kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 3 PID: 14145 Comm: syz-executor4 Not tainted 4.13.0-rc7-next-20170829+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88003bf8a400 task.stack: ffff88002eac0000
RIP: 0010:__hlist_del include/linux/list.h:650 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:791 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1309 [inline]
RIP: 0010:__run_timers+0x619/0xb90 kernel/time/timer.c:1620
RSP: 0018:ffff88006df07aa8 EFLAGS: 00010806
RAX: 1bd5a00000000041 RBX: ffff88006b5abb40 RCX: 1ffff1000dbe0f9e
RDX: ffff88006df07cf0 RSI: 0000000000000008 RDI: dead000000000208
RBP: ffff88006df07d98 R08: ffff88006df073f8 R09: ffff88006df073f0
R10: ffff88006df07368 R11: 1ffff100077f1713 R12: ffff88006b5abb48
R13: dffffc0000000000 R14: dead000000000200 R15: ffff88006df07d70
FS:  00007f4096eff700(0000) GS:ffff88006df00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200b1000 CR3: 000000003a08c000 CR4: 00000000000026e0
Call Trace:
 <IRQ>
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bd/0xbd4 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:1044
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:577
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0xe/0x60 kernel/kcov.c:64
RSP: 0018:ffff88002eac64a0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: ffff88003bf8a400 RBX: ffff880039515238 RCX: ffffc90003b9b000
RDX: 0000000000010000 RSI: ffffffff84ce972a RDI: ffff880039515230
RBP: ffff88002eac6690 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: ffffffff87061ca0 R12: ffffea0000d20ec0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0000d20ec0
 radix_tree_lookup_slot+0x78/0xe0 lib/radix-tree.c:1079
 find_get_entry+0x184/0x9e0 mm/filemap.c:1304
 find_lock_entry+0xde/0x730 mm/filemap.c:1368
 shmem_getpage_gfp+0x516/0x3830 mm/shmem.c:1616
 shmem_getpage mm/shmem.c:131 [inline]
 shmem_write_begin+0xf7/0x1a0 mm/shmem.c:2370
 generic_perform_write+0x28c/0x650 mm/filemap.c:2981
 __generic_file_write_iter+0x366/0x5b0 mm/filemap.c:3106
 generic_file_write_iter+0x399/0x7a0 mm/filemap.c:3134
 call_write_iter include/linux/fs.h:1744 [inline]
 do_iter_readv_writev+0x531/0x7f0 fs/read_write.c:650
 do_iter_write+0x15a/0x540 fs/read_write.c:929
 vfs_iter_write+0x77/0xb0 fs/read_write.c:942
 iter_file_splice_write+0x7e9/0xf50 fs/splice.c:765
 do_splice_from fs/splice.c:867 [inline]
 direct_splice_actor+0x125/0x180 fs/splice.c:1034
 splice_direct_to_actor+0x2c1/0x820 fs/splice.c:989
 do_splice_direct+0x2a7/0x3d0 fs/splice.c:1077
 do_sendfile+0x5d5/0xe90 fs/read_write.c:1412
 SYSC_sendfile64 fs/read_write.c:1467 [inline]
 SyS_sendfile64+0xbd/0x160 fs/read_write.c:1459
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x447299
RSP: 002b:00007f4096efec08 EFLAGS: 00000286 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000447299
RDX: 0000000020001000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000fec R11: 0000000000000286 R12: 00000000ffffffff
R13: 0000000000005d90 R14: 00000000006e7e50 R15: 0000000020001000
Code: 4d 85 f6 4c 89 32 48 89 95 58 fd ff ff 42 c6 04 28 f8 74 26 e8 e9 35 10 00 49 8d 7e 08 48 8b 95 58 fd ff ff 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 b5 04 00 00 49 89 56 08 e8 c3 35 10 00 4c 
RIP: __hlist_del include/linux/list.h:650 [inline] RSP: ffff88006df07aa8
RIP: detach_timer kernel/time/timer.c:791 [inline] RSP: ffff88006df07aa8
RIP: expire_timers kernel/time/timer.c:1309 [inline] RSP: ffff88006df07aa8
RIP: __run_timers+0x619/0xb90 kernel/time/timer.c:1620 RSP: ffff88006df07aa8
---[ end trace 07536522c3381cbc ]---