syz-executor1 calls setitimer() with new_value NULL pointer. Misfeature support will be removed kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 3909 Comm: syz-executor0 Not tainted 4.4.165+ #2 task: ffff8800a72117c0 task.stack: ffff8801c51e8000 RIP: 0010:[] [] rt_mutex_top_waiter kernel/locking/rtmutex_common.h:53 [inline] RIP: 0010:[] [] remove_waiter+0x4f/0x2e0 kernel/locking/rtmutex.c:1082 RSP: 0018:ffff8801c51ef940 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8800b6c69410 RCX: 0000000000000001 RDX: 0000000000000007 RSI: ffff8801beca79e0 RDI: 0000000000000038 RBP: ffff8801c51ef978 R08: ffff8800a72120f8 R09: ffffffff83a38cb0 R10: 00000000000544b0 R11: ffffffff831a2db8 R12: 00000000ffffffdd R13: ffff8801beca79e0 R14: ffff8800b6c69450 R15: 0000000000000000 FS: 00007f7c3a63c700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000025010d8 CR3: 00000001d9812000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801beca7a98 ffff8801beca79e0 ffff8800b6c69410 00000000ffffffdd ffff8800b6c69458 ffff8801beca79e0 dffffc0000000000 ffff8801c51ef9a8 ffffffff8120abdd ffff8801beca7a60 ffff8801c1c57a60 ffff8801beca7a98 Call Trace: [] rt_mutex_start_proxy_lock+0xbd/0x120 kernel/locking/rtmutex.c:1685 [] futex_requeue+0xbb2/0x16b0 kernel/futex.c:1944 [] do_futex+0x204/0x1a00 kernel/futex.c:3248 [] SYSC_futex kernel/futex.c:3286 [inline] [] SyS_futex+0x242/0x360 kernel/futex.c:3254 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Code: 53 48 89 fb 48 83 ec 10 80 3c 02 00 0f 85 2d 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 40 49 8d 7f 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 17 02 00 00 49 3b 5f 38 0f 85 f0 01 00 00 48 RIP [] rt_mutex_top_waiter kernel/locking/rtmutex_common.h:53 [inline] RIP [] remove_waiter+0x4f/0x2e0 kernel/locking/rtmutex.c:1082 RSP ---[ end trace 76c52808b08bd480 ]---