------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:187! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 29297 Comm: syz-executor.1 Not tainted 6.9.0-rc1-syzkaller #0 Hardware name: ARM-Versatile Express PC is at sg_set_buf include/linux/scatterlist.h:187 [inline] PC is at sg_init_one+0x9c/0xa8 lib/scatterlist.c:143 LR is at sg_init_table+0x2c/0x40 lib/scatterlist.c:128 pc : [<807e8650>] lr : [<807e6a44>] psr: 80000113 sp : df9d5b10 ip : df9d5b48 fp : df9d5b2c r10: 00000000 r9 : ffefd004 r8 : ff7e7f1c r7 : 00000048 r6 : df9d5b30 r5 : 84eed7d0 r4 : ffefd004 r3 : df000000 r2 : ffffffd8 r1 : 00000000 r0 : df9d5b30 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 84f05300 DAC: fffffffd Register r0 information: 2-page vmalloc region starting at 0xdf9d4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab vmap_area start 84eed7d0 pointer offset 0 size 40 Register r6 information: 2-page vmalloc region starting at 0xdf9d4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r7 information: non-paged memory Register r8 information: 0-page vmalloc region starting at 0xff7d8000 allocated at pcpu_get_vm_areas+0x0/0x12c8 mm/vmalloc.c:3064 Register r9 information: non-paged memory Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdf9d4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdf9d4000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.1 (pid: 29297, stack limit = 0xdf9d4000) Stack: (0xdf9d5b10 to 0xdf9d6000) 5b00: ff7e7efc 84eed7d0 dec96d44 841cdd80 5b20: df9d5b8c df9d5b30 804c3ddc 807e85c0 00000002 00000000 00000000 00000000 5b40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5b60: 00000006 2144f48e 84eed7d0 00000006 dec96d44 845e2b04 845e2b00 845e2b00 5b80: df9d5bb4 df9d5b90 804c6a20 804c3d2c dec96d44 00000001 df9d5c24 00000000 5ba0: 83fc0c00 8459bc00 df9d5c04 df9d5bb8 804bbbfc 804c68d0 804bd120 802e27a0 5bc0: ffffffe0 00000000 00100cca 00000000 00000000 2144f48e 8459bc00 00000006 5be0: 00100cca 00000000 00000000 df9d5c23 00000007 00000000 df9d5c7c df9d5c08 5c00: 804bd61c 804bbb60 df9d5c23 00000000 83fc0e80 dec96d44 00000006 00000006 5c20: 019d5c8c 00000000 00000000 00000000 00000000 00000000 00000001 00000000 5c40: df9d5c40 df9d5c40 818753b0 2144f48e 00000406 00000001 00000000 00000006 5c60: 85093a80 00100cca 00000000 df9d5d90 df9d5cf4 df9d5c80 804bd970 804bd464 5c80: 00000000 2144f48e 00000001 df9d5d90 00000000 00000000 df9d5ccc df9d5ca8 5ca0: 8042e9b8 8042e80c df9d5d90 8260cac8 85093a80 20000000 8459bc00 00000000 5cc0: df9d5cf4 2144f48e 804bcdf0 df9d5d90 00000000 00000006 85093a80 8459bc00 5ce0: 00000000 00000000 df9d5d54 df9d5cf8 8047f370 804bd914 80494464 80479d24 5d00: df9d5dc4 83fc0c00 00000000 00000000 20000000 850f7c00 df9d5d54 df9d5d28 5d20: 8459bc00 804943ec fc097003 00000214 83fc0c00 20000000 85093a80 20000000 5d40: 850f7c00 00000000 df9d5e04 df9d5d58 80480c54 8047f17c 850f7c40 ffffffff 5d60: df9d5dc8 20000000 81c66394 8424430c 850f7c40 20000000 20ffffff 8424430c 5d80: 00000000 ffffffff df9d5d90 df9d5e88 85093a80 00000cc0 00020000 20000000 5da0: 20000000 00000a14 8644c800 84f05300 00000680 00000000 00000000 00000000 5dc0: 00000000 def6a550 00000000 00000000 df9d5e04 2144f48e 80480310 df9d5e88 5de0: 20000000 00000214 00000207 20000000 850f7c00 00000007 df9d5e4c df9d5e08 5e00: 80215d94 80480888 00000000 df9d5e18 8031cac0 80318ad4 0001f83f 83fc0c00 5e20: ffffffff 8261d0e0 00000207 20000000 df9d5e88 80215c4c 83fc0c00 81701b1c 5e40: df9d5e84 df9d5e50 802161dc 80215c58 806d7774 806d1fa0 df9d5e64 00000298 5e60: 00000000 8184a144 80000013 ffffffff df9d5ebc 84272000 df9d5efc df9d5e88 5e80: 80200ae4 802161b0 20000000 7effffff a1000003 00000000 00000008 00000065 5ea0: 00000000 00000000 84272000 20000000 81701b1c df9d5efc df9d5f00 df9d5ed8 5ec0: 81701b4c 8184a144 80000013 ffffffff df9d5efc df9d5ee0 00000000 00000065 5ee0: 00000000 00000008 84831680 20000000 df9d5f4c df9d5f00 8137b504 81701b28 5f00: 20000000 00000008 00000000 80200288 83fc0c00 00000127 00000000 2144f48e 5f20: 8051ccf4 00000000 00000065 00000008 00000000 84831680 83fc0c00 00000127 5f40: df9d5fa4 df9d5f50 8137d220 8137b3f0 00000000 00000000 20000000 00000000 5f60: 8261ca0c fffffff7 00000001 00000000 00000000 20000000 00000000 2144f48e 5f80: 8020ca6c 20000000 00000000 0014c2d0 00000127 80200288 00000000 df9d5fa8 5fa0: 80200060 8137d19c 20000000 00000000 00000003 00000065 00000008 00000000 5fc0: 20000000 00000000 0014c2d0 00000127 7e87932e 7e87932f 003d0f00 76b460fc 5fe0: 76b45f08 76b45ef8 000167f8 00050bc0 60000010 00000003 00000000 00000000 Call trace: [<807e85b4>] (sg_init_one) from [<804c3ddc>] (zswap_decompress+0xbc/0x208 mm/zswap.c:1089) r7:841cdd80 r6:dec96d44 r5:84eed7d0 r4:ff7e7efc [<804c3d20>] (zswap_decompress) from [<804c6a20>] (zswap_load+0x15c/0x198 mm/zswap.c:1637) r9:845e2b00 r8:845e2b00 r7:845e2b04 r6:dec96d44 r5:00000006 r4:84eed7d0 [<804c68c4>] (zswap_load) from [<804bbbfc>] (swap_read_folio+0xa8/0x498 mm/page_io.c:518) r9:8459bc00 r8:83fc0c00 r7:00000000 r6:df9d5c24 r5:00000001 r4:dec96d44 [<804bbb54>] (swap_read_folio) from [<804bd61c>] (swap_cluster_readahead+0x1c4/0x34c mm/swap_state.c:684) r10:00000000 r9:00000007 r8:df9d5c23 r7:00000000 r6:00000000 r5:00100cca r4:00000006 [<804bd458>] (swap_cluster_readahead) from [<804bd970>] (swapin_readahead+0x68/0x4a8 mm/swap_state.c:904) r10:df9d5d90 r9:00000000 r8:00100cca r7:85093a80 r6:00000006 r5:00000000 r4:00000001 [<804bd908>] (swapin_readahead) from [<8047f370>] (do_swap_page+0x200/0xcc4 mm/memory.c:4046) r10:00000000 r9:00000000 r8:8459bc00 r7:85093a80 r6:00000006 r5:00000000 r4:df9d5d90 [<8047f170>] (do_swap_page) from [<80480c54>] (handle_pte_fault mm/memory.c:5301 [inline]) [<8047f170>] (do_swap_page) from [<80480c54>] (__handle_mm_fault mm/memory.c:5439 [inline]) [<8047f170>] (do_swap_page) from [<80480c54>] (handle_mm_fault+0x3d8/0x12b8 mm/memory.c:5604) r10:00000000 r9:850f7c00 r8:20000000 r7:85093a80 r6:20000000 r5:83fc0c00 r4:00000214 [<8048087c>] (handle_mm_fault) from [<80215d94>] (do_page_fault+0x148/0x3a8 arch/arm/mm/fault.c:333) r10:00000007 r9:850f7c00 r8:20000000 r7:00000207 r6:00000214 r5:20000000 r4:df9d5e88 [<80215c4c>] (do_page_fault) from [<802161dc>] (do_DataAbort+0x38/0xa8 arch/arm/mm/fault.c:565) r10:81701b1c r9:83fc0c00 r8:80215c4c r7:df9d5e88 r6:20000000 r5:00000207 r4:8261d0e0 [<802161a4>] (do_DataAbort) from [<80200ae4>] (__dabt_svc+0x44/0x60 arch/arm/kernel/entry-armv.S:212) Exception stack(0xdf9d5e88 to 0xdf9d5ed0) 5e80: 20000000 7effffff a1000003 00000000 00000008 00000065 5ea0: 00000000 00000000 84272000 20000000 81701b1c df9d5efc df9d5f00 df9d5ed8 5ec0: 81701b4c 8184a144 80000013 ffffffff r8:84272000 r7:df9d5ebc r6:ffffffff r5:80000013 r4:8184a144 [<81701b1c>] (raw_getsockopt) from [<8137b504>] (do_sock_getsockopt+0x120/0x274 net/socket.c:2373) r9:20000000 r8:84831680 r7:00000008 r6:00000000 r5:00000065 r4:00000000 [<8137b3e4>] (do_sock_getsockopt) from [<8137d220>] (__sys_getsockopt net/socket.c:2402 [inline]) [<8137b3e4>] (do_sock_getsockopt) from [<8137d220>] (__do_sys_getsockopt net/socket.c:2412 [inline]) [<8137b3e4>] (do_sock_getsockopt) from [<8137d220>] (sys_getsockopt+0x90/0xd4 net/socket.c:2409) r10:00000127 r9:83fc0c00 r8:84831680 r7:00000000 r6:00000008 r5:00000065 r4:00000000 [<8137d190>] (sys_getsockopt) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xdf9d5fa8 to 0xdf9d5ff0) 5fa0: 20000000 00000000 00000003 00000065 00000008 00000000 5fc0: 20000000 00000000 0014c2d0 00000127 7e87932e 7e87932f 003d0f00 76b460fc 5fe0: 76b45f08 76b45ef8 000167f8 00050bc0 r8:80200288 r7:00000127 r6:0014c2d0 r5:00000000 r4:20000000 Code: 1a000004 e1822003 e8860094 e89da8f0 (e7f001f2) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 1a000004 bne 0x18 4: e1822003 orr r2, r2, r3 8: e8860094 stm r6, {r2, r4, r7} c: e89da8f0 ldm sp, {r4, r5, r6, r7, fp, sp, pc} * 10: e7f001f2 udf #18 <-- trapping instruction