Well, I can reproduce it fairly easily. It seems to be:
static inline void scatterwalk_start(struct scatter_walk *walk,
struct scatterlist *sg)
{
walk->sg = sg;
walk->offset = sg->offset; <----
}
Presumably sg is rubbish.
Dump of assembler code for function gcm_walk_start:
0x0000000000000038 <+0>: jgnop 0x38 <gcm_walk_start>
0x000000000000003e <+6>: xc 8(64,%r2),8(%r2)
0x0000000000000044 <+12>: st %r4,32(%r2)
0x0000000000000048 <+16>: stg %r3,0(%r2)
0x000000000000004e <+22>: l %r1,8(%r3)
0x0000000000000052 <+26>: st %r1,8(%r2)
0x0000000000000056 <+30>: jg 0x56 <gcm_walk_start+30>
I'm don't know much about s390x assembly, but I'm guessing %r2 has "walk" and
%r3 has "sg".
AS:0000000116d50007 R3:0000000000000024
Fault in home space mode while using kernel ASCE.
Failing address: 0026070200000000 TEID: 0026070200000803
Unable to handle kernel pointer dereference in virtual kernel address space
Krnl GPRS: 000000000000000c 0000038000000310 00000380002a7938 0026070200000000
0000000000000000 0000000115593cb4 0000000000000000 0000000000000010
0000000100000000 000000017e984690 000000000000000c 0000000000000000
000003ffaf12cf98 0000000000000000 000003ff7fc536ba 00000380002a77e0
I'm not sure what to make of the 0026070200000000.
David
