8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 0000000e when read
[0000000e] *pgd=84af5003, *pmd=dfbba003
Internal error: Oops: 205 [#1] SMP ARM
Modules linked in:
CPU: 1 UID: 0 PID: 11133 Comm: syz.1.1655 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
PC is at io_ring_buffer_select io_uring/kbuf.c:163 [inline]
PC is at io_buffer_select+0x50/0x18c io_uring/kbuf.c:207
LR is at rcu_read_unlock include/linux/rcupdate.h:873 [inline]
LR is at xa_load+0x68/0xa4 lib/xarray.c:1621
pc : [<80889bf4>]    lr : [<81a4c414>]    psr: 20000013
sp : e08e1dd0  ip : e08e1d90  fp : e08e1dec
r10: 00000240  r9 : 80000001  r8 : 00000000
r7 : e08e1e10  r6 : 00000000  r5 : 84bd5100  r4 : 855cd6c0
r3 : 00000001  r2 : 00000000  r1 : 851129c0  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 85354980  DAC: 00000000
Register r0 information: NULL pointer
Register r1 information: slab kmalloc-64 start 851129c0 pointer offset 0 size 64
Register r2 information: NULL pointer
Register r3 information: non-paged memory
Register r4 information: slab io_kiocb start 855cd6c0 pointer offset 0 size 192
Register r5 information: slab kmalloc-2k start 84bd5000 pointer offset 256 size 2048
Register r6 information: NULL pointer
Register r7 information: 2-page vmalloc region starting at 0xe08e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Register r8 information: NULL pointer
Register r9 information: non-slab/vmalloc memory
Register r10 information: non-paged memory
Register r11 information: 2-page vmalloc region starting at 0xe08e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Register r12 information: 2-page vmalloc region starting at 0xe08e0000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2844
Process syz.1.1655 (pid: 11133, stack limit = 0xe08e0000)
Stack: (0xe08e1dd0 to 0xe08e2000)
1dc0:                                     84c9fb80 855cd6c0 851b1e00 00000000
1de0: e08e1e54 e08e1df0 8089345c 80889bb0 00000000 e08e1dd8 851b1e00 45d67497
1e00: 00010001 00000001 84bd5128 00000000 00000000 0000001b 00000000 85971800
1e20: e08e1e4c 45d67497 e08e1e54 855cd6c0 81cf0ca0 00000000 00000000 00000000
1e40: 80000001 85971800 e08e1e7c e08e1e58 808823a4 8089311c 855cd6c0 80000001
1e60: 0000001b 81cf0b5c 860dccc0 00000000 e08e1ebc e08e1e80 80886e74 80882364
1e80: 855cd3c0 855cd540 855cd000 81cf0ca0 855cd300 84bd5000 855cd72c 855cd6c0
1ea0: 85dc0000 00000000 00000000 85971800 e08e1f14 e08e1ec0 8088798c 80886e38
1ec0: 8088e348 81a4c3b8 e08e1f44 e08e1ed8 00000800 00000800 81cf0b5c 00000800
1ee0: 84bd5000 45d67497 860dc600 00000000 84bd5000 00003516 860dc600 00000000
1f00: 85971800 00000000 e08e1fa4 e08e1f18 80888434 8088778c 8029eafc 84bd5040
1f20: 00000000 00000000 e08e1f94 80200be4 85971800 30c5387d e08e1f5c e08e1f48
1f40: 81a540a8 8029ce24 802001ec 60000013 00000000 e08e1f60 80200c04 81a54068
1f60: 00000008 00003516 00000000 00000000 00000000 45d67497 002e643c 00000000
1f80: 00000000 002e643c 000001aa 8020029c 85971800 000001aa 00000000 e08e1fa8
1fa0: 80200060 80888308 00000000 00000000 00000008 00003516 00000000 00000000
1fc0: 00000000 00000000 002e643c 000001aa 002d0000 00000000 00006364 76b0b0bc
1fe0: 76b0aec0 76b0aeb0 0001939c 00131f30 60000010 00000008 00000000 00000000
Call trace: 
[<80889ba4>] (io_buffer_select) from [<8089345c>] (io_recv_buf_select io_uring/net.c:1098 [inline])
[<80889ba4>] (io_buffer_select) from [<8089345c>] (io_recv+0x34c/0x46c io_uring/net.c:1138)
 r7:00000000 r6:851b1e00 r5:855cd6c0 r4:84c9fb80
[<80893110>] (io_recv) from [<808823a4>] (__io_issue_sqe+0x4c/0x1c0 io_uring/io_uring.c:1734)
 r10:85971800 r9:80000001 r8:00000000 r7:00000000 r6:00000000 r5:81cf0ca0
 r4:855cd6c0
[<80882358>] (__io_issue_sqe) from [<80886e74>] (io_issue_sqe+0x48/0x59c io_uring/io_uring.c:1757)
 r9:00000000 r8:860dccc0 r7:81cf0b5c r6:0000001b r5:80000001 r4:855cd6c0
[<80886e2c>] (io_issue_sqe) from [<8088798c>] (io_queue_sqe io_uring/io_uring.c:1963 [inline])
[<80886e2c>] (io_issue_sqe) from [<8088798c>] (io_submit_sqe io_uring/io_uring.c:2219 [inline])
[<80886e2c>] (io_issue_sqe) from [<8088798c>] (io_submit_sqes+0x20c/0x938 io_uring/io_uring.c:2336)
 r10:85971800 r9:00000000 r8:00000000 r7:85dc0000 r6:855cd6c0 r5:855cd72c
 r4:84bd5000
[<80887780>] (io_submit_sqes) from [<80888434>] (__do_sys_io_uring_enter io_uring/io_uring.c:3396 [inline])
[<80887780>] (io_submit_sqes) from [<80888434>] (sys_io_uring_enter+0x138/0x780 io_uring/io_uring.c:3330)
 r10:00000000 r9:85971800 r8:00000000 r7:860dc600 r6:00003516 r5:84bd5000
 r4:00000000
[<808882fc>] (sys_io_uring_enter) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xe08e1fa8 to 0xe08e1ff0)
1fa0:                   00000000 00000000 00000008 00003516 00000000 00000000
1fc0: 00000000 00000000 002e643c 000001aa 002d0000 00000000 00006364 76b0b0bc
1fe0: 76b0aec0 76b0aeb0 0001939c 00131f30
 r10:000001aa r9:85971800 r8:8020029c r7:000001aa r6:002e643c r5:00000000
 r4:00000000
Code: e3130001 0a00002f e5910000 e1d120be (e1d030be) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e3130001 	tst	r3, #1
   4:	0a00002f 	beq	0xc8
   8:	e5910000 	ldr	r0, [r1]
   c:	e1d120be 	ldrh	r2, [r1, #14]
* 10:	e1d030be 	ldrh	r3, [r0, #14] <-- trapping instruction