8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=87f0a003, *pmd=df021003
Internal error: Oops: a07 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 20147 Comm: syz-executor.0 Not tainted 6.7.0-rc6-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2383 [inline]
PC is at do_pagemap_scan+0x308/0x698 fs/proc/task_mmu.c:2430
LR is at 0x10
pc : [<80581284>]    lr : [<00000010>]    psr: 20000013
sp : e04b1dd0  ip : 00000000  fp : e04b1eb4
r10: e04b1e00  r9 : 00000000  r8 : 836b3c00
r7 : 00000000  r6 : 891cd200  r5 : 20ffe000  r4 : 00000000
r3 : 20ffe000  r2 : 00000000  r1 : 00000000  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 9a72e000  DAC: fffffffd
Register r0 information: NULL pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: NULL pointer
Register r5 information: non-paged memory
Register r6 information: slab mm_struct start 891cd200 pointer offset 0 size 712
Register r7 information: NULL pointer
Register r8 information: slab task_struct start 836b3c00 pointer offset 0 size 3072
Register r9 information: NULL pointer
Register r10 information: 2-page vmalloc region starting at 0xe04b0000 allocated at kernel_clone+0xac/0x41c kernel/fork.c:2907
Register r11 information: 2-page vmalloc region starting at 0xe04b0000 allocated at kernel_clone+0xac/0x41c kernel/fork.c:2907
Register r12 information: NULL pointer
Process syz-executor.0 (pid: 20147, stack limit = 0xe04b0000)
Stack: (0xe04b1dd0 to 0xe04b2000)
1dc0:                                     00000000 00000000 06000000 200014c0
1de0: 20ffe000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1e00: 00000060 00000000 00000000 00000000 20ffe000 00000000 20ffe000 00000000
1e20: 00000000 00000000 20001480 00000000 00000000 06000000 ffffffff 00000000
1e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
1e60: 00000000 00000000 00000010 00000000 00000000 00000000 20001480 00000000
1e80: c0606610 5edc5e31 e04b1ea4 c0606610 00000000 86fa2b41 200014c0 86fa2b40
1ea0: 00000003 836b3c00 e04b1ec4 e04b1eb8 8058163c 80580f88 e04b1fa4 e04b1ec8
1ec0: 804f95f8 80581620 00050af0 00000000 00000000 00000000 e04b1f04 e04b1ee8
1ee0: 8020c0ac 8020d078 00000000 00000001 8185e2b8 ecac8b10 e04b1f44 e04b1f08
1f00: 8020d100 8020c094 000f4240 00000000 8020c954 e04b1fac 836b3c00 00000001
1f20: ecac8b10 836b3c00 e04b1f44 e04b1f38 81852c78 81852b48 e04b1f5c e04b1f48
1f40: 8024c5d8 802792c8 40000000 e04b1fb0 e04b1f84 e04b1f60 802030e4 8024c594
1f60: 8261c928 e04b1fb0 0006b320 ecac8b10 80202fcc 5edc5e31 e04b1fac 00000000
1f80: 00000000 0014c2c0 00000036 80200288 836b3c00 00000036 00000000 e04b1fa8
1fa0: 80200060 804f94ec 00000000 00000000 00000003 c0606610 200014c0 00000000
1fc0: 00000000 00000000 0014c2c0 00000036 7edd232e 7edd232f 003d0f00 76be60fc
1fe0: 76be5f08 76be5ef8 000167a0 00050af0 60000010 00000003 00000000 00000000
Backtrace: 
[<80580f7c>] (do_pagemap_scan) from [<8058163c>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2494)
 r10:836b3c00 r9:00000003 r8:86fa2b40 r7:200014c0 r6:86fa2b41 r5:00000000
 r4:c0606610
[<80581614>] (do_pagemap_cmd) from [<804f95f8>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<80581614>] (do_pagemap_cmd) from [<804f95f8>] (do_vfs_ioctl fs/ioctl.c:831 [inline])
[<80581614>] (do_pagemap_cmd) from [<804f95f8>] (__do_sys_ioctl fs/ioctl.c:869 [inline])
[<80581614>] (do_pagemap_cmd) from [<804f95f8>] (sys_ioctl+0x118/0xb58 fs/ioctl.c:857)
[<804f94e0>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66)
Exception stack(0xe04b1fa8 to 0xe04b1ff0)
1fa0:                   00000000 00000000 00000003 c0606610 200014c0 00000000
1fc0: 00000000 00000000 0014c2c0 00000036 7edd232e 7edd232f 003d0f00 76be60fc
1fe0: 76be5f08 76be5ef8 000167a0 00050af0
 r10:00000036 r9:836b3c00 r8:80200288 r7:00000036 r6:0014c2c0 r5:00000000
 r4:00000000
Code: e51b2098 e51b108c e50b103c e3a01000 (e1ce00f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b2098 	ldr	r2, [fp, #-152]	@ 0xffffff68
   4:	e51b108c 	ldr	r1, [fp, #-140]	@ 0xffffff74
   8:	e50b103c 	str	r1, [fp, #-60]	@ 0xffffffc4
   c:	e3a01000 	mov	r1, #0
* 10:	e1ce00f8 	strd	r0, [lr, #8] <-- trapping instruction