BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1172fb067 P4D 1172fb067 PUD 1172fa067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 2799 Comm: syz-executor.0 Not tainted 6.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:63 [inline] RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:83 [inline] RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:72 [inline] RIP: 0010:scatterwalk_copychunks+0x111/0x160 crypto/scatterwalk.c:50 Code: ff ff 01 da 89 db 49 39 df 41 89 56 08 74 46 8b 47 0c 49 01 dc 49 29 df 03 47 08 39 c2 72 da e8 35 6e 07 00 48 89 c7 49 89 06 <8b> 40 08 41 89 46 08 89 c2 03 47 0c e9 10 ff ff ff 48 89 fe 4c 89 RSP: 0018:ffffc90005597710 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffc90006d83000 RDI: 0000000000000000 RBP: 0000000000000001 R08: ee62b060177e79bb R09: 0491b0a3b67464e6 R10: 78fbfbe0669080c7 R11: 82d8bd1b6060f805 R12: ffffc90006d83000 R13: 0000000000001000 R14: ffffc90005597750 R15: 0000000000000014 FS: 00007fb3702ef6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000001173fb000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: scatterwalk_map_and_copy+0x84/0xa0 crypto/scatterwalk.c:67 scomp_acomp_comp_decomp+0xc6/0x110 crypto/scompress.c:149 crypto_acomp_compress include/crypto/acompress.h:302 [inline] zswap_store+0x417/0xd70 mm/zswap.c:1674 swap_writepage+0x2e/0xb0 mm/page_io.c:198 pageout+0x11b/0x2f0 mm/vmscan.c:656 shrink_folio_list+0xcef/0xf10 mm/vmscan.c:1319 reclaim_folio_list+0x7f/0x120 mm/vmscan.c:2104 reclaim_pages+0x150/0x1c0 mm/vmscan.c:2140 madvise_cold_or_pageout_pte_range+0x2fa/0x620 mm/madvise.c:526 walk_pmd_range mm/pagewalk.c:143 [inline] walk_pud_range mm/pagewalk.c:221 [inline] walk_p4d_range mm/pagewalk.c:256 [inline] walk_pgd_range+0x415/0x720 mm/pagewalk.c:293 __walk_page_range+0x200/0x220 mm/pagewalk.c:395 walk_page_range+0x1df/0x2e0 mm/pagewalk.c:521 madvise_pageout_page_range mm/madvise.c:585 [inline] madvise_pageout+0xff/0x260 mm/madvise.c:612 madvise_vma_behavior mm/madvise.c:1031 [inline] madvise_walk_vmas mm/madvise.c:1260 [inline] do_madvise+0x6f2/0xfb0 mm/madvise.c:1440 __do_sys_madvise mm/madvise.c:1453 [inline] __se_sys_madvise mm/madvise.c:1451 [inline] __x64_sys_madvise+0x27/0x30 mm/madvise.c:1451 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fb37076cce9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb3702ef0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007fb37088bf80 RCX: 00007fb37076cce9 RDX: 0000000000000015 RSI: 0000000000c00304 RDI: 0000000020000000 RBP: 00007fb3707b947a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb37088bf80 R15: 00007ffef11347d8 Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- RIP: 0010:scatterwalk_start include/crypto/scatterwalk.h:63 [inline] RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:83 [inline] RIP: 0010:scatterwalk_pagedone include/crypto/scatterwalk.h:72 [inline] RIP: 0010:scatterwalk_copychunks+0x111/0x160 crypto/scatterwalk.c:50 Code: ff ff 01 da 89 db 49 39 df 41 89 56 08 74 46 8b 47 0c 49 01 dc 49 29 df 03 47 08 39 c2 72 da e8 35 6e 07 00 48 89 c7 49 89 06 <8b> 40 08 41 89 46 08 89 c2 03 47 0c e9 10 ff ff ff 48 89 fe 4c 89 RSP: 0018:ffffc90005597710 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000000 RDX: 0000000000001000 RSI: ffffc90006d83000 RDI: 0000000000000000 RBP: 0000000000000001 R08: ee62b060177e79bb R09: 0491b0a3b67464e6 R10: 78fbfbe0669080c7 R11: 82d8bd1b6060f805 R12: ffffc90006d83000 R13: 0000000000001000 R14: ffffc90005597750 R15: 0000000000000014 FS: 00007fb3702ef6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 00000001173fb000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: ff 01 incl (%rcx) 2: da 89 db 49 39 df fimull -0x20c6b625(%rcx) 8: 41 89 56 08 mov %edx,0x8(%r14) c: 74 46 je 0x54 e: 8b 47 0c mov 0xc(%rdi),%eax 11: 49 01 dc add %rbx,%r12 14: 49 29 df sub %rbx,%r15 17: 03 47 08 add 0x8(%rdi),%eax 1a: 39 c2 cmp %eax,%edx 1c: 72 da jb 0xfffffff8 1e: e8 35 6e 07 00 call 0x76e58 23: 48 89 c7 mov %rax,%rdi 26: 49 89 06 mov %rax,(%r14) * 29: 8b 40 08 mov 0x8(%rax),%eax <-- trapping instruction 2c: 41 89 46 08 mov %eax,0x8(%r14) 30: 89 c2 mov %eax,%edx 32: 03 47 0c add 0xc(%rdi),%eax 35: e9 10 ff ff ff jmp 0xffffff4a 3a: 48 89 fe mov %rdi,%rsi 3d: 4c rex.WR 3e: 89 .byte 0x89