kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3204 Comm: syz-executor1 Not tainted 4.13.0-next-20170912+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88002b4aa500 task.stack: ffff88002b4b0000
RIP: 0010:__hlist_del include/linux/list.h:650 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:791 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1309 [inline]
RIP: 0010:__run_timers+0x619/0xb90 kernel/time/timer.c:1620
RSP: 0018:ffff88003ec07968 EFLAGS: 00010806
RAX: 1bd5a00000000041 RBX: ffff8800387d3740 RCX: 1ffff10007d80f76
RDX: ffff88003ec07bb0 RSI: ffffffff85b380e0 RDI: dead000000000208
RBP: ffff88003ec07c58 R08: ffff88003ec072b8 R09: ffff88003ec072b0
R10: ffff88003ec07228 R11: 1ffff10005695733 R12: ffff8800387d3748
R13: dffffc0000000000 R14: dead000000000200 R15: ffff88003ec07c30
FS:  00000000019df940(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000019e9cb8 CR3: 000000002b477000 CR4: 00000000000026f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:814 [inline]
RIP: 0010:lock_acquire+0x256/0x580 kernel/locking/lockdep.c:4005
RSP: 0018:ffff88002b4b7c88 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff88002b4aa500 RCX: 0000000000000000
RDX: 1ffffffff0b59305 RSI: 0000000000000001 RDI: 0000000000000282
RBP: ffff88002b4b7d80 R08: 0000000000000000 R09: 0000000000000000
R10: 1ffff10005696eb2 R11: 1ffff10005696fea R12: 1ffff10005696f97
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
 down_read+0x96/0x150 kernel/locking/rwsem.c:23
 inode_lock_shared include/linux/fs.h:722 [inline]
 iterate_dir+0xbf/0x5d0 fs/readdir.c:40
 SYSC_getdents fs/readdir.c:231 [inline]
 SyS_getdents+0x225/0x450 fs/readdir.c:212
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x445765
RSP: 002b:0000000000a5e8b0 EFLAGS: 00000246 ORIG_RAX: 000000000000004e
RAX: ffffffffffffffda RBX: 00000000019e1cb0 RCX: 0000000000445765
RDX: 0000000000008000 RSI: 00000000019e1cb0 RDI: 0000000000000016
RBP: 0000000000000082 R08: 0000000000000001 R09: 0000000000000076
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000019e1c70
R13: 0000000000018351 R14: 0000000000002710 R15: 00000000006e99d8
Code: 4d 85 f6 4c 89 32 48 89 95 58 fd ff ff 42 c6 04 28 f8 74 26 e8 49 33 10 00 49 8d 7e 08 48 8b 95 58 fd ff ff 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 b5 04 00 00 49 89 56 08 e8 23 33 10 00 4c 
RIP: __hlist_del include/linux/list.h:650 [inline] RSP: ffff88003ec07968
RIP: detach_timer kernel/time/timer.c:791 [inline] RSP: ffff88003ec07968
RIP: expire_timers kernel/time/timer.c:1309 [inline] RSP: ffff88003ec07968
RIP: __run_timers+0x619/0xb90 kernel/time/timer.c:1620 RSP: ffff88003ec07968
---[ end trace db7bc398cdd859d2 ]---