8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 000000a0 pgd = 86b70a40 [000000a0] *pgd=86b24003, *pmd=fe61e003 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 20035 Comm: iou-sqp-20020 Not tainted 5.12.0-rc3-syzkaller #0 Hardware name: ARM-Versatile Express PC is at atomic_add arch/arm/include/asm/atomic.h:223 [inline] PC is at atomic_inc include/linux/atomic-fallback.h:372 [inline] PC is at io_uring_cancel_sqpoll+0xac/0x1a0 fs/io_uring.c:8926 LR is at io_sq_thread+0x3d0/0x6f8 fs/io_uring.c:6772 pc : [<80561f00>] lr : [<80566f50>] psr: 60000013 sp : 865c5ee0 ip : 86a35140 fp : 865c5f2c r10: 00000000 r9 : 865c4000 r8 : 00000000 r7 : 86734000 r6 : 86b64200 r5 : 86b64254 r4 : 86734000 r3 : 000000a0 r2 : 865c4000 r1 : 000000a0 r0 : 865c5ef4 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 86b70a40 DAC: 00000000 Process iou-sqp-20020 (pid: 20035, stack limit = 0x865c4210) Stack: (0x865c5ee0 to 0x865c6000) 5ee0: 00000000 000000a0 00000000 86a35140 802a6878 865c5ef4 865c5ef4 56b92eae 5f00: 00000001 86734000 86b64254 86b64200 00000000 00000000 865c4000 00000000 5f20: 865c5fac 865c5f30 80566f50 80561e60 86b64204 81f744cc 82a06d00 00000000 5f40: 80384db8 86b64200 837e8580 86b64254 00000000 00000000 00000000 86a35140 5f60: 802a6878 865c5f64 865c5f64 2d756f69 2d707173 32303032 80250030 56b92eae 5f80: 00000000 86b64200 80566b80 00000000 00000000 00000000 00000000 00000000 5fa0: 00000000 865c5fb0 80200114 80566b8c 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Backtrace: [<80561e54>] (io_uring_cancel_sqpoll) from [<80566f50>] (io_sq_thread+0x3d0/0x6f8 fs/io_uring.c:6772) r10:00000000 r9:865c4000 r8:00000000 r7:00000000 r6:86b64200 r5:86b64254 r4:86734000 [<80566b80>] (io_sq_thread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158) Exception stack(0x865c5fb0 to 0x865c5ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80566b80 r4:86b64200 Code: e28830a0 e50b3048 f593f000 e1a01003 (e1913f9f) ---[ end trace d3cf0d69d9b91477 ]--- ---------------- Code disassembly (best guess): 0: e28830a0 add r3, r8, #160 ; 0xa0 4: e50b3048 str r3, [fp, #-72] ; 0xffffffb8 8: f593f000 pldw [r3] c: e1a01003 mov r1, r3 * 10: e1913f9f ldrex r3, [r1] <-- trapping instruction