8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 [00000000] *pgd=85372003, *pmd=fe6dd003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 28234 Comm: syz-executor.1 Not tainted 6.1.0-rc6-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __queue_work+0xa0/0x74c kernel/workqueue.c:1459 LR is at 0x82c00000 pc : [<80260410>] lr : [<82c00000>] psr: 60000193 sp : df801e30 ip : 82c00024 fp : df801e74 r10: 8280e800 r9 : 00000000 r8 : 82446498 r7 : 8220c940 r6 : 00000008 r5 : 83ce5000 r4 : 848da05c r3 : 00000000 r2 : 00000000 r1 : 00000004 r0 : 8280e800 Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85239140 DAC: fffffffd Register r0 information: slab kmalloc-512 start 8280e800 pointer offset 0 size 512 Register r1 information: non-paged memory Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: slab kmalloc-2k start 848da000 pointer offset 92 size 2048 Register r5 information: slab kmalloc-512 start 83ce5000 pointer offset 0 size 512 Register r6 information: non-paged memory Register r7 information: non-slab/vmalloc memory Register r8 information: non-slab/vmalloc memory Register r9 information: NULL pointer Register r10 information: slab kmalloc-512 start 8280e800 pointer offset 0 size 512 Register r11 information: 2-page vmalloc region starting at 0xdf800000 allocated at start_kernel+0x588/0x78c init/main.c:1041 Register r12 information: slab radix_tree_node start 82c00000 pointer offset 36 Process syz-executor.1 (pid: 28234, stack limit = 0xea85c000) Stack: (0xdf801e30 to 0xdf802000) 1e20: df801e8c df801e40 820a235c 84b05c00 1e40: 00000002 00000000 00000000 848da05c 00000008 83ce5000 20000113 00000100 1e60: 00061fb8 dddcc900 df801e94 df801e78 80260b0c 8026037c 848da030 816df1a4 1e80: 84b05c00 816df1a4 df801ea4 df801e98 816df1cc 80260ac8 df801edc df801ea8 1ea0: 802e4f38 816df1b0 000003ec dddcc900 82204d40 5886bcbe 848da030 816df1a4 1ec0: df801efc 823d9d10 00061fb8 84b05c00 df801f4c df801ee0 802e5474 802e4f14 1ee0: 84b05c00 82204d40 8220c5d8 8220c498 00000001 00000000 76bb06d0 00000000 1f00: df801f1c df801f10 8029b158 802fab48 df801f4c df801f20 80293fe8 5886bcbe 1f20: 82204084 82204084 00000002 00000001 ea85dfb0 00000002 00000100 84b05c00 1f40: df801fbc df801f50 8020133c 802e514c 8176e554 8176e440 00400040 82204d40 1f60: 00061fb9 81eba890 820a2344 0000000a 820aaa00 823d843a 823d94a0 8220c5d8 1f80: 8220c498 81ea8f64 820a23d0 82204080 8176e574 820aaa00 81eba890 81eba878 1fa0: ea85dfb0 00000000 76bb06d0 7ee3953c df801fd4 df801fc0 80249f48 802011dc 1fc0: 820aa9dc 81eba890 df801ffc df801fd8 8176dab8 80249eb8 000170dc 20000010 1fe0: ffffffff 84b05c00 820a2044 76bb06d0 ea85dfac df802000 81723aa0 8176da48 Backtrace: frame pointer underflow [<80260370>] (__queue_work) from [<80260b0c>] (queue_work_on+0x50/0x5c kernel/workqueue.c:1545) r10:dddcc900 r9:00061fb8 r8:00000100 r7:20000113 r6:83ce5000 r5:00000008 r4:848da05c [<80260abc>] (queue_work_on) from [<816df1cc>] (queue_work include/linux/workqueue.h:503 [inline]) [<80260abc>] (queue_work_on) from [<816df1cc>] (nci_cmd_timer+0x28/0x2c net/nfc/nci/core.c:615) r7:816df1a4 r6:84b05c00 r5:816df1a4 r4:848da030 [<816df1a4>] (nci_cmd_timer) from [<802e4f38>] (call_timer_fn+0x30/0x238 kernel/time/timer.c:1474) [<802e4f08>] (call_timer_fn) from [<802e5474>] (expire_timers kernel/time/timer.c:1519 [inline]) [<802e4f08>] (call_timer_fn) from [<802e5474>] (__run_timers kernel/time/timer.c:1790 [inline]) [<802e4f08>] (call_timer_fn) from [<802e5474>] (run_timer_softirq+0x334/0x470 kernel/time/timer.c:1803) r9:84b05c00 r8:00061fb8 r7:823d9d10 r6:df801efc r5:816df1a4 r4:848da030 [<802e5140>] (run_timer_softirq) from [<8020133c>] (__do_softirq+0x16c/0x498 kernel/softirq.c:571) r10:84b05c00 r9:00000100 r8:00000002 r7:ea85dfb0 r6:00000001 r5:00000002 r4:82204084 [<802011d0>] (__do_softirq) from [<80249f48>] (invoke_softirq kernel/softirq.c:445 [inline]) [<802011d0>] (__do_softirq) from [<80249f48>] (__irq_exit_rcu kernel/softirq.c:650 [inline]) [<802011d0>] (__do_softirq) from [<80249f48>] (__irq_exit_rcu kernel/softirq.c:640 [inline]) [<802011d0>] (__do_softirq) from [<80249f48>] (irq_exit+0x9c/0xe8 kernel/softirq.c:674) r10:7ee3953c r9:76bb06d0 r8:00000000 r7:ea85dfb0 r6:81eba878 r5:81eba890 r4:820aaa00 [<80249eac>] (irq_exit) from [<8176dab8>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:240) r5:81eba890 r4:820aa9dc [<8176da3c>] (generic_handle_arch_irq) from [<81723aa0>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:76bb06d0 r8:820a2044 r7:84b05c00 r6:ffffffff r5:20000010 r4:000170dc [<81723a84>] (call_with_stack) from [<80200e74>] (__irq_usr+0x74/0x80 arch/arm/kernel/entry-armv.S:436) Exception stack(0xea85dfb0 to 0xea85dff8) dfa0: ffffffff 00000004 000001b8 00000000 dfc0: 00000000 00008fa6 00000000 00000000 7ee393ca 76bb06d0 7ee3953c 76bb020c dfe0: 20000300 20000300 000170dc 000170dc 20000010 ffffffff Code: 0a00003b e59f06a8 eb532fa3 e1a0a000 (e5990000) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 0a00003b beq 0xf4 4: e59f06a8 ldr r0, [pc, #1704] ; 0x6b4 8: eb532fa3 bl 0x14cbe9c c: e1a0a000 mov sl, r0 * 10: e5990000 ldr r0, [r9] <-- trapping instruction