BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 1f06c7067 P4D 1f06c7067 PUD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 2947 Comm: syz-executor.2 Not tainted 5.4.274-syzkaller-00016-gdd432c37afcd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202 RAX: ffffffff8154d7aa RBX: 0000000000000101 RCX: ffff8881ebdc8fc0 RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff8881d600f1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffff9e60 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d600f1c0 FS: 00007fbf56f856c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d7f3d000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: <IRQ> call_timer_fn+0x36/0x390 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x879/0xbe0 kernel/time/timer.c:1817 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x195/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:538 [inline] smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 </IRQ> RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:165 [inline] RIP: 0010:check_memory_region_inline mm/kasan/generic.c:181 [inline] RIP: 0010:check_memory_region+0x4c/0x280 mm/kasan/generic.c:191 Code: 00 00 48 89 fb 48 c1 eb 03 49 b8 00 00 00 00 00 fc ff df 4e 8d 0c 03 4c 8d 54 37 ff 49 c1 ea 03 49 bb 01 00 00 00 00 fc ff df <4f> 8d 34 1a 4c 89 f5 4c 29 cd 48 83 fd 10 7f 26 48 85 ed 0f 84 3a RSP: 0018:ffff8881ec25f578 EFLAGS: 00000a07 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: 1ffffd4000ef67b8 RCX: ffffffff818acd84 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffea00077b3dc0 RBP: 000000000001ffff R08: dffffc0000000000 R09: fffff94000ef67b8 R10: 1ffffd4000ef67b8 R11: dffffc0000000001 R12: ffffea00077b3dc8 R13: dffffc0000000000 R14: 1ffffd4000ef67b9 R15: ffffea00077b3dc0 test_bit include/asm-generic/bitops-instrumented.h:237 [inline] PageCompound include/linux/page-flags.h:188 [inline] page_mapcount include/linux/mm.h:824 [inline] zap_pte_range mm/memory.c:1106 [inline] zap_pmd_range mm/memory.c:1222 [inline] zap_pud_range mm/memory.c:1251 [inline] zap_p4d_range mm/memory.c:1272 [inline] unmap_page_range+0x10c4/0x2620 mm/memory.c:1293 unmap_single_vma mm/memory.c:1338 [inline] unmap_vmas+0x355/0x4b0 mm/memory.c:1370 exit_mmap+0x2bc/0x520 mm/mmap.c:3191 __mmput+0x8e/0x2c0 kernel/fork.c:1101 exit_mm kernel/exit.c:536 [inline] do_exit+0xc08/0x2bc0 kernel/exit.c:846 do_group_exit+0x138/0x300 kernel/exit.c:982 get_signal+0xdb1/0x1440 kernel/signal.c:2735 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7fbf57c2bf69 Code: Bad RIP value. RSP: 002b:00007fbf56f85178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbf57d63058 RCX: 00007fbf57c2bf69 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbf57d6305c RBP: 00007fbf57d63050 R08: 00007ffefb1ef0b0 R09: 00007fbf56f856c0 R10: 0000000000000046 R11: 0000000000000246 R12: 00007fbf57d6305c R13: 000000000000000b R14: 00007ffefb1cb150 R15: 00007ffefb1cb238 Modules linked in: CR2: 0000000000000000 ---[ end trace 912754053aa8f8e5 ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010202 RAX: ffffffff8154d7aa RBX: 0000000000000101 RCX: ffff8881ebdc8fc0 RDX: 0000000080000101 RSI: 0000000000000000 RDI: ffff8881d600f1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffff9e60 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d600f1c0 FS: 00007fbf56f856c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d7f3d000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 48 89 fb mov %rdi,%rbx 5: 48 c1 eb 03 shr $0x3,%rbx 9: 49 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%r8 10: fc ff df 13: 4e 8d 0c 03 lea (%rbx,%r8,1),%r9 17: 4c 8d 54 37 ff lea -0x1(%rdi,%rsi,1),%r10 1c: 49 c1 ea 03 shr $0x3,%r10 20: 49 bb 01 00 00 00 00 movabs $0xdffffc0000000001,%r11 27: fc ff df * 2a: 4f 8d 34 1a lea (%r10,%r11,1),%r14 <-- trapping instruction 2e: 4c 89 f5 mov %r14,%rbp 31: 4c 29 cd sub %r9,%rbp 34: 48 83 fd 10 cmp $0x10,%rbp 38: 7f 26 jg 0x60 3a: 48 85 ed test %rbp,%rbp 3d: 0f .byte 0xf 3e: 84 3a test %bh,(%rdx)