BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1e449b067 P4D 1e449b067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4633 Comm: syz-executor.2 Tainted: G        W         5.4.274-syzkaller-00016-gdd432c37afcd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010202
RAX: ffffffff8154d7aa RBX: 0000000000000102 RCX: ffff8881e7b58fc0
RDX: 0000000080000102 RSI: 0000000000000000 RDI: ffff8881d764b1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d3ee R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffaae0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d764b1c0
FS:  0000555556238480(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001d40f0000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x879/0xbe0 kernel/time/timer.c:1817
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x195/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:538 [inline]
 smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x1a/0x70 kernel/kcov.c:283
Code: 74 0a 18 4c 89 44 0a 20 49 ff c1 4c 89 09 c3 90 4c 8b 04 24 65 48 8b 15 f4 4d 9e 7e 65 8b 05 f9 4d 9e 7e a9 00 01 1f 00 74 01 <c3> 8b 82 00 0a 00 00 83 f8 03 75 f4 48 8b 8a 08 0a 00 00 44 8b 92
RSP: 0018:ffff8881e6d4f700 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881e7b58fc0
RDX: ffff8881e7b58fc0 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8881e6d4f901 R08: ffffffff818a8b1a R09: fffff94000ebbace
R10: 0000000000000000 R11: dffffc0000000001 R12: 80000001d8999007
R13: 0000000000000028 R14: 00007f15a0c20000 R15: ffff8881e9178de0
 __pte_needs_invert arch/x86/include/asm/pgtable-invert.h:18 [inline]
 protnone_mask arch/x86/include/asm/pgtable-invert.h:24 [inline]
 pte_pfn arch/x86/include/asm/pgtable.h:214 [inline]
 vm_normal_page+0x3a/0x1d0 mm/memory.c:609
 copy_one_pte mm/memory.c:802 [inline]
 copy_pte_range mm/memory.c:855 [inline]
 copy_pmd_range mm/memory.c:906 [inline]
 copy_pud_range mm/memory.c:940 [inline]
 copy_p4d_range mm/memory.c:962 [inline]
 copy_page_range+0x100f/0x26f0 mm/memory.c:1024
 dup_mmap kernel/fork.c:608 [inline]
 dup_mm kernel/fork.c:1379 [inline]
 copy_mm+0xb23/0x10d0 kernel/fork.c:1435
 copy_process+0x1291/0x3230 kernel/fork.c:2052
 _do_fork+0x197/0x900 kernel/fork.c:2399
 __do_sys_clone kernel/fork.c:2557 [inline]
 __se_sys_clone kernel/fork.c:2538 [inline]
 __x64_sys_clone+0x26b/0x2c0 kernel/fork.c:2538
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f15a149ff93
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffd9042d918 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f15a149ff93
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000555556238750 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
Modules linked in:
CR2: 0000000000000000
---[ end trace 3ad903357e2cd6e7 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010202
RAX: ffffffff8154d7aa RBX: 0000000000000102 RCX: ffff8881e7b58fc0
RDX: 0000000080000102 RSI: 0000000000000000 RDI: ffff8881d764b1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154d3ee R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffaae0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d764b1c0
FS:  0000555556238480(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001d40f0000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	74 0a                	je     0xc
   2:	18 4c 89 44          	sbb    %cl,0x44(%rcx,%rcx,4)
   6:	0a 20                	or     (%rax),%ah
   8:	49 ff c1             	inc    %r9
   b:	4c 89 09             	mov    %r9,(%rcx)
   e:	c3                   	ret
   f:	90                   	nop
  10:	4c 8b 04 24          	mov    (%rsp),%r8
  14:	65 48 8b 15 f4 4d 9e 	mov    %gs:0x7e9e4df4(%rip),%rdx        # 0x7e9e4e10
  1b:	7e
  1c:	65 8b 05 f9 4d 9e 7e 	mov    %gs:0x7e9e4df9(%rip),%eax        # 0x7e9e4e1c
  23:	a9 00 01 1f 00       	test   $0x1f0100,%eax
  28:	74 01                	je     0x2b
* 2a:	c3                   	ret <-- trapping instruction
  2b:	8b 82 00 0a 00 00    	mov    0xa00(%rdx),%eax
  31:	83 f8 03             	cmp    $0x3,%eax
  34:	75 f4                	jne    0x2a
  36:	48 8b 8a 08 0a 00 00 	mov    0xa08(%rdx),%rcx
  3d:	44                   	rex.R
  3e:	8b                   	.byte 0x8b
  3f:	92                   	xchg   %eax,%edx