------------[ cut here ]------------ kernel BUG at include/linux/scatterlist.h:187! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 14624 Comm: syz-executor.0 Not tainted 6.9.0-rc1-syzkaller #0 Hardware name: ARM-Versatile Express PC is at sg_set_buf include/linux/scatterlist.h:187 [inline] PC is at sg_init_one+0x9c/0xa8 lib/scatterlist.c:143 LR is at sg_init_table+0x2c/0x40 lib/scatterlist.c:128 pc : [<807e8650>] lr : [<807e6a44>] psr: 80000113 sp : dffd9c38 ip : dffd9c70 fp : dffd9c54 r10: 00000000 r9 : ffefd004 r8 : ff7e7f1c r7 : 0000003e r6 : dffd9c58 r5 : 84143758 r4 : ffefd004 r3 : df000000 r2 : ffffffd8 r1 : 00000000 r0 : dffd9c58 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 85031a40 DAC: fffffffd Register r0 information: 2-page vmalloc region starting at 0xdffd8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r1 information: NULL pointer Register r2 information: non-paged memory Register r3 information: non-paged memory Register r4 information: non-paged memory Register r5 information: slab vmap_area start 84143758 pointer offset 0 size 40 Register r6 information: 2-page vmalloc region starting at 0xdffd8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r7 information: non-paged memory Register r8 information: 0-page vmalloc region starting at 0xff7d8000 allocated at pcpu_get_vm_areas+0x0/0x12c8 mm/vmalloc.c:3064 Register r9 information: non-paged memory Register r10 information: NULL pointer Register r11 information: 2-page vmalloc region starting at 0xdffd8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Register r12 information: 2-page vmalloc region starting at 0xdffd8000 allocated at kernel_clone+0xac/0x3cc kernel/fork.c:2796 Process syz-executor.0 (pid: 14624, stack limit = 0xdffd8000) Stack: (0xdffd9c38 to 0xdffda000) 9c20: ff7e7efc 84143758 9c40: dedd8d7c 83decf80 dffd9cb4 dffd9c58 804c3ddc 807e85c0 00000002 00000000 9c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9c80: 00000000 00000000 00000043 fc83f40c 84143758 00000043 dedd8d7c 8445e144 9ca0: 8445e140 8445e140 dffd9cdc dffd9cb8 804c6a20 804c3d2c dedd8d7c 00000001 9cc0: dffd9d4c 00000000 85306c00 84439d00 dffd9d2c dffd9ce0 804bbbfc 804c68d0 9ce0: 804bd120 802e27a0 dffd9d1c 00000000 00100cca 00000000 00000000 fc83f40c 9d00: dffd9d1c 00000043 00100cca 00000000 00000000 dffd9d4b 00000047 00000000 9d20: dffd9da4 dffd9d30 804bd61c 804bbb60 dffd9d4b 00000000 dddd0280 dedd8d7c 9d40: 00000043 00000043 01fd9db8 00000000 00000000 00000000 00000000 00000000 9d60: 00000001 00000000 dffd9d68 dffd9d68 818753b0 fc83f40c 00000406 00000001 9d80: 00000000 00000043 84dcda80 00100cca 00000000 dffd9eb8 dffd9e1c dffd9da8 9da0: 804bd970 804bd464 00000000 fc83f40c 802db4f4 dffd9eb8 00000000 00000000 9dc0: dffd9df4 dffd9dd0 8042e9b8 8042e80c dffd9eb8 8260cac8 84dcda80 20000000 9de0: 84439d00 00000000 dffd9e1c fc83f40c 804bcdf0 dffd9eb8 00000000 00000043 9e00: 84dcda80 84439d00 00000000 00000040 dffd9e7c dffd9e20 8047f370 804bd914 9e20: dffd9f2c dffd9e30 80200bb4 8189b884 dffd9eb8 00001a55 00000000 00000000 9e40: 00001255 85306c00 84439d00 84dcda80 85306c00 00001255 85306c00 20000900 9e60: 84dcda80 85306c00 851cc900 00000040 dffd9f2c dffd9e80 80480c54 8047f17c 9e80: 80200288 85306c00 000000f0 dffd9f44 00000000 dffd9eb0 dffd9ecc dffd9ea8 9ea0: 8027caf4 802ac7ac 00000000 81c66394 dffd9eb8 dffd9fb0 84dcda80 00000cc0 9ec0: 00020000 20000000 20000900 00001a55 846d8800 85031a40 00004300 00000000 9ee0: 00000000 00000000 00000000 defb129c 00000000 00000000 20ffffff fc83f40c 9f00: 00000000 dffd9fb0 20000900 00000255 00000a07 85306c00 851cc900 00000002 9f20: dffd9f74 dffd9f30 80215e14 80480888 81897c90 81897b5c dffd9f5c dffd9f48 9f40: 8024c880 84dcda80 40000000 8261d0e0 00000a07 20000900 dffd9fb0 80215c4c 9f60: 0014c29c 7ec414dc dffd9fac dffd9f78 802161dc 80215c58 dffd9fac dffd9f88 9f80: 8020ca6c 80203060 0006b3f4 0001d400 60000010 ffffffff 85306c00 824a9044 9fa0: 00000000 dffd9fb0 80200e3c 802161b0 00000000 00000000 00000000 20000900 9fc0: 00000008 00000000 00000000 000001f4 fffffffe 0014c29c 7ec414dc 002e3d38 9fe0: 0193a590 7ec413a8 0001d150 0001d400 60000010 ffffffff 00000000 00000000 Call trace: [<807e85b4>] (sg_init_one) from [<804c3ddc>] (zswap_decompress+0xbc/0x208 mm/zswap.c:1089) r7:83decf80 r6:dedd8d7c r5:84143758 r4:ff7e7efc [<804c3d20>] (zswap_decompress) from [<804c6a20>] (zswap_load+0x15c/0x198 mm/zswap.c:1637) r9:8445e140 r8:8445e140 r7:8445e144 r6:dedd8d7c r5:00000043 r4:84143758 [<804c68c4>] (zswap_load) from [<804bbbfc>] (swap_read_folio+0xa8/0x498 mm/page_io.c:518) r9:84439d00 r8:85306c00 r7:00000000 r6:dffd9d4c r5:00000001 r4:dedd8d7c [<804bbb54>] (swap_read_folio) from [<804bd61c>] (swap_cluster_readahead+0x1c4/0x34c mm/swap_state.c:684) r10:00000000 r9:00000047 r8:dffd9d4b r7:00000000 r6:00000000 r5:00100cca r4:00000043 [<804bd458>] (swap_cluster_readahead) from [<804bd970>] (swapin_readahead+0x68/0x4a8 mm/swap_state.c:904) r10:dffd9eb8 r9:00000000 r8:00100cca r7:84dcda80 r6:00000043 r5:00000000 r4:00000001 [<804bd908>] (swapin_readahead) from [<8047f370>] (do_swap_page+0x200/0xcc4 mm/memory.c:4046) r10:00000040 r9:00000000 r8:84439d00 r7:84dcda80 r6:00000043 r5:00000000 r4:dffd9eb8 [<8047f170>] (do_swap_page) from [<80480c54>] (handle_pte_fault mm/memory.c:5301 [inline]) [<8047f170>] (do_swap_page) from [<80480c54>] (__handle_mm_fault mm/memory.c:5439 [inline]) [<8047f170>] (do_swap_page) from [<80480c54>] (handle_mm_fault+0x3d8/0x12b8 mm/memory.c:5604) r10:00000040 r9:851cc900 r8:85306c00 r7:84dcda80 r6:20000900 r5:85306c00 r4:00001255 [<8048087c>] (handle_mm_fault) from [<80215e14>] (do_page_fault+0x1c8/0x3a8 arch/arm/mm/fault.c:299) r10:00000002 r9:851cc900 r8:85306c00 r7:00000a07 r6:00000255 r5:20000900 r4:dffd9fb0 [<80215c4c>] (do_page_fault) from [<802161dc>] (do_DataAbort+0x38/0xa8 arch/arm/mm/fault.c:565) r10:7ec414dc r9:0014c29c r8:80215c4c r7:dffd9fb0 r6:20000900 r5:00000a07 r4:8261d0e0 [<802161a4>] (do_DataAbort) from [<80200e3c>] (__dabt_usr+0x5c/0x60 arch/arm/kernel/entry-armv.S:427) Exception stack(0xdffd9fb0 to 0xdffd9ff8) 9fa0: 00000000 00000000 00000000 20000900 9fc0: 00000008 00000000 00000000 000001f4 fffffffe 0014c29c 7ec414dc 002e3d38 9fe0: 0193a590 7ec413a8 0001d150 0001d400 60000010 ffffffff r8:824a9044 r7:85306c00 r6:ffffffff r5:60000010 r4:0001d400 Code: 1a000004 e1822003 e8860094 e89da8f0 (e7f001f2) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 1a000004 bne 0x18 4: e1822003 orr r2, r2, r3 8: e8860094 stm r6, {r2, r4, r7} c: e89da8f0 ldm sp, {r4, r5, r6, r7, fp, sp, pc} * 10: e7f001f2 udf #18 <-- trapping instruction