BUG: kernel NULL pointer dereference, address: 0000000000000004 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 99540067 P4D 99540067 PUD 9dcf6067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7193 Comm: syz-executor.4 Not tainted 5.9.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:update_pvclock_gtod arch/x86/kvm/x86.c:1745 [inline] RIP: 0010:pvclock_gtod_notify+0x192/0x570 arch/x86/kvm/x86.c:7452 Code: 8b 43 18 48 8d 7b 1c 48 89 fa 48 c1 ea 03 89 05 9c 0d 8b 0b 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 48 89 f8 83 e0 07 7e 7e <03> 38 d0 7c 08 84 d2 0f 85 2b 03 00 00 8b 43 1c 48 8d 7b 20 48 89 RSP: 0018:ffffc90000da8bf0 EFLAGS: 00010002 RAX: 0000000000000004 RBX: ffffffff8d437980 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8d43799c RBP: ffffffff89f770e0 R08: 0000000000000000 R09: ffffffff8d0b7a1f R10: fffffbfff1a16f43 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff89f02dc0 FS: 0000000000000000(0000) GS:ffff8880ae500000(0063) knlGS:000000000a2f1900 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000004 CR3: 0000000090e4a000 CR4: 00000000001526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 update_pvclock_gtod kernel/time/timekeeping.c:581 [inline] timekeeping_update+0x28a/0x4a0 kernel/time/timekeeping.c:675 timekeeping_advance+0x6ad/0xa40 kernel/time/timekeeping.c:2122 tick_do_update_jiffies64.part.0+0x1ec/0x330 kernel/time/tick-sched.c:101 tick_do_update_jiffies64 kernel/time/tick-sched.c:64 [inline] tick_sched_do_timer kernel/time/tick-sched.c:147 [inline] tick_sched_timer+0x236/0x2a0 kernel/time/tick-sched.c:1321 __run_hrtimer kernel/time/hrtimer.c:1524 [inline] __hrtimer_run_queues+0x1d5/0xfc0 kernel/time/hrtimer.c:1588 hrtimer_interrupt+0x334/0x940 kernel/time/hrtimer.c:1650 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline] __sysvec_apic_timer_interrupt+0x147/0x5f0 arch/x86/kernel/apic/apic.c:1097 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] sysvec_apic_timer_interrupt+0xb2/0xf0 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:770 [inline] RIP: 0010:lock_acquire+0x27b/0xaf0 kernel/locking/lockdep.c:5032 Code: ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 1d 07 00 00 48 83 3d d8 60 a0 08 00 0f 84 73 05 00 00 4c 89 ff 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 03 44 24 08 48 c7 RSP: 0018:ffffc9000611f780 EFLAGS: 00000286 RAX: 1ffffffff13f8d75 RBX: ffff88808ada8440 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000286 RBP: ffff88808ab7f4e8 R08: 0000000000000000 R09: ffffffff8d0b7a2f R10: fffffbfff1a16f45 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000286 down_write+0x8d/0x150 kernel/locking/rwsem.c:1531 inode_lock include/linux/fs.h:779 [inline] bd_set_size fs/block_dev.c:1376 [inline] __blkdev_get+0x7eb/0x1aa0 fs/block_dev.c:1517 blkdev_get fs/block_dev.c:1639 [inline] blkdev_open+0x227/0x300 fs/block_dev.c:1753 do_dentry_open+0x4b9/0x11b0 fs/open.c:817 do_open fs/namei.c:3251 [inline] path_openat+0x1b9a/0x2730 fs/namei.c:3368 do_filp_open+0x17e/0x3c0 fs/namei.c:3395 do_sys_openat2+0x16d/0x420 fs/open.c:1168 do_sys_open fs/open.c:1184 [inline] __do_compat_sys_open fs/open.c:1233 [inline] __se_compat_sys_open fs/open.c:1231 [inline] __ia32_compat_sys_open+0x119/0x1c0 fs/open.c:1231 do_syscall_32_irqs_on arch/x86/entry/common.c:78 [inline] __do_fast_syscall_32+0x60/0x90 arch/x86/entry/common.c:137 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:160 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f54549 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000090bfda4 EFLAGS: 00000216 ORIG_RAX: 0000000000000005 RAX: ffffffffffffffda RBX: 00000000090bfe50 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 000000000009e0d7 RDI: 00000000090bfe10 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: 0000000000000004 ---[ end trace f3f2acee4c18457d ]--- RIP: 0010:update_pvclock_gtod arch/x86/kvm/x86.c:1745 [inline] RIP: 0010:pvclock_gtod_notify+0x192/0x570 arch/x86/kvm/x86.c:7452 Code: 8b 43 18 48 8d 7b 1c 48 89 fa 48 c1 ea 03 89 05 9c 0d 8b 0b 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 48 89 f8 83 e0 07 7e 7e <03> 38 d0 7c 08 84 d2 0f 85 2b 03 00 00 8b 43 1c 48 8d 7b 20 48 89 RSP: 0018:ffffc90000da8bf0 EFLAGS: 00010002 RAX: 0000000000000004 RBX: ffffffff8d437980 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8d43799c RBP: ffffffff89f770e0 R08: 0000000000000000 R09: ffffffff8d0b7a1f R10: fffffbfff1a16f43 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffffffff89f02dc0 FS: 0000000000000000(0000) GS:ffff8880ae500000(0063) knlGS:000000000a2f1900 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000000000004 CR3: 0000000090e4a000 CR4: 00000000001526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400