8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = 86cd8f40 [00000000] *pgd=86f81003, *pmd=fe749003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 8511 Comm: syz-executor.0 Not tainted 5.12.0-rc3-syzkaller #0 Hardware name: ARM-Versatile Express PC is at __list_del_entry_valid+0x28/0x9c lib/list_debug.c:51 LR is at __list_del_entry include/linux/list.h:132 [inline] LR is at list_del_init include/linux/list.h:204 [inline] LR is at __fw_load_abort drivers/base/firmware_loader/fallback.c:97 [inline] LR is at __fw_load_abort drivers/base/firmware_loader/fallback.c:88 [inline] LR is at kill_pending_fw_fallback_reqs+0x64/0xb4 drivers/base/firmware_loader/fallback.c:119 pc : [<808072e4>] lr : [<80a3996c>] psr: 80000013 sp : 86d3bc00 ip : 86d3bc10 fp : 86d3bc0c r10: 833ba640 r9 : 86e19f80 r8 : 00000003 r7 : 00000001 r6 : 82b6b2d0 r5 : ffffff94 r4 : 86e19fec r3 : 00000000 r2 : 00000000 r1 : 00000122 r0 : 86e19fec Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 86cd8f40 DAC: fffffffd Process syz-executor.0 (pid: 8511, stack limit = 0x86d3a210) Stack: (0x86d3bc00 to 0x86d3c000) bc00: 86d3bc34 86d3bc10 80a3996c 808072c8 82b85378 00000001 fffffffa 86d3bc90 bc20: 00000001 00000000 86d3bc4c 86d3bc38 80a37988 80a39914 82b85378 00000001 bc40: 86d3bc84 86d3bc50 80275934 80a37958 81f4aaf0 81f4aad4 81825014 82b0a558 bc60: 82a40bb0 00000000 00000002 00000000 82a40c00 81a0367c 86d3bcbc 86d3bc88 bc80: 80275bf8 802758dc 86d3bc90 84067bd8 00000004 56b92eae 83278a04 00000000 bca0: 85891780 82b65e18 84067bd8 000000e7 86d3bccc 86d3bcc0 802c7910 80275b9c bcc0: 86d3bce4 86d3bcd0 802d05c4 802c78f8 82a41068 82b65e64 86d3bd14 86d3bce8 bce0: 8098d3d0 802d0524 8098d290 8375d5c0 84067bd8 81b1e1fc 85891780 804e0074 bd00: 85891788 00000000 86d3bd44 86d3bd18 804e013c 8098d29c 806f319c 56b92eae bd20: 85891780 84067bd8 00000000 86d3be58 804e0074 85891788 86d3bd6c 86d3bd48 bd40: 804d565c 804e0080 00000000 86d3bf20 82a3c39c 86d3be58 85891780 00000000 bd60: 86d3bd7c 86d3bd70 804d7564 804d5520 86d3be54 86d3bd80 804ec9dc 804d753c bd80: 00000002 00000000 86d3bda4 86d3bd98 8181dacc 8181d97c 00000041 81f713c8 bda0: 82b09c84 56b92eae 86d3a000 828a2680 828a2680 00000000 00000000 00000000 bdc0: 00000002 84067bd8 86d3be4c 86d3bdd8 802bfb9c 8181dabc 00000001 00000000 bde0: 00000000 80502990 86746828 00000001 82b09c84 828a2680 86d3be14 86d3be08 be00: 8181dacc 8181d97c 86d3be44 86d3be18 8181c9a4 86746808 86d38bd0 86d3be68 be20: 86d3be54 56b92eae 60000013 86d3bf58 86d3be58 86d3bf20 00000001 80200224 be40: 86d3a000 00000142 86d3bf0c 86d3be58 804ef4ac 804ec438 8577c850 83dcc840 be60: 3bb95240 00000008 835b1015 56b92eae 00000000 83ebf9c0 84067bd8 00000101 be80: 00000002 00001324 0000daac 00000000 00000000 00000000 86d3be9c 8027e0bc bea0: 00000003 00000001 86d3befc 86d3beb8 80502a5c 81826a2c 86d3bef4 81f9199c bec0: 81f40284 00000000 86d38bc0 835b1000 00000000 00000002 ffffff9c 00000000 bee0: ffff41ed 80200224 86d3a000 56b92eae 86d3bf58 835b1000 00000003 ffffff9c bf00: 86d3bf54 86d3bf10 804d782c 804ef43c 802b4aec 802b463c 86d3bfb0 76fc4fd4 bf20: 00000000 86d30000 00000004 00000100 00000001 56b92eae ffffff9c 20000000 bf40: 00000000 00000142 86d3bfa4 86d3bf58 804d7cd0 804d7790 00000000 00000000 bf60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 bf80: 00000000 00000000 80384db8 56b92eae 00000000 00000000 00000000 86d3bfa8 bfa0: 80200060 804d7c38 00000000 00000000 ffffff9c 20000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000142 7ee4c32a 76fc56d0 7ee4c4ac 76fc520c bfe0: 76fc5048 76fc5038 00018d70 0004b620 60000010 ffffff9c 00000000 00000000 Backtrace: [<808072bc>] (__list_del_entry_valid) from [<80a3996c>] (__list_del_entry include/linux/list.h:132 [inline]) [<808072bc>] (__list_del_entry_valid) from [<80a3996c>] (list_del_init include/linux/list.h:204 [inline]) [<808072bc>] (__list_del_entry_valid) from [<80a3996c>] (__fw_load_abort drivers/base/firmware_loader/fallback.c:97 [inline]) [<808072bc>] (__list_del_entry_valid) from [<80a3996c>] (__fw_load_abort drivers/base/firmware_loader/fallback.c:88 [inline]) [<808072bc>] (__list_del_entry_valid) from [<80a3996c>] (kill_pending_fw_fallback_reqs+0x64/0xb4 drivers/base/firmware_loader/fallback.c:119) [<80a39908>] (kill_pending_fw_fallback_reqs) from [<80a37988>] (fw_pm_notify+0x3c/0x104 drivers/base/firmware_loader/main.c:1448) r9:00000000 r8:00000001 r7:86d3bc90 r6:fffffffa r5:00000001 r4:82b85378 [<80a3794c>] (fw_pm_notify) from [<80275934>] (notifier_call_chain+0x64/0xe0 kernel/notifier.c:83) r5:00000001 r4:82b85378 [<802758d0>] (notifier_call_chain) from [<80275bf8>] (notifier_call_chain_robust kernel/notifier.c:118 [inline]) [<802758d0>] (notifier_call_chain) from [<80275bf8>] (blocking_notifier_call_chain_robust kernel/notifier.c:302 [inline]) [<802758d0>] (notifier_call_chain) from [<80275bf8>] (blocking_notifier_call_chain_robust+0x68/0xc8 kernel/notifier.c:290) r10:81a0367c r9:82a40c00 r8:00000000 r7:00000002 r6:00000000 r5:82a40bb0 r4:82b0a558 [<80275b90>] (blocking_notifier_call_chain_robust) from [<802c7910>] (pm_notifier_call_chain_robust+0x24/0x38 kernel/power/main.c:87) r9:000000e7 r8:84067bd8 r7:82b65e18 r6:85891780 r5:00000000 r4:83278a04 [<802c78ec>] (pm_notifier_call_chain_robust) from [<802d05c4>] (snapshot_open+0xac/0x12c kernel/power/user.c:75) [<802d0518>] (snapshot_open) from [<8098d3d0>] (misc_open+0x140/0x178 drivers/char/misc.c:141) r5:82b65e64 r4:82a41068 [<8098d290>] (misc_open) from [<804e013c>] (chrdev_open+0xc8/0x244 fs/char_dev.c:414) r10:00000000 r9:85891788 r8:804e0074 r7:85891780 r6:81b1e1fc r5:84067bd8 r4:8375d5c0 r3:8098d290 [<804e0074>] (chrdev_open) from [<804d565c>] (do_dentry_open+0x148/0x3e8 fs/open.c:826) r9:85891788 r8:804e0074 r7:86d3be58 r6:00000000 r5:84067bd8 r4:85891780 [<804d5514>] (do_dentry_open) from [<804d7564>] (vfs_open+0x34/0x38 fs/open.c:940) r9:00000000 r8:85891780 r7:86d3be58 r6:82a3c39c r5:86d3bf20 r4:00000000 [<804d7530>] (vfs_open) from [<804ec9dc>] (do_open fs/namei.c:3365 [inline]) [<804d7530>] (vfs_open) from [<804ec9dc>] (path_openat+0x5b0/0x10f8 fs/namei.c:3498) [<804ec42c>] (path_openat) from [<804ef4ac>] (do_filp_open+0x7c/0x12c fs/namei.c:3525) r10:00000142 r9:86d3a000 r8:80200224 r7:00000001 r6:86d3bf20 r5:86d3be58 r4:86d3bf58 [<804ef430>] (do_filp_open) from [<804d782c>] (do_sys_openat2+0xa8/0x160 fs/open.c:1187) r7:ffffff9c r6:00000003 r5:835b1000 r4:86d3bf58 [<804d7784>] (do_sys_openat2) from [<804d7cd0>] (do_sys_open fs/open.c:1203 [inline]) [<804d7784>] (do_sys_openat2) from [<804d7cd0>] (__do_sys_openat fs/open.c:1219 [inline]) [<804d7784>] (do_sys_openat2) from [<804d7cd0>] (sys_openat+0xa4/0xcc fs/open.c:1214) r7:00000142 r6:00000000 r5:20000000 r4:ffffff9c [<804d7c2c>] (sys_openat) from [<80200060>] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64) Exception stack(0x86d3bfa8 to 0x86d3bff0) bfa0: 00000000 00000000 ffffff9c 20000000 00000000 00000000 bfc0: 00000000 00000000 00000000 00000142 7ee4c32a 76fc56d0 7ee4c4ac 76fc520c bfe0: 76fc5048 76fc5038 00018d70 0004b620 r5:00000000 r4:00000000 Code: 0a00000a e3001122 e1520001 0a000017 (e5921000) ---[ end trace d0e5f3f96c19d620 ]--- ---------------- Code disassembly (best guess): 0: 0a00000a beq 0x30 4: e3001122 movw r1, #290 ; 0x122 8: e1520001 cmp r2, r1 c: 0a000017 beq 0x70 * 10: e5921000 ldr r1, [r2] <-- trapping instruction