814c5c80>] (bpf_prog_test_run_xdp) from [<8039c904>] (__sys_bpf+0xf30/0x1ef0 kernel/bpf/syscall.c:5678) r10:00000000 r9:00000050 r8:20000240 r7:0000000a r6:dfa45e98 r5:00000050 r4:dfbf1000 [<8039b9d4>] (__sys_bpf) from [<8039de44>] (__do_sys_bpf kernel/bpf/syscall.c:5767 [inline]) [<8039b9d4>] (__sys_bpf) from [<8039de44>] (sys_bpf+0x2c/0x48 kernel/bpf/syscall.c:5765) r10:00000182 r9:8f7c3c00 r8:80200288 r7:00000182 r6:0014c2c8 r5:00000000 r4:00000000 [<8039de18>] (sys_bpf) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdfa45fa8 to 0xdfa45ff0) 5fa0: 00000000 00000000 0000000a 20000240 00000050 00000000 5fc0: 00000000 00000000 0014c2c8 00000182 7ec0932e 7ec0932f 003d0f00 76baf0fc 5fe0: 76baef08 76baeef8 00016ab0 00050bf0 Code: e1a0c00d e92dd830 e24cb004 e1a03000 (e5900000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e1a0c00d mov ip, sp 4: e92dd830 push {r4, r5, fp, ip, lr, pc} 8: e24cb004 sub fp, ip, #4 c: e1a03000 mov r3, r0 * 10: e5900000 ldr r0, [r0] <-- trapping instruction