BUG: unable to handle kernel NULL pointer dereference at 00000000000000fc
PGD 0 P4D 0 
Oops: 0000 [#1] SMP KASAN
CPU: 0 PID: 10127 Comm: blkid Not tainted 4.18.0-rc3+ #51
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
Code: 48 89 e5 41 57 49 c7 c7 60 b0 f1 88 41 56 41 55 41 54 49 89 f4 53 48 83 ec 10 48 89 7d c8 4d 89 e5 4d 85 e4 0f 84 c8 00 00 00 <49> 63 95 fc 00 00 00 4c 8b 30 48 29 d0 49 83 3f 00 48 89 c6 0f 84 
RSP: 0018:ffff880199cdf3d0 EFLAGS: 00010246
RAX: ffffffff8aa58410 RBX: 0000000000000282 RCX: 0000000000000000
RDX: ffffea00002a9600 RSI: ffffea00002a9607 RDI: 0000000000000282
RBP: ffff880199cdf408 R08: ffffed0043fff5cd R09: ffffed0043fff5cc
R10: ffffed0043fff5cc R11: ffff88021fffae63 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8aa58410 R15: ffffffff88f1b060
FS:  0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000fc CR3: 000000019bcd9000 CR4: 00000000001406f0
DR0: 00000000200001c0 DR1: 00000000200001c0 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 quarantine_reduce+0x163/0x1a0 mm/kasan/quarantine.c:259
 kasan_kmalloc+0x99/0xe0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3392 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
 ptlock_alloc mm/memory.c:4721 [inline]
 ptlock_init include/linux/mm.h:1858 [inline]
 pgtable_pmd_page_ctor include/linux/mm.h:1952 [inline]
 pmd_alloc_one arch/x86/include/asm/pgalloc.h:105 [inline]
 __pmd_alloc+0xc3/0x530 mm/memory.c:4214
 pmd_alloc include/linux/mm.h:1808 [inline]
 alloc_new_pmd mm/mremap.c:75 [inline]
 move_page_tables+0x154f/0x1dc0 mm/mremap.c:222
 shift_arg_pages+0x1c6/0x470 fs/exec.c:652
 setup_arg_pages+0x6b0/0x850 fs/exec.c:764
 load_elf_binary+0xcb0/0x5610 fs/binfmt_elf.c:887
 search_binary_handler+0x17d/0x570 fs/exec.c:1653
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.36+0x171d/0x2730 fs/exec.c:1819
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fd8bf0a3207
Code: Bad RIP value.
RSP: 002b:00007fff7c852e58 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fd8bf0a3207
RDX: 00000000020241f0 RSI: 00007fff7c852f50 RDI: 00007fff7c853f60
RBP: 0000000000625500 R08: 000000000000199a R09: 000000000000199a
R10: 0000000000000000 R11: 0000000000000202 R12: 00000000020241f0
R13: 0000000000000007 R14: 0000000002023250 R15: 0000000000000005
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: 00000000000000fc
BUG: unable to handle kernel paging request at fffffffd01228e60
==================================================================
PGD 8e6d067 
BUG: KASAN: stack-out-of-bounds in hlist_move_list include/linux/list.h:760 [inline]
BUG: KASAN: stack-out-of-bounds in __collect_expired_timers kernel/time/timer.c:1382 [inline]
BUG: KASAN: stack-out-of-bounds in collect_expired_timers kernel/time/timer.c:1615 [inline]
BUG: KASAN: stack-out-of-bounds in __run_timers+0xba0/0xc70 kernel/time/timer.c:1662
P4D 8e6d067 
Write of size 8 at addr ffff8801a0f70890 by task blkid/10127
PUD 0 

CPU: 0 PID: 10127 Comm: blkid Tainted: G      D           4.18.0-rc3+ #51
Thread overran stack, or stack corrupted
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Oops: 0000 [#2] SMP KASAN
Call Trace:
CPU: 1 PID: 10108 Comm: syz-executor3 Tainted: G      D           4.18.0-rc3+ #51
 <IRQ>
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
RIP: 0010:__queue_work+0x2cf/0x1410 kernel/workqueue.c:1391
Code: 
00 
00 
4a 8d 
3c 
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
ed 
60 
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
2e 
 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:438
d1 
 hlist_move_list include/linux/list.h:760 [inline]
 __collect_expired_timers kernel/time/timer.c:1382 [inline]
 collect_expired_timers kernel/time/timer.c:1615 [inline]
 __run_timers+0xba0/0xc70 kernel/time/timer.c:1662
88 
83 
e3 
02 48 
89 f8 
48 
c1 
e8 03 
42 
80 
3c 
20 00 
0f 
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
85 aa 
 __do_softirq+0x2e8/0xb17 kernel/softirq.c:288
0f 
00 00 
48 
c7 
c0 
60 
2e 
d1 
88 
31 
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x1d1/0x200 kernel/softirq.c:408
ff 
 exiting_irq arch/x86/include/asm/apic.h:527 [inline]
 smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1052
89 de 
<4e> 8b 
2c 
e8 
e8 
58 
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
bb 
 </IRQ>
2c 
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:783 [inline]
RIP: 0010:oops_end+0x65/0xe0 arch/x86/kernel/dumpstack.c:342
00 85 
Code: 
db 
00 
0f 
00 00 
85 
c7 
be 06 
05 
00 
f8 
00 
34 
e8 
c4 
3b ba 
07 
2c 
ff ff 
00 
ff 
ff 
RSP: 0018:ffff8801daf07550 EFLAGS: 00010046
e8 a3 
a1 
RAX: ffffffff88d12e60 RBX: 0000000000000000 RCX: ffffffff814f511f
1c 
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
00 83 
RBP: ffff8801daf07770 R08: ffff8801c2b72540 R09: fffffbfff15852e1
2d 
R10: fffffbfff15852e1 R11: ffffffff8ac2970b R12: dffffc0000000000
R13: ffffffffaf0a2c00 R14: ffff8801da8147c0 R15: 00000000af0a2c00
14 09 
FS:  00000000029be940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
bb 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
08 
CR2: fffffffd01228e60 CR3: 00000001c1c25000 CR4: 00000000001406e0
01 
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
74 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
57 
Call Trace:
48 
 <IRQ>
83 3d 
ca 
23 
c7 
07 
00 
74 
7b 48 
89 
df 
 delayed_work_timer_fn+0x5d/0x90 kernel/workqueue.c:1500
57 9d 
 call_timer_fn+0x242/0x970 kernel/time/timer.c:1326
<0f> 
1f 
44 
00 
00 
e8 
21 
a9 1c 
00 be 
01 
00 
00 
00 
48 
c7 
c7 
c0 
95 
 expire_timers kernel/time/timer.c:1359 [inline]
 __run_timers+0x705/0xc70 kernel/time/timer.c:1666
e5 
89 
RSP: 0018:ffff880199cdef48 EFLAGS: 00000282
 ORIG_RAX: ffffffffffffff13
RAX: ffff8801b9f20600 RBX: 0000000000000282 RCX: ffffffff81472e80
RDX: 0000000000000000 RSI: ffffffff81472e59 RDI: 0000000000000282
RBP: ffff880199cdef60 R08: ffff8801b9f20600 R09: ffffed003b5c3ec2
R10: ffffed003b5c3ec2 R11: ffff8801dae1f617 R12: 0000000000000009
R13: ffff880199cdf328 R14: 0000000000000009 R15: ffff880199cdf328
 no_context+0x3ff/0x980 arch/x86/mm/fault.c:814
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
 __do_softirq+0x2e8/0xb17 kernel/softirq.c:288
 __bad_area_nosemaphore+0x33b/0x3f0 arch/x86/mm/fault.c:902
 bad_area_nosemaphore+0x33/0x40 arch/x86/mm/fault.c:909
 __do_page_fault+0x1db/0xe50 arch/x86/mm/fault.c:1328
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x1d1/0x200 kernel/softirq.c:408
 do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
 exiting_irq arch/x86/include/asm/apic.h:527 [inline]
 smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
 </IRQ>
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
Modules linked in:
Code: 
48 
Dumping ftrace buffer:
89 
   (ftrace buffer empty)
e5 
CR2: fffffffd01228e60
41 
---[ end trace f70e6a862fecfb5a ]---
57 
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
49 c7 
Code: 48 
c7 
89 e5 
60 b0 
41 57 
f1 
49 
88 
c7 c7 
41 56 
60 b0 
41 55 
f1 
41 54 
88 
49 
41 
89 
56 
f4 53 
41 
48 
55 41 
83 
54 
ec 
49 89 
10 
f4 
48 
53 
89 
48 83 
7d 
ec 10 
c8 
48 
4d 
89 
89 
7d 
e5 
c8 
4d 
4d 89 
85 
e5 
e4 
4d 85 
0f 
e4 
84 
0f 
c8 00 
84 
00 
c8 
00 
00 
<49> 
00 00 
63 95 
<49> 63 
fc 
95 
00 00 
fc 
00 
00 00 
4c 
00 
8b 
4c 
30 
8b 
48 
30 
29 
48 
d0 
29 
49 
d0 49 
83 3f 
83 
00 48 
3f 
89 
00 48 
c6 0f 
89 c6 
84 
0f 
84 
RSP: 0018:ffff880199cdf3d0 EFLAGS: 00010246
RSP: 0018:ffff880199cdf3d0 EFLAGS: 00010246
RAX: ffffffff8aa58410 RBX: 0000000000000282 RCX: 0000000000000000
RDX: ffffea00002a9600 RSI: ffffea00002a9607 RDI: 0000000000000282
RBP: ffff880199cdf408 R08: ffffed0043fff5cd R09: ffffed0043fff5cc
RAX: ffffffff8aa58410 RBX: 0000000000000282 RCX: 0000000000000000
R10: ffffed0043fff5cc R11: ffff88021fffae63 R12: 0000000000000000
RDX: ffffea00002a9600 RSI: ffffea00002a9607 RDI: 0000000000000282
R13: 0000000000000000 R14: ffffffff8aa58410 R15: ffffffff88f1b060
RBP: ffff880199cdf408 R08: ffffed0043fff5cd R09: ffffed0043fff5cc
R10: ffffed0043fff5cc R11: ffff88021fffae63 R12: 0000000000000000
 quarantine_reduce+0x163/0x1a0 mm/kasan/quarantine.c:259
R13: 0000000000000000 R14: ffffffff8aa58410 R15: ffffffff88f1b060
 kasan_kmalloc+0x99/0xe0 mm/kasan/kasan.c:538
FS:  00000000029be940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3392 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
CR2: fffffffd01228e60 CR3: 00000001c1c25000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 ptlock_alloc mm/memory.c:4721 [inline]
 ptlock_init include/linux/mm.h:1858 [inline]
 pgtable_pmd_page_ctor include/linux/mm.h:1952 [inline]
 pmd_alloc_one arch/x86/include/asm/pgalloc.h:105 [inline]
 __pmd_alloc+0xc3/0x530 mm/memory.c:4214
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 pmd_alloc include/linux/mm.h:1808 [inline]
 alloc_new_pmd mm/mremap.c:75 [inline]
 move_page_tables+0x154f/0x1dc0 mm/mremap.c:222