BUG: kernel NULL pointer dereference, address: 0000000000000649 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 8000000029f44067 P4D 8000000029f44067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 18345 Comm: syz.3.3326 Not tainted 6.16.0-syzkaller-12084-g33caa208dba6 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:llc_ui_setsockopt+0x4e1/0x5f0 net/llc/af_llc.c:-1 Code: a2 f8 eb 4b e8 60 a8 3e f8 4c 6b f3 64 49 8d 9f a0 06 00 00 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 cf 13 a2 f8 <4c> 89 33 eb 23 e8 35 a8 3e f8 4d 8d b7 0d 07 00 00 4c 89 f0 48 c1 RSP: 0000:ffffc90003e2fad8 EFLAGS: 00010246 RAX: 00000000000000c9 RBX: 0000000000000649 RCX: ffff888054200000 RDX: 0000000000000100 RSI: ffffffff8be32660 RDI: ffff8880580e3c10 RBP: ffffc90003e2fbd0 R08: ffffffff8fa34637 R09: 1ffffffff1f468c6 R10: dffffc0000000000 R11: ffffffff89810270 R12: 1ffff920007c5f60 R13: ffff8880580e3c10 R14: 0000000000000001 R15: 0000000000000001 FS: 000055558d574500(0000) GS:ffff888125d21000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000649 CR3: 0000000075f82000 CR4: 00000000003526f0 Call Trace: expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x7fa00586ecd0 Code: ff 48 8b 43 38 83 43 28 04 48 8d 50 fc 48 89 53 38 44 89 68 fc 8b 43 28 48 83 c4 38 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00 44 24 1e 01 48 89 ee 44 89 e7 4c 89 44 24 10 4c 89 54 24 08 e8 RSP: 002b:00007ffe037461b0 EFLAGS: 00000246 RAX: ffffffff823c77ed RBX: 00007fa0066e5720 RCX: 000000000000276c RDX: ffffffff823c6aee RSI: ffffffff823c77ed RDI: 000000000000000e RBP: ffffffff823c6aee R08: 00007fa005bb6128 R09: 00007fa005ba2000 R10: 00007fa004ff5008 R11: 000000000000000e R12: 000000000000000e R13: 0000000000000000 R14: ffffffff823c6aee R15: 000000000000276c Modules linked in: CR2: 0000000000000649 ---[ end trace 0000000000000000 ]--- RIP: 0010:llc_ui_setsockopt+0x4e1/0x5f0 net/llc/af_llc.c:-1 Code: a2 f8 eb 4b e8 60 a8 3e f8 4c 6b f3 64 49 8d 9f a0 06 00 00 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 cf 13 a2 f8 <4c> 89 33 eb 23 e8 35 a8 3e f8 4d 8d b7 0d 07 00 00 4c 89 f0 48 c1 RSP: 0000:ffffc90003e2fad8 EFLAGS: 00010246 RAX: 00000000000000c9 RBX: 0000000000000649 RCX: ffff888054200000 RDX: 0000000000000100 RSI: ffffffff8be32660 RDI: ffff8880580e3c10 RBP: ffffc90003e2fbd0 R08: ffffffff8fa34637 R09: 1ffffffff1f468c6 R10: dffffc0000000000 R11: ffffffff89810270 R12: 1ffff920007c5f60 R13: ffff8880580e3c10 R14: 0000000000000001 R15: 0000000000000001 FS: 000055558d574500(0000) GS:ffff888125d21000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000649 CR3: 0000000075f82000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: a2 f8 eb 4b e8 60 a8 movabs %al,0xf83ea860e84bebf8 7: 3e f8 9: 4c 6b f3 64 imul $0x64,%rbx,%r14 d: 49 8d 9f a0 06 00 00 lea 0x6a0(%r15),%rbx 14: 48 89 d8 mov %rbx,%rax 17: 48 c1 e8 03 shr $0x3,%rax 1b: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 20: 74 08 je 0x2a 22: 48 89 df mov %rbx,%rdi 25: e8 cf 13 a2 f8 call 0xf8a213f9 * 2a: 4c 89 33 mov %r14,(%rbx) <-- trapping instruction 2d: eb 23 jmp 0x52 2f: e8 35 a8 3e f8 call 0xf83ea869 34: 4d 8d b7 0d 07 00 00 lea 0x70d(%r15),%r14 3b: 4c 89 f0 mov %r14,%rax 3e: 48 rex.W 3f: c1 .byte 0xc1