8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read [00000014] *pgd=86c61003 , *pmd=df68e003 Internal error: Oops: 205 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 9125 Comm: syz.1.1441 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at kthread_destroy_worker+0xc/0xa8 kernel/kthread.c:1599 LR is at vdpasim_free+0x20/0x118 drivers/vdpa/vdpa_sim/vdpa_sim.c:750 pc : [<802825fc>] lr : [<80abaaac>] psr: 60000013 sp : fe5a5950 ip : fe5a5968 fp : fe5a5964 r10: 86130400 r9 : 86130638 r8 : 82b57ea4 r7 : 00000000 r6 : 86130400 r5 : 00000000 r4 : 86130400 r3 : 80abaa8c r2 : 00000000 r1 : 00000000 r0 : fffffffc Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 86044b40 DAC: 00000000 Register r0 information: non-paged memory Register r1 information: NULL pointer Register r2 information: NULL pointer Register r3 information: non-slab/vmalloc memory Register r4 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024 Register r5 information: NULL pointer Register r6 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024 Register r7 information: NULL pointer Register r8 information: non-slab/vmalloc memory Register r9 information: slab kmalloc-1k start 86130400 pointer offset 568 size 1024 Register r10 information: slab kmalloc-1k start 86130400 pointer offset 0 size 1024 Register r11 information: 2-page vmalloc region starting at 0xfe5a4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Register r12 information: 2-page vmalloc region starting at 0xfe5a4000 allocated at kernel_clone+0xc4/0x43c kernel/fork.c:2766 Process syz.1.1441 (pid: 9125, stack limit = 0xfe5a4000) Stack: (0xfe5a5950 to 0xfe5a6000) 5940: 86130400 00000000 fe5a598c fe5a5968 5960: 80abaaac 802825fc 86130400 00000000 860aca00 00000000 82b57ea4 86130638 5980: fe5a59a4 fe5a5990 80ab77e4 80abaa98 86130400 00000000 fe5a59c4 fe5a59a8 59a0: 80bd729c 80ab77cc fe5a5a04 823a58f0 86130400 81d5b39c fe5a59f4 fe5a59c8 59c0: 81b458b0 80bd7268 fe5a5a04 fe5a59d8 fe5a5a04 fffffff4 fe5a5a50 00000000 59e0: fffffffc 82b57ea4 fe5a5a04 fe5a59f8 80bd7410 81b4581c fe5a5a4c fe5a5a08 5a00: 80abadcc 80bd7404 00000001 000002d8 84e824a8 00000001 00000002 8331e200 5a20: 86093d80 82b57ef0 00000001 84e824a4 00000000 fe5a5c48 82e3a4c0 8255276c 5a40: fe5a5aac fe5a5a50 80abbda8 80abac6c 82b57ef0 84e824a8 08007646 00000003 5a60: 000002d8 00000060 00000001 00000002 00000001 00000001 80abc0a8 80abbf9c 5a80: 00000000 00000000 80abc084 00000000 84e824a4 0fc6cca0 82b57ef0 fe5a5b20 5aa0: fe5a5b14 fe5a5ab0 80ab8388 80abbd1c 80a01e34 80a011a0 0000001f fe5a5c48 5ac0: 86093d80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ae0: 00000000 00000000 fe5a5c48 0fc6cca0 84e82490 86093d80 8384c600 fe5a5bd8 5b00: fe5a5c48 82e3a4c0 fe5a5ba4 fe5a5b18 8176d5d8 80ab80d4 00000004 00000001 5b20: 00000000 000006d1 8255276c 84e82480 84e82490 86093d80 82e3a4c0 00000000 5b40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5b60: 00000000 00000000 00000000 fe5a5c48 80261030 0fc6cca0 0000000c 8255276c 5b80: 84e82480 00000000 fe5a5bd8 8384c600 82e3a4c0 00000002 fe5a5c44 fe5a5ba8 5ba0: 8176de1c 8176d4f4 fe5a5bd8 00000004 82e3a4c0 00c00000 00000004 fe5a5c48 5bc0: 00000000 82c09b00 fe5a5bfc fe5a5bd8 80290c5c 802d699c 00000000 80ab80c8 5be0: 00000000 81d252c0 00000025 00030003 fe5a5c1c fe5a5c00 804fabb4 8028f548 5c00: ffefd000 deda411c 00000001 82c85518 fe5a5c44 0fc6cca0 8052cfd0 00000000 5c20: 8384c600 8176dbdc 84e82480 8384c600 82e3a4c0 85733d84 fe5a5cd4 fe5a5c48 5c40: 8176c82c 8176dbe8 00000000 00000000 00000000 00000000 00000000 00000000 5c60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5c80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ca0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 8384c600 83393c64 5cc0: 00000030 83840bc0 fe5a5cec fe5a5cd8 8176d3c0 8176c778 83393c00 83393c64 5ce0: fe5a5d2c fe5a5cf0 8176bff8 8176d3a4 8384c600 00000000 7fffffff 0fc6cca0 5d00: 00000000 fe5a5f28 8384c600 00000030 85733c00 00000000 00000000 00000000 5d20: fe5a5d94 fe5a5d30 8176c2d0 8176bd94 fe5a5f28 8580cf40 00000000 00000000 5d40: 00000000 00000030 831dcc00 00000000 000006d1 00000000 00000000 00000000 5d60: 00000030 0fc6cca0 fe5a5d94 00000000 fe5a5f28 8580cf40 00000000 fe5a5dd4 5d80: 00000000 00000000 fe5a5db4 fe5a5d98 8162f7c4 8176c114 fe5a5f28 8580cf40 5da0: 00000000 00000000 fe5a5e24 fe5a5db8 81630864 8162f78c fe5a5e30 fe5a5f38 5dc0: 00000000 fe5a5de0 fe5a5e24 fe5a5dd8 81630b30 00000000 00000000 00000000 5de0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 00000000 00000000 5e00: fe5a5f28 8580cf40 00000000 00000000 20000280 00000128 fe5a5f1c fe5a5e28 5e20: 81630c64 81630638 00000000 00000001 00000000 20000300 00000030 00000000 5e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5ee0: 00000000 00000000 00000000 00000000 00000000 0fc6cca0 00000005 863dc081 5f00: 20000280 00000000 863dc080 8409b100 fe5a5f94 fe5a5f20 81632e3c 81630bd4 5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00010000 00000030 5f40: 20000300 00000000 00000001 00000000 00000000 00000001 00000000 00000000 5f60: 00000000 00000000 ecac8b10 0fc6cca0 ffffffff 00000000 00000000 003564f0 5f80: 00000128 8020029c fe5a5fa4 fe5a5f98 81632ea4 81632dbc 00000000 fe5a5fa8 5fa0: 80200060 81632e9c 00000000 00000000 00000005 20000280 00000000 00000000 5fc0: 00000000 00000000 003564f0 00000128 003564b8 00000000 003d0f00 76f440dc 5fe0: 76f43e88 76f43e78 00018fa0 00130a50 60000010 00000005 00000000 00000000 Call trace: [<802825f0>] (kthread_destroy_worker) from [<80abaaac>] (vdpasim_free+0x20/0x118 drivers/vdpa/vdpa_sim/vdpa_sim.c:750) r5:00000000 r4:86130400 [<80abaa8c>] (vdpasim_free) from [<80ab77e4>] (vdpa_release_dev+0x24/0x40 drivers/vdpa/vdpa.c:94) r9:86130638 r8:82b57ea4 r7:00000000 r6:860aca00 r5:00000000 r4:86130400 [<80ab77c0>] (vdpa_release_dev) from [<80bd729c>] (device_release+0x40/0xb0 drivers/base/core.c:2636) r5:00000000 r4:86130400 [<80bd725c>] (device_release) from [<81b458b0>] (kobject_cleanup lib/kobject.c:689 [inline]) [<80bd725c>] (device_release) from [<81b458b0>] (kobject_release lib/kobject.c:720 [inline]) [<80bd725c>] (device_release) from [<81b458b0>] (kref_put include/linux/kref.h:65 [inline]) [<80bd725c>] (device_release) from [<81b458b0>] (kobject_put+0xa0/0x258 lib/kobject.c:737) r5:81d5b39c r4:86130400 [<81b45810>] (kobject_put) from [<80bd7410>] (put_device+0x18/0x1c drivers/base/core.c:3880) r8:82b57ea4 r7:fffffffc r6:00000000 r5:fe5a5a50 r4:fffffff4 [<80bd73f8>] (put_device) from [<80abadcc>] (vdpasim_create+0x16c/0x2f8 drivers/vdpa/vdpa_sim/vdpa_sim.c:282) [<80abac60>] (vdpasim_create) from [<80abbda8>] (vdpasim_blk_dev_add+0x98/0x140 drivers/vdpa/vdpa_sim/vdpa_sim_blk.c:423) r10:8255276c r9:82e3a4c0 r8:fe5a5c48 r7:00000000 r6:84e824a4 r5:00000001 r4:82b57ef0 [<80abbd10>] (vdpasim_blk_dev_add) from [<80ab8388>] (vdpa_nl_cmd_dev_add_set_doit+0x2c0/0x480 drivers/vdpa/vdpa.c:662) r5:fe5a5b20 r4:82b57ef0 [<80ab80c8>] (vdpa_nl_cmd_dev_add_set_doit) from [<8176d5d8>] (genl_family_rcv_msg_doit+0xf0/0x140 net/netlink/genetlink.c:1114) r9:82e3a4c0 r8:fe5a5c48 r7:fe5a5bd8 r6:8384c600 r5:86093d80 r4:84e82490 [<8176d4e8>] (genl_family_rcv_msg_doit) from [<8176de1c>] (genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]) [<8176d4e8>] (genl_family_rcv_msg_doit) from [<8176de1c>] (genl_rcv_msg+0x240/0x3a8 net/netlink/genetlink.c:1209) r10:00000002 r9:82e3a4c0 r8:8384c600 r7:fe5a5bd8 r6:00000000 r5:84e82480 r4:8255276c [<8176dbdc>] (genl_rcv_msg) from [<8176c82c>] (netlink_rcv_skb+0xc0/0x120 net/netlink/af_netlink.c:2556) r10:85733d84 r9:82e3a4c0 r8:8384c600 r7:84e82480 r6:8176dbdc r5:8384c600 r4:00000000 [<8176c76c>] (netlink_rcv_skb) from [<8176d3c0>] (genl_rcv+0x28/0x38 net/netlink/genetlink.c:1218) r7:83840bc0 r6:00000030 r5:83393c64 r4:8384c600 [<8176d398>] (genl_rcv) from [<8176bff8>] (netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]) [<8176d398>] (genl_rcv) from [<8176bff8>] (netlink_unicast+0x270/0x380 net/netlink/af_netlink.c:1345) r5:83393c64 r4:83393c00 [<8176bd88>] (netlink_unicast) from [<8176c2d0>] (netlink_sendmsg+0x1c8/0x444 net/netlink/af_netlink.c:1900) r10:00000000 r9:00000000 r8:00000000 r7:85733c00 r6:00000030 r5:8384c600 r4:fe5a5f28 [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (sock_sendmsg_nosec net/socket.c:800 [inline]) [<8176c108>] (netlink_sendmsg) from [<8162f7c4>] (__sock_sendmsg+0x44/0x78 net/socket.c:815) r10:00000000 r9:00000000 r8:fe5a5dd4 r7:00000000 r6:8580cf40 r5:fe5a5f28 r4:00000000 [<8162f780>] (__sock_sendmsg) from [<81630864>] (____sys_sendmsg+0x238/0x2c4 net/socket.c:2709) r7:00000000 r6:00000000 r5:8580cf40 r4:fe5a5f28 [<8163062c>] (____sys_sendmsg) from [<81630c64>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2763) r10:00000128 r9:20000280 r8:00000000 r7:00000000 r6:8580cf40 r5:fe5a5f28 r4:00000000 [<81630bc8>] (___sys_sendmsg) from [<81632e3c>] (__sys_sendmsg+0x8c/0xe0 net/socket.c:2795) r9:8409b100 r8:863dc080 r7:00000000 r6:20000280 r5:863dc081 r4:00000005 [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (__do_sys_sendmsg net/socket.c:2800 [inline]) [<81632db0>] (__sys_sendmsg) from [<81632ea4>] (sys_sendmsg+0x14/0x18 net/socket.c:2798) r8:8020029c r7:00000128 r6:003564f0 r5:00000000 r4:00000000 [<81632e90>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xfe5a5fa8 to 0xfe5a5ff0) 5fa0: 00000000 00000000 00000005 20000280 00000000 00000000 5fc0: 00000000 00000000 003564f0 00000128 003564b8 00000000 003d0f00 76f440dc 5fe0: 76f43e88 76f43e78 00018fa0 00130a50 Code: e89da830 e1a0c00d e92dd830 e24cb004 (e5905018) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e89da830 ldm sp, {r4, r5, fp, sp, pc} 4: e1a0c00d mov ip, sp 8: e92dd830 push {r4, r5, fp, ip, lr, pc} c: e24cb004 sub fp, ip, #4 * 10: e5905018 ldr r5, [r0, #24] <-- trapping instruction