8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=8461f003, *pmd=fe158003
Internal error: Oops: a05 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 PID: 5020 Comm: syz-executor Not tainted 6.10.0-rc7-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2417 [inline]
PC is at do_pagemap_scan+0x2ac/0x6f8 fs/proc/task_mmu.c:2463
LR is at kmalloc_noprof include/linux/slab.h:664 [inline]
LR is at kmalloc_array_noprof include/linux/slab.h:699 [inline]
LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2412 [inline]
LR is at do_pagemap_scan+0x278/0x6f8 fs/proc/task_mmu.c:2463
pc : [<805a7844>]    lr : [<805a7810>]    psr: 20000013
sp : df9bde18  ip : df9bde18  fp : df9bdf04
r10: 00000000  r9 : 00000000  r8 : 00000000
r7 : df9bde50  r6 : 8395ec00  r5 : 20165000  r4 : 8414bc00
r3 : 20ffb000  r2 : 00000000  r1 : 00000000  r0 : 00000010
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 846150c0  DAC: 00000000
Register r0 information: zero-size pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab mm_struct start 8414bc00 pointer offset 0 size 712
Register r5 information: non-paged memory
Register r6 information: slab task_struct start 8395ec00 pointer offset 0 size 3072
Register r7 information: 2-page vmalloc region starting at 0xdf9bc000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Register r8 information: NULL pointer
Register r9 information: NULL pointer
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xdf9bc000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Register r12 information: 2-page vmalloc region starting at 0xdf9bc000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Process syz-executor (pid: 5020, stack limit = 0xdf9bc000)
Stack: (0xdf9bde18 to 0xdf9be000)
de00:                                                       00000000 00000000
de20: 00000000 00000000 200004c0 00000001 20165000 00000000 00000000 00000000
de40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000
de60: 20165000 00000000 20ffb000 00000000 00000000 00000000 20000000 00000000
de80: 00000000 10000000 ffffffff 00000000 00000000 00000000 00000000 00000000
dea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000
dec0: 00000000 00000000 20000000 00000000 c0606610 26b635ba df9bdef4 c0606610
dee0: 00000000 84408c01 200004c0 84408c00 00000003 8395ec00 df9bdf14 df9bdf08
df00: 805a7cb8 805a75a4 df9bdfa4 df9bdf18 8051a5a8 805a7c9c 8395ec00 00000001
df20: ecac8b10 8395ec00 df9bdf44 df9bdf38 818f3c94 818f3b64 df9bdf5c df9bdf48
df40: 8024d2a4 8027cc9c 40000000 df9bdfb0 df9bdf84 df9bdf60 80202dc4 8024d260
df60: 8261c90c df9bdfb0 0006bf00 ecac8b10 80202cac 26b635ba df9bdfac 00000000
df80: 00000000 001542c8 00000036 8020029c 8395ec00 00000036 00000000 df9bdfa8
dfa0: 80200060 8051a480 00000000 00000000 00000003 c0606610 200004c0 00000000
dfc0: 00000000 00000000 001542c8 00000036 7ed4a336 7ed4a337 003d0f00 76b0b0fc
dfe0: 76b0af08 76b0aef8 00016f30 000516d0 60000010 00000003 00000000 00000000
Call trace: 
[<805a7598>] (do_pagemap_scan) from [<805a7cb8>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2530)
 r10:8395ec00 r9:00000003 r8:84408c00 r7:200004c0 r6:84408c01 r5:00000000
 r4:c0606610
[<805a7c90>] (do_pagemap_cmd) from [<8051a5a8>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<805a7c90>] (do_pagemap_cmd) from [<8051a5a8>] (do_vfs_ioctl fs/ioctl.c:861 [inline])
[<805a7c90>] (do_pagemap_cmd) from [<8051a5a8>] (__do_sys_ioctl fs/ioctl.c:905 [inline])
[<805a7c90>] (do_pagemap_cmd) from [<8051a5a8>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893)
[<8051a474>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf9bdfa8 to 0xdf9bdff0)
dfa0:                   00000000 00000000 00000003 c0606610 200004c0 00000000
dfc0: 00000000 00000000 001542c8 00000036 7ed4a336 7ed4a337 003d0f00 76b0b0fc
dfe0: 76b0af08 76b0aef8 00016f30 000516d0
 r10:00000036 r9:8395ec00 r8:8020029c r7:00000036 r6:001542c8 r5:00000000
 r4:00000000
Code: e51b309c e51b108c e50b103c e3a01000 (e1c080f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b309c 	ldr	r3, [fp, #-156]	@ 0xffffff64
   4:	e51b108c 	ldr	r1, [fp, #-140]	@ 0xffffff74
   8:	e50b103c 	str	r1, [fp, #-60]	@ 0xffffffc4
   c:	e3a01000 	mov	r1, #0
* 10:	e1c080f8 	strd	r8, [r0, #8] <-- trapping instruction