8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000008 when read
[00000008] *pgd=8546f003, *pmd=f202f003
Internal error: Oops: 205 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 4875 Comm: syz.1.412 Not tainted 6.10.0-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at path_from_stashed+0x1c/0x308 fs/libfs.c:2204
LR is at open_namespace+0x44/0xbc fs/nsfs.c:102
pc : [<8053af54>]    lr : [<8054d6f8>]    psr: 80000013
sp : dfd69e80  ip : 84d82400  fp : dfd69ec4
r10: 84d82400  r9 : 00000005  r8 : 82ec7540
r7 : 82caa250  r6 : 84d82400  r5 : 00000000  r4 : 8437a258
r3 : dfd69ecc  r2 : 00000008  r1 : 82c95800  r0 : 00000008
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 8529d2c0  DAC: fffffffd
Register r0 information: non-paged memory
Register r1 information: slab kmalloc-1k start 82c95800 pointer offset 0 size 1024
Register r2 information: non-paged memory
Register r3 information: 2-page vmalloc region starting at 0xdfd68000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780
Register r4 information: slab anon_vma_chain start 8437a258 pointer offset 0 size 40
Register r5 information: NULL pointer
Register r6 information: slab task_struct start 84d82400 pointer offset 0 size 3072
Register r7 information: slab mnt_cache start 82caa240 pointer offset 16 size 184
Register r8 information: slab filp start 82ec7540 pointer offset 0 size 160
Register r9 information: non-paged memory
Register r10 information: slab task_struct start 84d82400 pointer offset 0 size 3072
Register r11 information: 2-page vmalloc region starting at 0xdfd68000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2780
Register r12 information: slab task_struct start 84d82400 pointer offset 0 size 3072
Process syz.1.412 (pid: 4875, stack limit = 0xdfd68000)
Stack: (0xdfd69e80 to 0xdfd6a000)
9e80: 805525e4 84d82400 dfd69ebc dfd69e98 8027c93c 802ac404 00000000 8437a258
9ea0: 00000000 84d82400 84d80880 82ec7540 00000005 84d82400 dfd69ef4 dfd69ec8
9ec0: 8054d6f8 8053af44 dfd69ef4 00000000 00000000 be9d7c60 8437a258 8437a258
9ee0: 84d80000 00000008 dfd69f14 dfd69ef8 8055271c 8054d6c0 0000ff07 00000000
9f00: 82ec7541 00000000 dfd69fa4 dfd69f18 8051a7f0 805525a4 84d82400 00000001
9f20: ecac8b10 84d82400 dfd69f44 dfd69f38 81903eac 81903d7c dfd69f5c dfd69f48
9f40: 8024b544 8027aebc 40000000 dfd69fb0 dfd69f84 dfd69f60 80202dd8 8024b500
9f60: 8261c90c dfd69fb0 0014aa30 ecac8b10 80202cc0 be9d7c60 dfd69fac 00000000
9f80: 00000000 002642e0 00000036 8020029c 84d82400 00000036 00000000 dfd69fa8
9fa0: 80200060 8051a6c8 00000000 00000000 00000005 0000ff07 00000000 00000000
9fc0: 00000000 00000000 002642e0 00000036 7eee5766 7eee5767 003d0f00 76b500bc
9fe0: 76b4fec8 76b4feb8 000183ec 00130580 60000010 00000005 00000000 00000000
Call trace: 
[<8053af38>] (path_from_stashed) from [<8054d6f8>] (open_namespace+0x44/0xbc fs/nsfs.c:102)
 r10:84d82400 r9:00000005 r8:82ec7540 r7:84d80880 r6:84d82400 r5:00000000
 r4:8437a258
[<8054d6b4>] (open_namespace) from [<8055271c>] (pidfd_ioctl+0x184/0x4c4 fs/pidfs.c:196)
 r6:00000008 r5:84d80000 r4:8437a258
[<80552598>] (pidfd_ioctl) from [<8051a7f0>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<80552598>] (pidfd_ioctl) from [<8051a7f0>] (do_vfs_ioctl fs/ioctl.c:861 [inline])
[<80552598>] (pidfd_ioctl) from [<8051a7f0>] (__do_sys_ioctl fs/ioctl.c:905 [inline])
[<80552598>] (pidfd_ioctl) from [<8051a7f0>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893)
 r7:00000000 r6:82ec7541 r5:00000000 r4:0000ff07
[<8051a6bc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdfd69fa8 to 0xdfd69ff0)
9fa0:                   00000000 00000000 00000005 0000ff07 00000000 00000000
9fc0: 00000000 00000000 002642e0 00000036 7eee5766 7eee5767 003d0f00 76b500bc
9fe0: 76b4fec8 76b4feb8 000183ec 00130580
 r10:00000036 r9:84d82400 r8:8020029c r7:00000036 r6:002642e0 r5:00000000
 r4:00000000
Code: e24dd01c e1a07001 e5911004 ee1dcf70 (e5905000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e24dd01c 	sub	sp, sp, #28
   4:	e1a07001 	mov	r7, r1
   8:	e5911004 	ldr	r1, [r1, #4]
   c:	ee1dcf70 	mrc	15, 0, ip, cr13, cr0, {3}
* 10:	e5905000 	ldr	r5, [r0] <-- trapping instruction