TITLE: BUG: unable to handle kernel NULL pointer dereference in nci_send_cmd
ALT: bad-access in nci_send_cmd
TYPE: NULL-POINTER-DEREFERENCE
PANICKED: Y

[ 9171.691128][T26146] 8<--- cut here ---
[ 9171.691541][T26146] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 9171.692254][T26146] [00000000] *pgd=8c44e003, *pmd=e0940003
[ 9171.693325][T26146] Internal error: Oops: 207 [#1] PREEMPT SMP ARM
[ 9171.694090][T26146] Modules linked in:
[ 9171.694434][T26146] CPU: 1 PID: 26146 Comm: syz-executor.1 Not tainted 6.1.0-rc5-syzkaller #0
[ 9171.694728][T26146] Hardware name: ARM-Versatile Express
[ 9171.694927][T26146] PC is at __queue_work+0xa0/0x74c
[ 9171.695140][T26146] LR is at 0x82c00000
[ 9171.695565][T26146] pc : [<80260410>]    lr : [<82c00000>]    psr: 60000093
[ 9171.695793][T26146] sp : ec3d1ac8  ip : 82c00024  fp : ec3d1b0c
[ 9171.696040][T26146] r10: 8280e800  r9 : 00000000  r8 : 82446498
[ 9171.696270][T26146] r7 : 8220c940  r6 : 00000008  r5 : 84e37c00  r4 : 851eb85c
[ 9171.696548][T26146] r3 : 00000000  r2 : 00000000  r1 : 00000004  r0 : 8280e800
[ 9171.696849][T26146] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
[ 9171.697181][T26146] Control: 30c5387d  Table: 8437b900  DAC: 00000000
[ 9171.697460][T26146] Register r0 information: slab kmalloc-512 start 8280e800 pointer offset 0 size 512
[ 9171.698405][T26146] Register r1 information: non-paged memory
[ 9171.698822][T26146] Register r2 information: NULL pointer
[ 9171.699049][T26146] Register r3 information: NULL pointer
[ 9171.699297][T26146] Register r4 information: slab kmalloc-2k start 851eb800 pointer offset 92 size 2048
[ 9171.699715][T26146] Register r5 information: slab kmalloc-512 start 84e37c00 pointer offset 0 size 512
[ 9171.700105][T26146] Register r6 information: non-paged memory
[ 9171.700320][T26146] Register r7 information: non-slab/vmalloc memory
[ 9171.700646][T26146] Register r8 information: non-slab/vmalloc memory
[ 9171.700877][T26146] Register r9 information: NULL pointer
[ 9171.701039][T26146] Register r10 information: slab kmalloc-512 start 8280e800 pointer offset 0 size 512
[ 9171.701349][T26146] Register r11 information: 2-page vmalloc region starting at 0xec3d0000 allocated at kernel_clone+0x9c/0x3f4
[ 9171.702161][T26146] Register r12 information: slab radix_tree_node start 82c00000 pointer offset 36
[ 9171.703630][T26146] Process syz-executor.1 (pid: 26146, stack limit = 0xec3d0000)
[ 9171.704342][T26146] Stack: (0xec3d1ac8 to 0xec3d2000)
[ 9171.704626][T26146] 1ac0:                   80275518 802a0f18 820a235c 855d9700 00000038 00000001
[ 9171.704844][T26146] 1ae0: 80000013 851eb85c 00000008 84e37c00 60000013 ec3d1b63 8250ca80 8538e974
[ 9171.705071][T26146] 1b00: ec3d1b2c ec3d1b10 80260b0c 8026037c 843a7f00 851eb800 00000000 00000001
[ 9171.705290][T26146] 1b20: ec3d1b5c ec3d1b30 816df870 80260ac8 816901c8 ec3d1bbc ec3d1ba8 851eb800
[ 9171.705507][T26146] 1b40: 851eb8d8 000001f4 816df8f0 00000000 ec3d1b74 ec3d1b60 816df924 816df7cc
[ 9171.705722][T26146] 1b60: 01275518 b6345568 ec3d1b94 ec3d1b78 816de4b0 816df8fc 851eb800 81ed5f0c
[ 9171.705923][T26146] 1b80: 851eb818 851eb8c4 ec3d1bbc ec3d1b98 816deb28 816de488 ec3d1bbc b6345568
[ 9171.706137][T26146] 1ba0: 8538f800 81ed5f0c 8538f85c 8436aa00 ec3d1bdc ec3d1bc0 816d2e28 816dea1c
[ 9171.706346][T26146] 1bc0: 8538f800 81ed5f0c 843a7c00 8436aa00 ec3d1bf4 ec3d1be0 816d441c 816d2dc0
[ 9171.706555][T26146] 1be0: 84e36214 81ed5f0c ec3d1c9c ec3d1bf8 813bf7d4 816d43f8 00000001 ec3d1c08
[ 9171.706767][T26146] 1c00: 8020d4c4 8020c2fc ec3d1c34 ec3d1c18 8020c314 8020d440 00000000 00000001
[ 9171.706978][T26146] 1c20: 81777be8 0000167f ec3d1c74 ec3d1c38 816d43ec 00000000 00000000 00000000
[ 9171.707239][T26146] 1c40: 81a4ae68 0000001f 03010002 00000000 00001117 84e36200 84e36210 84e36214
[ 9171.707452][T26146] 1c60: 8436aa00 8250ca80 00000000 00000000 ec3d1ca4 b6345568 843a7c00 813bf60c
[ 9171.707648][T26146] 1c80: 84e36200 0000001c 82210b94 00000000 ec3d1cec ec3d1ca0 813be8c0 813bf618
[ 9171.707871][T26146] 1ca0: 82801480 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 9171.708087][T26146] 1cc0: 00000000 00000000 00000000 b6345568 843a7c00 823c074c 8538e800 843a7c00
[ 9171.708324][T26146] 1ce0: ec3d1d04 ec3d1cf0 813bf130 813be808 82930000 82930064 ec3d1d44 ec3d1d08
[ 9171.708535][T26146] 1d00: 813bddfc 813bf110 8538e800 0000001c 7fffffff b6345568 ec3d1d44 0000001c
[ 9171.708741][T26146] 1d20: ec3d1f38 843a7c00 0000001c 8538e800 00000000 00000000 ec3d1da4 ec3d1d48
[ 9171.709030][T26146] 1d40: 813be144 813bdbb4 00000000 00000000 84e36200 00000000 00000000 8523b780
[ 9171.709238][T26146] 1d60: 00000000 00001117 00000000 00000000 00000000 b6345568 ec3d1da4 ec3d1f38
[ 9171.709480][T26146] 1d80: 85a0b180 85a0b180 00000000 00000000 00000000 ec3d1ddc ec3d1dbc ec3d1da8
[ 9171.709688][T26146] 1da0: 81295f24 813bdf3c ec3d1f38 00000000 ec3d1e2c ec3d1dc0 81296d50 81295ef4
[ 9171.709898][T26146] 1dc0: 80795af4 80795970 ec3d1e38 ec3d1f48 00000000 00000000 ec3d1e2c ec3d1de8
[ 9171.710115][T26146] 1de0: 8129895c 80795ad4 ec3d1e38 ec3d1f48 00000000 00000000 20000180 b6345568
[ 9171.710318][T26146] 1e00: 00000000 00000000 ec3d1f38 85a0b180 00000000 00000000 855d9700 00000128
[ 9171.710522][T26146] 1e20: ec3d1f24 ec3d1e30 81298a04 81296b50 00000000 81770264 00000000 20000200
[ 9171.710724][T26146] 1e40: 0000001c 855d9700 ec3d1f24 ec3d1e58 80300518 802fc984 ec3d1e6c 00000000
[ 9171.710930][T26146] 1e60: ddde6640 855d9700 804a984c 828f8100 ec3d1e8c ec3d1e80 8176e29c 8176e188
[ 9171.711215][T26146] 1e80: 00000000 ec3d1ee0 ec3d1ed4 ec3d1e98 802fbfd8 808112f0 00088019 85aa0d48
[ 9171.711423][T26146] 1ea0: 8368dcb0 b6345568 00000064 ec3d1eac ec3d1eac ec3d1eb4 ec3d1eb4 855d9700
[ 9171.711618][T26146] 1ec0: ec3d1efc ec3d1ed0 804cc504 802ce8a8 00000000 ec3d1f34 ec3d1f30 00000000
[ 9171.711814][T26146] 1ee0: 00000128 80200288 855d9700 00000128 ec3d1f0c ec3d1f00 804cc578 b6345568
[ 9171.712032][T26146] 1f00: ec3d1f24 85a0b180 20000140 00000000 00000128 80200288 ec3d1fa4 ec3d1f28
[ 9171.712240][T26146] 1f20: 81298e58 8129899c 00000000 00000000 00000001 fffffff7 00000000 00000000
[ 9171.712468][T26146] 1f40: ec3d1fa4 ec3d1f50 01010000 00000000 00000000 ec3d1e44 00000000 00000000
[ 9171.712672][T26146] 1f60: 00000000 ec3d1f71 00000000 00000000 00000000 00000000 00000008 b6345568
[ 9171.712934][T26146] 1f80: 80200288 b6345568 00000000 00000000 00000000 0014c110 00000000 ec3d1fa8
[ 9171.713147][T26146] 1fa0: 80200060 81298e0c 00000000 00000000 00000006 20000140 00000000 00000000
[ 9171.713353][T26146] 1fc0: 00000000 00000000 0014c110 00000128 7ef253d2 76b8e6d0 7ef25544 76b8e20c
[ 9171.713797][T26146] 1fe0: 76b8e020 76b8e010 000164dc 0004d5a0 60000010 00000006 00000000 00000000
[ 9171.714059][T26146] Backtrace: 
[ 9171.714382][T26146] [<80260370>] (__queue_work) from [<80260b0c>] (queue_work_on+0x50/0x5c)
[ 9171.714738][T26146]  r10:8538e974 r9:8250ca80 r8:ec3d1b63 r7:60000013 r6:84e37c00 r5:00000008
[ 9171.715151][T26146]  r4:851eb85c
[ 9171.715391][T26146] [<80260abc>] (queue_work_on) from [<816df870>] (nci_send_cmd+0xb0/0x110)
[ 9171.715743][T26146]  r7:00000001 r6:00000000 r5:851eb800 r4:843a7f00
[ 9171.715982][T26146] [<816df7c0>] (nci_send_cmd) from [<816df924>] (nci_reset_req+0x34/0x5c)
[ 9171.716217][T26146]  r8:00000000 r7:816df8f0 r6:000001f4 r5:851eb8d8 r4:851eb800
[ 9171.716380][T26146] [<816df8f0>] (nci_reset_req) from [<816de4b0>] (__nci_request+0x34/0xd8)
[ 9171.716593][T26146] [<816de47c>] (__nci_request) from [<816deb28>] (nci_dev_up+0x118/0x1f8)
[ 9171.716802][T26146]  r7:851eb8c4 r6:851eb818 r5:81ed5f0c r4:851eb800
[ 9171.716950][T26146] [<816dea10>] (nci_dev_up) from [<816d2e28>] (nfc_dev_up+0x74/0x11c)
[ 9171.717178][T26146]  r7:8436aa00 r6:8538f85c r5:81ed5f0c r4:8538f800
[ 9171.717337][T26146] [<816d2db4>] (nfc_dev_up) from [<816d441c>] (nfc_genl_dev_up+0x30/0x58)
[ 9171.717563][T26146]  r7:8436aa00 r6:843a7c00 r5:81ed5f0c r4:8538f800
[ 9171.717718][T26146] [<816d43ec>] (nfc_genl_dev_up) from [<813bf7d4>] (genl_rcv_msg+0x1c8/0x3f4)
[ 9171.717945][T26146]  r5:81ed5f0c r4:84e36214
[ 9171.718080][T26146] [<813bf60c>] (genl_rcv_msg) from [<813be8c0>] (netlink_rcv_skb+0xc4/0x128)
[ 9171.718309][T26146]  r9:00000000 r8:82210b94 r7:0000001c r6:84e36200 r5:813bf60c r4:843a7c00
[ 9171.718501][T26146] [<813be7fc>] (netlink_rcv_skb) from [<813bf130>] (genl_rcv+0x2c/0x3c)
[ 9171.718710][T26146]  r7:843a7c00 r6:8538e800 r5:823c074c r4:843a7c00
[ 9171.718850][T26146] [<813bf104>] (genl_rcv) from [<813bddfc>] (netlink_unicast+0x254/0x388)
[ 9171.719115][T26146]  r5:82930064 r4:82930000
[ 9171.719267][T26146] [<813bdba8>] (netlink_unicast) from [<813be144>] (netlink_sendmsg+0x214/0x4a8)
[ 9171.719529][T26146]  r10:00000000 r9:00000000 r8:8538e800 r7:0000001c r6:843a7c00 r5:ec3d1f38
[ 9171.719723][T26146]  r4:0000001c
[ 9171.719829][T26146] [<813bdf30>] (netlink_sendmsg) from [<81295f24>] (sock_sendmsg+0x3c/0x4c)
[ 9171.720092][T26146]  r10:ec3d1ddc r9:00000000 r8:00000000 r7:00000000 r6:85a0b180 r5:85a0b180
[ 9171.720280][T26146]  r4:ec3d1f38
[ 9171.720373][T26146] [<81295ee8>] (sock_sendmsg) from [<81296d50>] (____sys_sendmsg+0x20c/0x2a4)
[ 9171.720638][T26146]  r5:00000000 r4:ec3d1f38
[ 9171.720794][T26146] [<81296b44>] (____sys_sendmsg) from [<81298a04>] (___sys_sendmsg+0x74/0xac)
[ 9171.721127][T26146]  r10:00000128 r9:855d9700 r8:00000000 r7:00000000 r6:85a0b180 r5:ec3d1f38
[ 9171.721423][T26146]  r4:00000000
[ 9171.721550][T26146] [<81298990>] (___sys_sendmsg) from [<81298e58>] (sys_sendmsg+0x58/0xa0)
[ 9171.721853][T26146]  r8:80200288 r7:00000128 r6:00000000 r5:20000140 r4:85a0b180
[ 9171.722042][T26146] [<81298e00>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c)
[ 9171.722271][T26146] Exception stack(0xec3d1fa8 to 0xec3d1ff0)
[ 9171.722448][T26146] 1fa0:                   00000000 00000000 00000006 20000140 00000000 00000000
[ 9171.722663][T26146] 1fc0: 00000000 00000000 0014c110 00000128 7ef253d2 76b8e6d0 7ef25544 76b8e20c
[ 9171.722911][T26146] 1fe0: 76b8e020 76b8e010 000164dc 0004d5a0
[ 9171.723089][T26146]  r6:0014c110 r5:00000000 r4:00000000
[ 9171.723668][T26146] Code: 0a00003b e59f06a8 eb532efb e1a0a000 (e5990000) 
[ 9171.724521][T26146] ---[ end trace 0000000000000000 ]---
[ 9171.724909][T26146] Kernel panic - not syncing: Fatal exception
[ 9171.725496][    C0] CPU0: stopping
[ 9171.726158][    C0] CPU: 0 PID: 17461 Comm: syz-executor.0 Tainted: G      D            6.1.0-rc5-syzkaller #0
[ 9171.726833][    C0] Hardware name: ARM-Versatile Express
[ 9171.727195][    C0] Backtrace: frame pointer underflow
[ 9171.727577][    C0] [<81751364>] (dump_backtrace) from [<81751458>] (show_stack+0x18/0x1c)
[ 9171.728104][    C0]  r7:81cf3f64 r6:8190f3a0 r5:60000193 r4:81d06c38
[ 9171.728525][    C0] [<81751440>] (show_stack) from [<8176d108>] (dump_stack_lvl+0x48/0x54)
[ 9171.729072][    C0] [<8176d0c0>] (dump_stack_lvl) from [<8176d12c>] (dump_stack+0x18/0x1c)
[ 9171.729641][    C0]  r5:00000000 r4:00000003
[ 9171.729957][    C0] [<8176d114>] (dump_stack) from [<802105c4>] (do_handle_IPI+0x3d4/0x408)
[ 9171.730502][    C0] [<802101f0>] (do_handle_IPI) from [<80210618>] (ipi_handler+0x20/0x28)
[ 9171.731002][    C0]  r10:7ec7d544 r9:76a9f6d0 r8:df801f78 r7:00000014 r6:8190f3a0 r5:8280cb80
[ 9171.731346][    C0]  r4:82888a00 r3:00000010
[ 9171.731632][    C0] [<802105f8>] (ipi_handler) from [<802b9e48>] (handle_percpu_devid_irq+0x9c/0x2f8)
[ 9171.732162][    C0] [<802b9dac>] (handle_percpu_devid_irq) from [<802b33dc>] (generic_handle_domain_irq+0x30/0x40)
[ 9171.732819][    C0]  r10:7ec7d544 r9:76a9f6d0 r8:00000000 r7:df80a00c r6:820a9360 r5:df80a000
[ 9171.733342][    C0]  r4:8220cdc0 r3:00010000
[ 9171.733621][    C0] [<802b33ac>] (generic_handle_domain_irq) from [<80824df0>] (gic_handle_irq+0x68/0x7c)
[ 9171.734219][    C0] [<80824d88>] (gic_handle_irq) from [<8176d7e4>] (generic_handle_arch_irq+0x60/0x80)
[ 9171.734838][    C0]  r7:ed705fb0 r6:81eba6d8 r5:81eba6f0 r4:820aa9dc
[ 9171.735336][    C0] [<8176d784>] (generic_handle_arch_irq) from [<817237f8>] (call_with_stack+0x1c/0x20)
[ 9171.736026][    C0]  r9:76a9f6d0 r8:820a2044 r7:82a8e780 r6:ffffffff r5:20000010 r4:000165f4
[ 9171.736266][    C0] [<817237dc>] (call_with_stack) from [<80200e74>] (__irq_usr+0x74/0x80)
[ 9171.736477][    C0] Exception stack(0xed705fb0 to 0xed705ff8)
[ 9171.736675][    C0] 5fa0:                                     ffffffff 00000004 000001b8 00000000
[ 9171.736862][    C0] 5fc0: 00000000 d00552ff 00000000 00000000 7ec7d3d2 76a9f6d0 7ec7d544 76a9f20c
[ 9171.737124][    C0] 5fe0: 200000c0 200000c0 000165f4 000165f4 20000010 ffffffff
[ 9171.739952][T26146] Rebooting in 86400 seconds..

