==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
BUG: KASAN: null-ptr-deref in page_ref_count include/linux/page_ref.h:67 [inline]
BUG: KASAN: null-ptr-deref in put_page_testzero include/linux/mm.h:996 [inline]
BUG: KASAN: null-ptr-deref in folio_put_testzero include/linux/mm.h:1002 [inline]
BUG: KASAN: null-ptr-deref in folio_put include/linux/mm.h:1429 [inline]
BUG: KASAN: null-ptr-deref in filemap_fault+0x544/0x24a0 mm/filemap.c:3382
Read of size 4 at addr 0000000000000032 by task syz-executor.1/6506

CPU: 1 PID: 6506 Comm: syz-executor.1 Not tainted 6.3.0-syzkaller-12423-g865fdb08197e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
 print_report mm/kasan/report.c:465 [inline]
 kasan_report+0xec/0x130 mm/kasan/report.c:572
 check_region_inline mm/kasan/generic.c:181 [inline]
 kasan_check_range+0x141/0x190 mm/kasan/generic.c:187
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
 page_ref_count include/linux/page_ref.h:67 [inline]
 put_page_testzero include/linux/mm.h:996 [inline]
 folio_put_testzero include/linux/mm.h:1002 [inline]
 folio_put include/linux/mm.h:1429 [inline]
 filemap_fault+0x544/0x24a0 mm/filemap.c:3382
 __do_fault+0x107/0x600 mm/memory.c:4176
 do_read_fault mm/memory.c:4530 [inline]
 do_fault mm/memory.c:4659 [inline]
 do_pte_missing mm/memory.c:3647 [inline]
 handle_pte_fault mm/memory.c:4947 [inline]
 __handle_mm_fault+0x28bc/0x41c0 mm/memory.c:5089
 handle_mm_fault+0x2af/0x9f0 mm/memory.c:5243
 do_user_addr_fault+0x51a/0x1210 arch/x86/mm/fault.c:1440
 handle_page_fault arch/x86/mm/fault.c:1534 [inline]
 exc_page_fault+0x98/0x170 arch/x86/mm/fault.c:1590
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0023:0xf7272d59
Code: 24 14 8d 04 7f 8b 6c 24 04 83 2c 24 01 89 44 24 0c 89 c8 89 ef 85 c0 0f 84 7b 01 00 00 8d 74 26 00 31 d2 89 c1 83 ef 01 f7 f6 <0f> b6 14 13 88 17 89 ea 29 fa 39 f1 73 e9 8b 0c 24 85 c9 0f 85 0e
RSP: 002b:00000000ffe4ebf0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 00000000f72d86c0 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 000000000000000a RDI: 00000000ffe4f13b
RBP: 00000000ffe4f13c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
==================================================================
----------------
Code disassembly (best guess):
   0:	24 14                	and    $0x14,%al
   2:	8d 04 7f             	lea    (%rdi,%rdi,2),%eax
   5:	8b 6c 24 04          	mov    0x4(%rsp),%ebp
   9:	83 2c 24 01          	subl   $0x1,(%rsp)
   d:	89 44 24 0c          	mov    %eax,0xc(%rsp)
  11:	89 c8                	mov    %ecx,%eax
  13:	89 ef                	mov    %ebp,%edi
  15:	85 c0                	test   %eax,%eax
  17:	0f 84 7b 01 00 00    	je     0x198
  1d:	8d 74 26 00          	lea    0x0(%rsi,%riz,1),%esi
  21:	31 d2                	xor    %edx,%edx
  23:	89 c1                	mov    %eax,%ecx
  25:	83 ef 01             	sub    $0x1,%edi
  28:	f7 f6                	div    %esi
* 2a:	0f b6 14 13          	movzbl (%rbx,%rdx,1),%edx <-- trapping instruction
  2e:	88 17                	mov    %dl,(%rdi)
  30:	89 ea                	mov    %ebp,%edx
  32:	29 fa                	sub    %edi,%edx
  34:	39 f1                	cmp    %esi,%ecx
  36:	73 e9                	jae    0x21
  38:	8b 0c 24             	mov    (%rsp),%ecx
  3b:	85 c9                	test   %ecx,%ecx
  3d:	0f                   	.byte 0xf
  3e:	85 0e                	test   %ecx,(%rsi)