BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 1 PID: 808 Comm: syz-executor Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6f09cf0 EFLAGS: 00010202 RAX: ffffffff8150a590 RBX: 0000000000000101 RCX: ffff8881de7f8fc0 RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e0cab1c0 RBP: ffff8881f6f09d30 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103ede1398 R11: 1ffff1103ede1398 R12: 00000000ffffa118 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e0cab1c0 FS: 0000555566889500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001dadd8000 CR4: 00000000003406a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x81d/0xb60 kernel/time/timer.c:1817 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830 __do_softirq+0x236/0x660 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x197/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:539 [inline] smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:unwind_next_frame+0x5f7/0x760 arch/x86/kernel/unwind_frame.c:363 Code: 89 df e8 5c 06 00 00 49 b8 00 00 00 00 00 fc ff df 48 8b 45 80 42 0f b6 04 00 84 c0 0f 85 c8 00 00 00 c7 03 00 00 00 00 31 c0 <65> 48 8b 0c 25 28 00 00 00 48 3b 4d d0 0f 85 a8 00 00 00 48 83 c4 RSP: 0018:ffff8881d90e7498 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 00000000818ce901 RBX: ffff8881d90e7528 RCX: 00000000818ce901 RDX: ffff8881d90e7900 RSI: 1ffff1103b21cea6 RDI: ffff8881d90e7580 RBP: ffff8881d90e7518 R08: dffffc0000000000 R09: ffff8881d90e7528 R10: ffffed103b21ceb1 R11: 1ffff1103b21cea5 R12: 0000000000000000 R13: 1ffff1103b21ceb0 R14: ffff8881d90e7580 R15: ffff8881d90e78e8 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0xf0 kernel/stacktrace.c:123 save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x162/0x200 mm/kasan/common.c:529 kasan_kmalloc+0xd/0x20 mm/kasan/common.c:543 __kmalloc+0x12a/0x2f0 mm/slub.c:3913 kmalloc include/linux/slab.h:561 [inline] context_struct_to_string+0x441/0x840 security/selinux/ss/services.c:1242 context_add_hash+0xad/0x170 security/selinux/ss/services.c:1483 context_struct_to_sid security/selinux/ss/services.c:1501 [inline] security_compute_sid+0xf93/0x13f0 security/selinux/ss/services.c:1865 security_transition_sid+0x7d/0x90 security/selinux/ss/services.c:1890 socket_sockcreate_sid security/selinux/hooks.c:4585 [inline] selinux_socket_create+0x1c6/0x290 security/selinux/hooks.c:4619 security_socket_create+0x77/0xb0 security/security.c:2014 __sock_create+0xce/0x740 net/socket.c:1382 sock_create net/socket.c:1478 [inline] __sys_socket+0xec/0x190 net/socket.c:1520 __do_sys_socket net/socket.c:1529 [inline] __se_sys_socket net/socket.c:1527 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1527 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f22b2f79887 Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffec7b98488 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007f22b2ffaad5 RCX: 00007f22b2f79887 RDX: 0000000000000000 RSI: 0000000000080002 RDI: 0000000000000001 RBP: 00007ffec7b984a0 R08: 0000000000000007 R09: 00306974765f3670 R10: 000000000000000c R11: 0000000000000246 R12: 00007ffec7b98520 R13: 00007f22b2ffaad5 R14: 00007f22b3ccd620 R15: 00007f22b2ffaad5 Modules linked in: CR2: 0000000000000000 ---[ end trace 211afd62b7c0bac2 ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6f09cf0 EFLAGS: 00010202 RAX: ffffffff8150a590 RBX: 0000000000000101 RCX: ffff8881de7f8fc0 RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881e0cab1c0 RBP: ffff8881f6f09d30 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103ede1398 R11: 1ffff1103ede1398 R12: 00000000ffffa118 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e0cab1c0 FS: 0000555566889500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001dadd8000 CR4: 00000000003406a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 89 df mov %ebx,%edi 2: e8 5c 06 00 00 call 0x663 7: 49 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%r8 e: fc ff df 11: 48 8b 45 80 mov -0x80(%rbp),%rax 15: 42 0f b6 04 00 movzbl (%rax,%r8,1),%eax 1a: 84 c0 test %al,%al 1c: 0f 85 c8 00 00 00 jne 0xea 22: c7 03 00 00 00 00 movl $0x0,(%rbx) 28: 31 c0 xor %eax,%eax * 2a: 65 48 8b 0c 25 28 00 mov %gs:0x28,%rcx <-- trapping instruction 31: 00 00 33: 48 3b 4d d0 cmp -0x30(%rbp),%rcx 37: 0f 85 a8 00 00 00 jne 0xe5 3d: 48 rex.W 3e: 83 .byte 0x83 3f: c4 .byte 0xc4