8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000018 when write
[00000018] *pgd=84d9a003, *pmd=fe54f003
Internal error: Oops: a05 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 6669 Comm: syz-executor.1 Not tainted 6.9.0-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2409 [inline]
PC is at do_pagemap_scan+0x2ac/0x6f8 fs/proc/task_mmu.c:2455
LR is at kmalloc_noprof include/linux/slab.h:664 [inline]
LR is at kmalloc_array_noprof include/linux/slab.h:699 [inline]
LR is at pagemap_scan_init_bounce_buffer fs/proc/task_mmu.c:2404 [inline]
LR is at do_pagemap_scan+0x278/0x6f8 fs/proc/task_mmu.c:2455
pc : [<805a9530>]    lr : [<805a94fc>]    psr: 20000013
sp : dfa39e18  ip : dfa39e18  fp : dfa39f04
r10: 00000000  r9 : 00000000  r8 : 00000000
r7 : dfa39e50  r6 : 851d0000  r5 : 00000000  r4 : 84298300
r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : 00000010
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 84fb9600  DAC: fffffffd
Register r0 information: zero-size pointer
Register r1 information: NULL pointer
Register r2 information: NULL pointer
Register r3 information: NULL pointer
Register r4 information: slab mm_struct start 84298300 pointer offset 0 size 712
Register r5 information: NULL pointer
Register r6 information: slab task_struct start 851d0000 pointer offset 0 size 3072
Register r7 information: 2-page vmalloc region starting at 0xdfa38000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Register r8 information: NULL pointer
Register r9 information: NULL pointer
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xdfa38000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Register r12 information: 2-page vmalloc region starting at 0xdfa38000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2797
Process syz-executor.1 (pid: 6669, stack limit = 0xdfa38000)
Stack: (0xdfa39e18 to 0xdfa3a000)
9e00:                                                       00000000 00000000
9e20: 00000000 00000000 20000040 00000001 00000000 00000000 00000000 00000000
9e40: 00000000 00000000 00000000 00000000 00000060 00000000 00000000 00000000
9e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000007 00000000
9e80: 00000000 00000001 ffffffff 00000000 00000000 00000000 00000000 00000000
9ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000010 00000000
9ec0: 00000000 00000000 00000007 00000000 c0606610 376b9cd0 dfa39ef4 c0606610
9ee0: 00000000 84c32cc1 20000040 84c32cc0 00000004 851d0000 dfa39f14 dfa39f08
9f00: 805a99a4 805a9290 dfa39fa4 dfa39f18 8051c364 805a9988 851d0000 00000001
9f20: ecac8b10 851d0000 dfa39f44 dfa39f38 819018f4 819017c4 dfa39f5c dfa39f48
9f40: 8024d45c 8027d278 40000000 dfa39fb0 dfa39f84 dfa39f60 80202df4 8024d418
9f60: 8261c90c dfa39fb0 0006bd90 ecac8b10 80202cdc 376b9cd0 dfa39fac 00000000
9f80: 00000000 0014c2c8 00000036 8020029c 851d0000 00000036 00000000 dfa39fa8
9fa0: 80200060 8051c23c 00000000 00000000 00000004 c0606610 20000040 00000000
9fc0: 00000000 00000000 0014c2c8 00000036 7e9b932e 7e9b932f 003d0f00 76b610fc
9fe0: 76b60f08 76b60ef8 00016d28 00051560 60000010 00000004 00000000 00000000
Call trace: 
[<805a9284>] (do_pagemap_scan) from [<805a99a4>] (do_pagemap_cmd+0x28/0x34 fs/proc/task_mmu.c:2522)
 r10:851d0000 r9:00000004 r8:84c32cc0 r7:20000040 r6:84c32cc1 r5:00000000
 r4:c0606610
[<805a997c>] (do_pagemap_cmd) from [<8051c364>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<805a997c>] (do_pagemap_cmd) from [<8051c364>] (do_vfs_ioctl fs/ioctl.c:861 [inline])
[<805a997c>] (do_pagemap_cmd) from [<8051c364>] (__do_sys_ioctl fs/ioctl.c:905 [inline])
[<805a997c>] (do_pagemap_cmd) from [<8051c364>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893)
[<8051c230>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdfa39fa8 to 0xdfa39ff0)
9fa0:                   00000000 00000000 00000004 c0606610 20000040 00000000
9fc0: 00000000 00000000 0014c2c8 00000036 7e9b932e 7e9b932f 003d0f00 76b610fc
9fe0: 76b60f08 76b60ef8 00016d28 00051560
 r10:00000036 r9:851d0000 r8:8020029c r7:00000036 r6:0014c2c8 r5:00000000
 r4:00000000
Code: e51b309c e51b108c e50b103c e3a01000 (e1c080f8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e51b309c 	ldr	r3, [fp, #-156]	@ 0xffffff64
   4:	e51b108c 	ldr	r1, [fp, #-140]	@ 0xffffff74
   8:	e50b103c 	str	r1, [fp, #-60]	@ 0xffffffc4
   c:	e3a01000 	mov	r1, #0
* 10:	e1c080f8 	strd	r8, [r0, #8] <-- trapping instruction