BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
PGD 1b38de067 P4D 1b38de067 PUD 1d372a067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 31453 Comm: syz-executor3 Not tainted 4.20.0-rc2+ #241
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:slab_equal_or_root mm/slab.h:228 [inline]
RIP: 0010:cache_from_obj mm/slab.h:374 [inline]
RIP: 0010:kmem_cache_free+0x120/0x290 mm/slab.c:3752
Code: ea ff ff 48 c1 e8 0c 48 c1 e0 06 48 01 d0 48 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 40 18 48 39 c3 0f 84 00 ff ff ff <48> 3b 98 80 00 00 00 0f 84 11 01 00 00 48 8b 48 58 48 c7 c6 e0 17
RSP: 0018:ffff88812b76ef38 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881da970480 RCX: dead0000000000ff
RDX: 0000000000000000 RSI: ffffffff8139cd66 RDI: 0000000000000007
RBP: ffff88812b76ef58 R08: ffff888181b84400 R09: 0000000000000008
R10: 0000000000005d11 R11: ffff888181b84400 R12: ffff8881b44f07a0
R13: 1ffff110256ede02 R14: ffff8881b67cacc0 R15: ffff8881b44f07b8
FS:  0000000000000000(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000001c5116000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 anon_vma_chain_free mm/rmap.c:134 [inline]
 unlink_anon_vmas+0x3b2/0xa60 mm/rmap.c:401
 free_pgtables+0x271/0x380 mm/memory.c:393
 exit_mmap+0x2cd/0x590 mm/mmap.c:3146
 __mmput kernel/fork.c:1045 [inline]
 mmput+0x247/0x610 kernel/fork.c:1066
 exit_mm kernel/exit.c:545 [inline]
 do_exit+0xe74/0x26d0 kernel/exit.c:854
 do_group_exit+0x177/0x440 kernel/exit.c:970
 get_signal+0x8b0/0x1980 kernel/signal.c:2517
 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline]
 do_fast_syscall_32+0xcd5/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7f6ea29
Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5f6a12c EFLAGS: 00000292 ORIG_RAX: 00000000000000f0
RAX: fffffffffffffe00 RBX: 000000000814af68 RCX: 0000000000000080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000814af6c
RBP: 00000000f5f6a228 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000080
---[ end trace fb9a30d7cdc68463 ]---
RIP: 0010:slab_equal_or_root mm/slab.h:228 [inline]
RIP: 0010:cache_from_obj mm/slab.h:374 [inline]
RIP: 0010:kmem_cache_free+0x120/0x290 mm/slab.c:3752
Code: ea ff ff 48 c1 e8 0c 48 c1 e0 06 48 01 d0 48 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 40 18 48 39 c3 0f 84 00 ff ff ff <48> 3b 98 80 00 00 00 0f 84 11 01 00 00 48 8b 48 58 48 c7 c6 e0 17
RSP: 0018:ffff88812b76ef38 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881da970480 RCX: dead0000000000ff
RDX: 0000000000000000 RSI: ffffffff8139cd66 RDI: 0000000000000007
RBP: ffff88812b76ef58 R08: ffff888181b84400 R09: 0000000000000008
R10: 0000000000005d11 R11: ffff888181b84400 R12: ffff8881b44f07a0
R13: 1ffff110256ede02 R14: ffff8881b67cacc0 R15: ffff8881b44f07b8
FS:  0000000000000000(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000001c5116000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400