8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=84c23003, *pmd=fe9fc003
Internal error: Oops: a05 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 3937 Comm: syz-executor.0 Not tainted 6.12.0-rc6-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2704 [inline]
PC is at do_pagemap_scan+0x2ac/0x6f8 fs/proc/task_mmu.c:2750
LR is at kmalloc_noprof include/linux/slab.h:882 [inline]
LR is at kmalloc_array_noprof include/linux/slab.h:923 [inline]
LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2699 [inline]
LR is at do_pagemap_scan+0x278/0x6f8 fs/proc/task_mmu.c:2750
pc : [<805bfba0>]    lr : [<805bfb6c>]    psr: 20000013
sp : df9e1e18  ip : df9e1e18  fp : df9e1f04
r10: 00000000  r9 : 00000000  r8 : 00000000
r7 : df9e1e50  r6 : 84a22400  r5 : 20ffb000  r4 : 83d51e00
r3 : 20ffc000  r2 : 00000000  r1 : 00000000  r0 : 00000010
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 84c21940  DAC: fffffffd
Register r0 information: zero-size pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab mm_struct start 83d51e00 pointer offset 0 size 712
Register r5 information: non-paged memory
Register r6 information: slab task_struct start 84a22400 pointer offset 0 size 3072
Register r7 information: 2-page vmalloc region starting at 0xdf9e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2786
Register r8 information: NULL pointer
Register r9 information: NULL pointer
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xdf9e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2786
Register r12 information: 2-page vmalloc region starting at 0xdf9e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2786
Process syz-executor.0 (pid: 3937, stack limit = 0xdf9e0000)
Stack: (0xdf9e1e18 to 0xdf9e2000)
1e00:                                                       00000000 00000000
1e20: 00000000 00000000 00000001 20000200 20ffb000 00000000 00000000 00000000
1e40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000
1e60: 20ffb000 00000000 20ffc000 00000000 00000000 00000000 20000140 00000000
1e80: 00000000 10000000 ffffffff 00000000 00000000 00000000 00000000 00000000
1ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000
1ec0: 00000000 00000000 20000140 00000000 20000200 c86b6db6 df9e1ef4 c0606610
1ee0: 00000000 842e0541 20000200 00000003 842e0540 84a22400 df9e1f14 df9e1f08
1f00: 805c0014 805bf900 df9e1fa4 df9e1f18 80530080 805bfff8 84a22400 00000001
1f20: ecac8b10 84a22400 df9e1f44 df9e1f38 819bc3a0 819bc270 df9e1f5c df9e1f48
1f40: 8024bacc 8027b988 00000000 df9e1f58 80200bcc 8196bc4c 00000003 c0606610
1f60: 20000200 00000000 00000000 00000000 0014c2c8 c86b6db6 8020029c 00000000
1f80: 00000000 0014c2c8 00000036 8020029c 84a22400 00000036 00000000 df9e1fa8
1fa0: 80200060 8052ff58 00000000 00000000 00000003 c0606610 20000200 00000000
1fc0: 00000000 00000000 0014c2c8 00000036 7ea9e32e 7ea9e32f 003d0f00 76bce0fc
1fe0: 76bcdf08 76bcdef8 000167e8 00050bb0 60000010 00000003 00000000 00000000
Call trace: 
[<805bf8f4>] (do_pagemap_scan) from [<805c0014>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2817)
 r10:84a22400 r9:842e0540 r8:00000003 r7:20000200 r6:842e0541 r5:00000000
 r4:c0606610
[<805bffec>] (do_pagemap_cmd) from [<80530080>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<805bffec>] (do_pagemap_cmd) from [<80530080>] (__do_sys_ioctl fs/ioctl.c:907 [inline])
[<805bffec>] (do_pagemap_cmd) from [<80530080>] (sys_ioctl+0x134/0xd98 fs/ioctl.c:893)
[<8052ff4c>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9e1fa8 to 0xdf9e1ff0)
1fa0:                   00000000 00000000 00000003 c0606610 20000200 00000000
1fc0: 00000000 00000000 0014c2c8 00000036 7ea9e32e 7ea9e32f 003d0f00 76bce0fc
1fe0: 76bcdf08 76bcdef8 000167e8 00050bb0
 r10:00000036 r9:84a22400 r8:8020029c r7:00000036 r6:0014c2c8 r5:00000000
 r4:00000000
Code: e51b309c e51b108c e50b103c e3a01000 (e1c080f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b309c 	ldr	r3, [fp, #-156]	@ 0xffffff64
   4:	e51b108c 	ldr	r1, [fp, #-140]	@ 0xffffff74
   8:	e50b103c 	str	r1, [fp, #-60]	@ 0xffffffc4
   c:	e3a01000 	mov	r1, #0
* 10:	e1c080f8 	strd	r8, [r0, #8] <-- trapping instruction