8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000008 when read
[00000008] *pgd=84f98003, *pmd=fe430003
Internal error: Oops: 205 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 9113 Comm: syz.1.1466 Not tainted 6.10.0-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at path_from_stashed+0x1c/0x308 fs/libfs.c:2204
LR is at open_namespace+0x44/0xbc fs/nsfs.c:102
pc : [<8053a974>]    lr : [<8054d110>]    psr: 80000013
sp : df98de80  ip : 83e5b000  fp : df98dec4
r10: 83e5b000  r9 : 00000004  r8 : 8546e600
r7 : 82cab250  r6 : 83e5b000  r5 : 00000000  r4 : 843b7a50
r3 : df98decc  r2 : 00000008  r1 : 82c99800  r0 : 00000008
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 850f75c0  DAC: fffffffd
Register r0 information: non-paged memory
Register r1 information: slab kmalloc-1k start 82c99800 pointer offset 0 size 1024
Register r2 information: non-paged memory
Register r3 information: 2-page vmalloc region starting at 0xdf98c000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2781
Register r4 information: slab anon_vma_chain start 843b7a50 pointer offset 0 size 40
Register r5 information: NULL pointer
Register r6 information: slab task_struct start 83e5b000 pointer offset 0 size 3072
Register r7 information: slab mnt_cache start 82cab240 pointer offset 16 size 184
Register r8 information: slab filp start 8546e600 pointer offset 0 size 160
Register r9 information: non-paged memory
Register r10 information: slab task_struct start 83e5b000 pointer offset 0 size 3072
Register r11 information: 2-page vmalloc region starting at 0xdf98c000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2781
Register r12 information: slab task_struct start 83e5b000 pointer offset 0 size 3072
Process syz.1.1466 (pid: 9113, stack limit = 0xdf98c000)
Stack: (0xdf98de80 to 0xdf98e000)
de80: 80552000 83e5b000 df98debc df98de98 8027c9dc 802ac4a4 00000000 843b7a50
dea0: 00000000 83e5b000 83e43880 8546e600 00000004 83e5b000 df98def4 df98dec8
dec0: 8054d110 8053a964 df98def4 00000000 00000000 e82ea859 843b7a50 843b7a50
dee0: 83e43000 00000008 df98df14 df98def8 80552138 8054d0d8 0000ff08 00000000
df00: 8546e601 00000000 df98dfa4 df98df18 8051a210 80551fc0 83e5b000 00000001
df20: ecac8b10 83e5b000 df98df44 df98df38 8190dda0 8190dc70 df98df5c df98df48
df40: 8024b594 8027af5c 40000000 df98dfb0 df98df84 df98df60 80202dd8 8024b550
df60: 8261c90c df98dfb0 0014ab60 ecac8b10 80202cc0 e82ea859 df98dfac 00000000
df80: 00000000 002662dc 00000036 8020029c 83e5b000 00000036 00000000 df98dfa8
dfa0: 80200060 8051a0e8 00000000 00000000 00000004 0000ff08 00000000 00000000
dfc0: 00000000 00000000 002662dc 00000036 7eb58766 7eb58767 003d0f00 76bf30bc
dfe0: 76bf2ec8 76bf2eb8 00018444 001306b0 60000010 00000004 00000000 00000000
Call trace: 
[<8053a958>] (path_from_stashed) from [<8054d110>] (open_namespace+0x44/0xbc fs/nsfs.c:102)
 r10:83e5b000 r9:00000004 r8:8546e600 r7:83e43880 r6:83e5b000 r5:00000000
 r4:843b7a50
[<8054d0cc>] (open_namespace) from [<80552138>] (pidfd_ioctl+0x184/0x4c4 fs/pidfs.c:196)
 r6:00000008 r5:83e43000 r4:843b7a50
[<80551fb4>] (pidfd_ioctl) from [<8051a210>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<80551fb4>] (pidfd_ioctl) from [<8051a210>] (do_vfs_ioctl fs/ioctl.c:861 [inline])
[<80551fb4>] (pidfd_ioctl) from [<8051a210>] (__do_sys_ioctl fs/ioctl.c:905 [inline])
[<80551fb4>] (pidfd_ioctl) from [<8051a210>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893)
 r7:00000000 r6:8546e601 r5:00000000 r4:0000ff08
[<8051a0dc>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdf98dfa8 to 0xdf98dff0)
dfa0:                   00000000 00000000 00000004 0000ff08 00000000 00000000
dfc0: 00000000 00000000 002662dc 00000036 7eb58766 7eb58767 003d0f00 76bf30bc
dfe0: 76bf2ec8 76bf2eb8 00018444 001306b0
 r10:00000036 r9:83e5b000 r8:8020029c r7:00000036 r6:002662dc r5:00000000
 r4:00000000
Code: e24dd01c e1a07001 e5911004 ee1dcf70 (e5905000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e24dd01c 	sub	sp, sp, #28
   4:	e1a07001 	mov	r7, r1
   8:	e5911004 	ldr	r1, [r1, #4]
   c:	ee1dcf70 	mrc	15, 0, ip, cr13, cr0, {3}
* 10:	e5905000 	ldr	r5, [r0] <-- trapping instruction