8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=85e92003, *pmd=fc0d3003
Internal error: Oops: a07 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 26938 Comm: syz-executor.0 Not tainted 6.7.0-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2400 [inline]
PC is at do_pagemap_scan+0x29c/0x6c0 fs/proc/task_mmu.c:2446
LR is at kmalloc_array include/linux/slab.h:627 [inline]
LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2395 [inline]
LR is at do_pagemap_scan+0x268/0x6c0 fs/proc/task_mmu.c:2446
pc : [<8058c738>]    lr : [<8058c704>]    psr: 20000013
sp : ead2ddc8  ip : 00000000  fp : ead2deb4
r10: ead2de00  r9 : 844ba400  r8 : 00000000
r7 : 00000000  r6 : 00000000  r5 : 20ffa000  r4 : 84129e00
r3 : 20ffc000  r2 : 00000000  r1 : 00000000  r0 : 00000010
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 861b8f00  DAC: 00000000
Register r0 information: zero-size pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab mm_struct start 84129e00 pointer offset 0 size 712
Register r5 information: non-paged memory
Register r6 information: NULL pointer
Register r7 information: NULL pointer
Register r8 information: NULL pointer
Register r9 information: slab task_struct start 844ba400 pointer offset 0 size 3072
Register r10 information: 2-page vmalloc region starting at 0xead2c000 allocated at kernel_clone+0xac/0x3c8 kernel/fork.c:2901
Register r11 information: 2-page vmalloc region starting at 0xead2c000 allocated at kernel_clone+0xac/0x3c8 kernel/fork.c:2901
Register r12 information: NULL pointer
Process syz-executor.0 (pid: 26938, stack limit = 0xead2c000)
Stack: (0xead2ddc8 to 0xead2e000)
ddc0:                   00000000 00000000 06000000 20000240 00000001 00000000
dde0: 00000000 20ffa000 00000000 00000000 00000000 00000000 00000000 00000000
de00: 00000060 00000000 00000000 00000000 20ffa000 00000000 20ffc000 00000000
de20: 00000000 00000000 200001c0 00000000 00000000 06000000 ffffffff 00000000
de40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
de60: 00000000 00000000 00000010 00000000 00000000 00000000 200001c0 00000000
de80: c0606610 af8f24ce ead2dea4 c0606610 00000000 84625cc1 20000240 84625cc0
dea0: 00000003 844ba400 ead2dec4 ead2deb8 8058cb84 8058c4a8 ead2dfa4 ead2dec8
dec0: 80501ec0 8058cb68 00050bd0 00000000 00000000 00000000 ead2df04 ead2dee8
dee0: 8020c124 8020d0f0 00000000 00000001 8185faa0 ecac8b10 ead2df44 ead2df08
df00: 8020d178 8020c10c 00000000 00000000 8020c9cc ead2dfac 844ba400 00000001
df20: ecac8b10 844ba400 ead2df44 ead2df38 81854418 818542e8 ead2df5c ead2df48
df40: 8024c824 80279930 40000000 ead2dfb0 ead2df84 ead2df60 80203134 8024c7e0
df60: 8261c978 ead2dfb0 0006b400 ecac8b10 8020301c af8f24ce ead2dfac 00000000
df80: 00000000 0014c2c8 00000036 80200288 844ba400 00000036 00000000 ead2dfa8
dfa0: 80200060 80501db4 00000000 00000000 00000003 c0606610 20000240 00000000
dfc0: 00000000 00000000 0014c2c8 00000036 7e8df326 7e8df327 003d0f00 76b580fc
dfe0: 76b57f08 76b57ef8 000167e8 00050bd0 60000010 00000003 00000000 00000000
Backtrace: 
[<8058c49c>] (do_pagemap_scan) from [<8058cb84>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2513)
 r10:844ba400 r9:00000003 r8:84625cc0 r7:20000240 r6:84625cc1 r5:00000000
 r4:c0606610
[<8058cb5c>] (do_pagemap_cmd) from [<80501ec0>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<8058cb5c>] (do_pagemap_cmd) from [<80501ec0>] (do_vfs_ioctl fs/ioctl.c:831 [inline])
[<8058cb5c>] (do_pagemap_cmd) from [<80501ec0>] (__do_sys_ioctl fs/ioctl.c:869 [inline])
[<8058cb5c>] (do_pagemap_cmd) from [<80501ec0>] (sys_ioctl+0x118/0xb58 fs/ioctl.c:857)
[<80501da8>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xead2dfa8 to 0xead2dff0)
dfa0:                   00000000 00000000 00000003 c0606610 20000240 00000000
dfc0: 00000000 00000000 0014c2c8 00000036 7e8df326 7e8df327 003d0f00 76b580fc
dfe0: 76b57f08 76b57ef8 000167e8 00050bd0
 r10:00000036 r9:844ba400 r8:80200288 r7:00000036 r6:0014c2c8 r5:00000000
 r4:00000000
Code: e51b309c e51b208c e50b203c e3a02000 (e1c060f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b309c 	ldr	r3, [fp, #-156]	@ 0xffffff64
   4:	e51b208c 	ldr	r2, [fp, #-140]	@ 0xffffff74
   8:	e50b203c 	str	r2, [fp, #-60]	@ 0xffffffc4
   c:	e3a02000 	mov	r2, #0
* 10:	e1c060f8 	strd	r6, [r0, #8] <-- trapping instruction