BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 1e5331067 P4D 1e5331067 PUD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 5245 Comm: syz.9.1359 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010206 RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881e0e56e40 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e9e5f1c0 RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffbe08 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e9e5f1c0 FS: 00007ff63b34c6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d9b86000 CR4: 00000000003406b0 DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff1 DR7: 0000000000000600 Call Trace: call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x81d/0xb60 kernel/time/timer.c:1817 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830 __do_softirq+0x236/0x660 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x197/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:539 [inline] smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:update_stack_state+0x0/0x4c0 arch/x86/kernel/unwind_frame.c:194 Code: 38 c1 0f 8c 57 fe ff ff e8 fd d5 5f 00 e9 4d fe ff ff 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 8b 07 48 89 06 5d c3 0f 1f 40 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 81 ec a8 00 00 00 49 89 RSP: 0018:ffff8881df4bf708 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffff8881df4bf778 RDI: ffff8881df4bf788 RBP: ffff8881df4bf778 R08: dffffc0000000001 R09: ffff8881df4bf788 R10: ffffed103be97efd R11: 1ffff1103be97ef1 R12: 0000000000000000 R13: ffff8881df4bf778 R14: ffff8881df4bf788 R15: ffff8881e0e56e40 unwind_start arch/x86/include/asm/unwind.h:60 [inline] arch_stack_walk+0xd8/0x140 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0xaa/0xf0 kernel/stacktrace.c:123 save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x162/0x200 mm/kasan/common.c:529 kasan_slab_alloc+0x12/0x20 mm/kasan/common.c:537 slab_post_alloc_hook mm/slab.h:584 [inline] slab_alloc_node mm/slub.c:2829 [inline] slab_alloc mm/slub.c:2837 [inline] kmem_cache_alloc_trace+0xe6/0x290 mm/slub.c:2854 kmalloc include/linux/slab.h:556 [inline] kzalloc include/linux/slab.h:690 [inline] selinux_perf_event_alloc+0x51/0x140 security/selinux/hooks.c:6970 security_perf_event_alloc+0x62/0x90 security/security.c:2455 perf_event_alloc+0x13fd/0x1920 kernel/events/core.c:10739 __do_sys_perf_event_open kernel/events/core.c:11161 [inline] __se_sys_perf_event_open+0x6ae/0x1a90 kernel/events/core.c:11053 __x64_sys_perf_event_open+0xbf/0xd0 kernel/events/core.c:11053 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7ff63cce3969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff63b34c038 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007ff63cf0afa0 RCX: 00007ff63cce3969 RDX: ffefffffffffffff RSI: 0000000000000000 RDI: 0000200000000700 RBP: 00007ff63cd65ab1 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ff63cf0afa0 R15: 00007ffd8890f768 Modules linked in: CR2: 0000000000000000 ---[ end trace 0ff3ec60637f3211 ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010206 RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881e0e56e40 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e9e5f1c0 RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffbe08 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e9e5f1c0 FS: 00007ff63b34c6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d9b86000 CR4: 00000000003406b0 DR0: 0000200000000300 DR1: 0000200000000300 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff1 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 38 c1 cmp %al,%cl 2: 0f 8c 57 fe ff ff jl 0xfffffe5f 8: e8 fd d5 5f 00 call 0x5fd60a d: e9 4d fe ff ff jmp 0xfffffe5f 12: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 19: 00 1a: 55 push %rbp 1b: 48 89 e5 mov %rsp,%rbp 1e: 48 8b 07 mov (%rdi),%rax 21: 48 89 06 mov %rax,(%rsi) 24: 5d pop %rbp 25: c3 ret 26: 0f 1f 40 00 nopl 0x0(%rax) * 2a: 55 push %rbp <-- trapping instruction 2b: 48 89 e5 mov %rsp,%rbp 2e: 41 57 push %r15 30: 41 56 push %r14 32: 41 55 push %r13 34: 41 54 push %r12 36: 53 push %rbx 37: 48 81 ec a8 00 00 00 sub $0xa8,%rsp 3e: 49 rex.WB 3f: 89 .byte 0x89