BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 800000001f7e9067 P4D 800000001f7e9067 PUD 1db82067 PMD 0 
Oops: Oops: 0002 [#2] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 5373 Comm: syz.4.13 Not tainted 6.11.0-rc4-next-20240822-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:lookup_address_in_pgd_attr+0x17d/0x800 arch/x86/mm/pat/set_memory.c:694
Code: 4c 89 7c 24 10 49 bf 00 00 00 00 00 fc ff df 48 8b 44 24 38 42 0f b6 04 38 84 c0 0f 85 ca 04 00 00 4c 89 74 24 28 48 8b 04 24 <c7> 00 03 00 00 00 43 80 7c 3d 00 00 74 12 48 89 ef e8 6d 80 b9 00
RSP: 0018:ffffc900046fe1e8 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 800000001f7e9067 RCX: 0000000000000003
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff888078842000 R08: ffffffff81430698 R09: fffff520008dfc34
R10: dffffc0000000000 R11: fffff520008dfc34 R12: 1ffff920008dfc5e
R13: 1ffff1100f108400 R14: 0000000000000000 R15: dffffc0000000000
FS:  00007f73c15246c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000078842000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 show_fault_oops arch/x86/mm/fault.c:525 [inline]
 page_fault_oops+0x30d/0xcc0 arch/x86/mm/fault.c:705
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:clear_pending kernel/locking/qspinlock.c:151 [inline]
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:435 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x830/0xdb0 kernel/locking/qspinlock.c:508
Code: e9 6e ff ff ff 48 8d 8c 24 b0 00 00 00 80 e1 07 fe c1 38 c1 7c 97 48 8d bc 24 b0 00 00 00 e8 a7 63 33 f6 eb 88 48 8b 44 24 10 <42> 0f b6 04 28 84 c0 0f 85 d3 00 00 00 4c 8b 64 24 48 41 c6 04 24
RSP: 0018:ffffc900046ff580 EFLAGS: 00010056
RAX: ffffc900046ff710 RBX: 1ffff920008dfec6 RCX: ffffc900046ff601
RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff8880b903ea42
RBP: ffffc900046ff6b8 R08: ffff8880b903ea43 R09: 1ffff11017207d48
R10: dffffc0000000000 R11: ffffed1017207d49 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880b903ea40 R15: ffffc900046ff640
FS:  00007f73c15246c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000078842000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	4c 89 7c 24 10       	mov    %r15,0x10(%rsp)
   5:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
   c:	fc ff df
   f:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  14:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax
  19:	84 c0                	test   %al,%al
  1b:	0f 85 ca 04 00 00    	jne    0x4eb
  21:	4c 89 74 24 28       	mov    %r14,0x28(%rsp)
  26:	48 8b 04 24          	mov    (%rsp),%rax
* 2a:	c7 00 03 00 00 00    	movl   $0x3,(%rax) <-- trapping instruction
  30:	43 80 7c 3d 00 00    	cmpb   $0x0,0x0(%r13,%r15,1)
  36:	74 12                	je     0x4a
  38:	48 89 ef             	mov    %rbp,%rdi
  3b:	e8 6d 80 b9 00       	call   0xb980ad