8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 0000000e when read [0000000e] *pgd=80000080004003, *pmd=00000000 Internal error: Oops: 207 [#1] PREEMPT SMP ARM Modules linked in: CPU: 1 PID: 939 Comm: kworker/u6:5 Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events_unbound io_ring_exit_work PC is at __io_remove_buffers io_uring/kbuf.c:219 [inline] PC is at __io_remove_buffers+0x38/0x184 io_uring/kbuf.c:209 LR is at io_destroy_buffers+0x48/0x138 io_uring/kbuf.c:264 pc : [<807c967c>] lr : [<807c9c38>] psr: 20000113 sp : e0725e48 ip : e0725e78 fp : e0725e74 r10: 827e4691 r9 : 846f6000 r8 : ffffffff r7 : 846f634c r6 : 00000001 r5 : 846f0000 r4 : 00000000 r3 : 00000000 r2 : 00000000 r1 : 846f0000 r0 : 846f6000 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 89d52f00 DAC: 00000000 Register r0 information: slab kmalloc-2k start 846f6000 pointer offset 0 size 2048 Register r1 information: slab kmalloc-2k start 846f0000 pointer offset 0 size 2048 Register r2 information: NULL pointer Register r3 information: NULL pointer Register r4 information: NULL pointer Register r5 information: slab kmalloc-2k start 846f0000 pointer offset 0 size 2048 Register r6 information: non-paged memory Register r7 information: slab kmalloc-2k start 846f6000 pointer offset 844 size 2048 Register r8 information: non-paged memory Register r9 information: slab kmalloc-2k start 846f6000 pointer offset 0 size 2048 Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xe0724000 allocated at kernel_clone+0xac/0x424 kernel/fork.c:2909 Register r12 information: 2-page vmalloc region starting at 0xe0724000 allocated at kernel_clone+0xac/0x424 kernel/fork.c:2909 Process kworker/u6:5 (pid: 939, stack limit = 0xe0724000) Stack: (0xe0725e48 to 0xe0726000) 5e40: 836e0bc0 00000014 846f6000 846f6040 846f634c 82604d40 5e60: 846f63cc 827e4691 e0725e9c e0725e78 807c9c38 807c9650 00000000 5525ada1 5e80: 846f63bc 846f6000 846f6040 846f634c e0725f04 e0725ea0 818264f0 807c9bfc 5ea0: e0725ebc e0725eb0 000376a2 846f6000 00000000 e0725ec0 00000000 81825020 5ec0: 00000000 00000000 e0725ec8 e0725ec8 846f6000 5525ada1 e0725f48 83d57c00 5ee0: 846f63bc 82c21600 82c0f200 00000180 836e0bc0 82c21605 e0725f44 e0725f08 5f00: 80265fd4 81826154 e0725f2c e0725f18 e0725f44 e0725f20 8026196c 83d57c00 5f20: 83d57c2c 82c0f200 82604d40 82c0f220 836e0bc0 61c88647 e0725f84 e0725f48 5f40: 80266520 80265e44 82604d40 82604d40 61c88647 83d57c2c e0725f84 83d59dc0 5f60: 836e0bc0 802662e0 83d57c00 83c87880 df941e98 00000000 e0725fac e0725f88 5f80: 8026d8e0 802662ec 83d59dc0 8026d7dc 00000000 00000000 00000000 00000000 5fa0: 00000000 e0725fb0 80200104 8026d7e8 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Backtrace: [<807c9644>] (__io_remove_buffers) from [<807c9c38>] (io_destroy_buffers+0x48/0x138 io_uring/kbuf.c:264) r10:827e4691 r9:846f63cc r8:82604d40 r7:846f634c r6:846f6040 r5:846f6000 r4:00000014 r3:836e0bc0 [<807c9bf0>] (io_destroy_buffers) from [<818264f0>] (io_ring_ctx_free io_uring/io_uring.c:2895 [inline]) [<807c9bf0>] (io_destroy_buffers) from [<818264f0>] (io_ring_exit_work+0x3a8/0x5ec io_uring/io_uring.c:3151) r7:846f634c r6:846f6040 r5:846f6000 r4:846f63bc [<81826148>] (io_ring_exit_work) from [<80265fd4>] (process_one_work+0x19c/0x4a8 kernel/workqueue.c:2630) r10:82c21605 r9:836e0bc0 r8:00000180 r7:82c0f200 r6:82c21600 r5:846f63bc r4:83d57c00 [<80265e38>] (process_one_work) from [<80266520>] (process_scheduled_works kernel/workqueue.c:2703 [inline]) [<80265e38>] (process_one_work) from [<80266520>] (worker_thread+0x240/0x48c kernel/workqueue.c:2784) r10:61c88647 r9:836e0bc0 r8:82c0f220 r7:82604d40 r6:82c0f200 r5:83d57c2c r4:83d57c00 [<802662e0>] (worker_thread) from [<8026d8e0>] (kthread+0x104/0x134 kernel/kthread.c:388) r10:00000000 r9:df941e98 r8:83c87880 r7:83d57c00 r6:802662e0 r5:836e0bc0 r4:83d59dc0 [<8026d7dc>] (kthread) from [<80200104>] (ret_from_fork+0x14/0x30 arch/arm/kernel/entry-common.S:134) Exception stack(0xe0725fb0 to 0xe0725ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8026d7dc r4:83d59dc0 Code: 0a000022 e5913004 e1d120be e5d14013 (e1d380be) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 0a000022 beq 0x90 4: e5913004 ldr r3, [r1, #4] 8: e1d120be ldrh r2, [r1, #14] c: e5d14013 ldrb r4, [r1, #19] * 10: e1d380be ldrh r8, [r3, #14] <-- trapping instruction