8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000048 when read [00000048] *pgd=80000080004003, *pmd=00000000 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 1159 Comm: aoe_tx0 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at dummy_queue+0x70/0x244 drivers/usb/gadget/udc/dummy_hcd.c:737 LR is at usb_ep_queue+0x40/0x168 drivers/usb/gadget/udc/core.c:305 pc : [<810c2f10>] lr : [<810bec2c>] psr: a0000013 sp : ea4f5d58 ip : ea4f5da0 fp : ea4f5d9c r10: 86644100 r9 : 85f0c710 r8 : 83e77000 r7 : 85f0c700 r6 : 83e776b0 r5 : 83e7705c r4 : 86644108 r3 : 00000000 r2 : 85b9e234 r1 : 00000003 r0 : 83e7705c Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 863f2e80 DAC: fffffffd Register r0 information: slab kmalloc-4k start 83e77000 pointer offset 92 size 4096 Register r1 information: non-paged memory Register r2 information: slab kmalloc-2k start 85b9e000 pointer offset 564 size 2048 Register r3 information: NULL pointer Register r4 information: slab kmalloc-128 start 86644100 pointer offset 8 size 128 Register r5 information: slab kmalloc-4k start 83e77000 pointer offset 92 size 4096 Register r6 information: slab kmalloc-4k start 83e77000 pointer offset 1712 size 4096 Register r7 information: slab kmalloc-cg-2k start 85f0c000 pointer offset 1792 size 2048 Register r8 information: slab kmalloc-4k start 83e77000 pointer offset 0 size 4096 Register r9 information: slab kmalloc-cg-2k start 85f0c000 pointer offset 1808 size 2048 Register r10 information: slab kmalloc-128 start 86644100 pointer offset 0 size 128 Register r11 information: 2-page vmalloc region starting at 0xea4f4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Register r12 information: 2-page vmalloc region starting at 0xea4f4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2748 Process aoe_tx0 (pid: 1159, stack limit = 0xea4f4000) Stack: (0xea4f5d58 to 0xea4f6000) 5d40: 8163c5b8 816345bc 5d60: 819bdd94 8028f490 861b83c0 85b90800 85f0c000 83e7705c 86644108 861ba180 5d80: 85f0c700 85f0c714 85f0c710 83e7705c ea4f5dc4 ea4f5da0 810bec2c 810c2eac 5da0: 85f0c000 86644138 861ba180 85f0c700 85f0c714 85f0c710 ea4f5dfc ea4f5dc8 5dc0: 810f19c4 810bebf8 86644108 a0000013 861ba180 861ba180 85f0c000 81de20c4 5de0: 00000000 00000000 82a0b150 828d54ce ea4f5e4c ea4f5e00 8165dd68 810f1840 5e00: 85f0c000 ea4f5e57 ea4f5e58 00000000 00000020 84918c40 82522578 85bbe200 5e20: 861ba180 863fa000 861ba180 85bbe200 85f0c000 00000000 00000000 5b4fd000 5e40: ea4f5e84 ea4f5e50 816e5898 8165dc80 ea4f5e84 003fa148 00000010 71eb38c7 5e60: 861ba180 85bbe200 ff7662a0 85f0c000 a42692a0 863fa000 ea4f5f34 ea4f5e88 5e80: 8165ec00 816e5804 00000000 00000001 8022bb90 863fa148 00000020 00000001 5ea0: 81b6bd40 00d2cdf4 fffffff4 00000000 8022cc10 8022bb78 00000000 80f3a6e4 5ec0: ea4f5f4c ea4f5f38 80290bb4 80f3a6e4 00000000 00000000 00000000 82d2cde4 5ee0: 60000093 82d2cde4 ea4f5f0c ea4f5ef8 ea4f5f0c ea4f5f00 81b6bb44 8028f490 5f00: ea4f5f34 71eb38c7 816335a8 85f0c000 84918c40 00000001 82d2cdf4 846dec00 5f20: df819e08 00000000 ea4f5f4c ea4f5f38 80f3a70c 8165e0e8 82d2cdf4 84918c40 5f40: ea4f5f84 ea4f5f50 80f36200 80f3a69c 00000000 84918c40 8029d9a0 00000100 5f60: 00000122 71eb38c7 80f36170 846dd500 84918c40 80f36170 ea4f5fac ea4f5f88 5f80: 80282710 80f3617c 846dd500 802825f4 00000000 00000000 00000000 00000000 5fa0: 00000000 ea4f5fb0 80200114 80282600 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Call trace: [<810c2ea0>] (dummy_queue) from [<810bec2c>] (usb_ep_queue+0x40/0x168 drivers/usb/gadget/udc/core.c:305) r10:83e7705c r9:85f0c710 r8:85f0c714 r7:85f0c700 r6:861ba180 r5:86644108 r4:83e7705c [<810bebec>] (usb_ep_queue) from [<810f19c4>] (eth_start_xmit+0x190/0x534 drivers/usb/gadget/function/u_ether.c:579) r9:85f0c710 r8:85f0c714 r7:85f0c700 r6:861ba180 r5:86644138 r4:85f0c000 [<810f1834>] (eth_start_xmit) from [<8165dd68>] (__netdev_start_xmit include/linux/netdevice.h:5397 [inline]) [<810f1834>] (eth_start_xmit) from [<8165dd68>] (netdev_start_xmit include/linux/netdevice.h:5406 [inline]) [<810f1834>] (eth_start_xmit) from [<8165dd68>] (xmit_one net/core/dev.c:3889 [inline]) [<810f1834>] (eth_start_xmit) from [<8165dd68>] (dev_hard_start_xmit+0xf4/0x324 net/core/dev.c:3905) r10:828d54ce r9:82a0b150 r8:00000000 r7:00000000 r6:81de20c4 r5:85f0c000 r4:861ba180 [<8165dc74>] (dev_hard_start_xmit) from [<816e5898>] (sch_direct_xmit+0xa0/0x44c net/sched/sch_generic.c:372) r10:5b4fd000 r9:00000000 r8:00000000 r7:85f0c000 r6:85bbe200 r5:861ba180 r4:863fa000 [<816e57f8>] (sch_direct_xmit) from [<8165ec00>] (__dev_xmit_skb net/core/dev.c:4214 [inline]) [<816e57f8>] (sch_direct_xmit) from [<8165ec00>] (__dev_queue_xmit+0xb24/0x126c net/core/dev.c:4836) r9:863fa000 r8:a42692a0 r7:85f0c000 r6:ff7662a0 r5:85bbe200 r4:861ba180 [<8165e0dc>] (__dev_queue_xmit) from [<80f3a70c>] (dev_queue_xmit include/linux/netdevice.h:3448 [inline]) [<8165e0dc>] (__dev_queue_xmit) from [<80f3a70c>] (tx+0x7c/0xcc drivers/block/aoe/aoenet.c:62) r10:00000000 r9:df819e08 r8:846dec00 r7:82d2cdf4 r6:00000001 r5:84918c40 r4:85f0c000 [<80f3a690>] (tx) from [<80f36200>] (kthread+0x90/0x10c drivers/block/aoe/aoecmd.c:1241) r5:84918c40 r4:82d2cdf4 [<80f36170>] (kthread) from [<80282710>] (kthread+0x11c/0x154 kernel/kthread.c:436) r6:80f36170 r5:84918c40 r4:846dd500 [<802825f4>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xea4f5fb0 to 0xea4f5ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802825f4 r4:846dd500 Code: 01a03002 e5962260 e3520000 0a00005c (e5933048) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 01a03002 moveq r3, r2 4: e5962260 ldr r2, [r6, #608] @ 0x260 8: e3520000 cmp r2, #0 c: 0a00005c beq 0x184 * 10: e5933048 ldr r3, [r3, #72] @ 0x48 <-- trapping instruction