8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000008 when read
[00000008] *pgd=85297003, *pmd=fee05003
Internal error: Oops: 205 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 PID: 3844 Comm: syz.1.49 Not tainted 6.10.0-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at path_from_stashed+0x1c/0x308 fs/libfs.c:2204
LR is at open_namespace+0x44/0xbc fs/nsfs.c:102
pc : [<80539bb4>]    lr : [<8054c358>]    psr: 80000013
sp : dfa65e80  ip : 83d66000  fp : dfa65ec4
r10: 83d66000  r9 : 00000003  r8 : 851eab40
r7 : 82caa250  r6 : 83d66000  r5 : 00000000  r4 : 843c8de8
r3 : dfa65ecc  r2 : 00000008  r1 : 82c95800  r0 : 00000008
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 30c5387d  Table: 85290b40  DAC: fffffffd
Register r0 information: non-paged memory
Register r1 information: slab kmalloc-1k start 82c95800 pointer offset 0 size 1024
Register r2 information: non-paged memory
Register r3 information: 2-page vmalloc region starting at 0xdfa64000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2777
Register r4 information: slab anon_vma_chain start 843c8de8 pointer offset 0 size 40
Register r5 information: NULL pointer
Register r6 information: slab task_struct start 83d66000 pointer offset 0 size 3072
Register r7 information: slab mnt_cache start 82caa240 pointer offset 16 size 184
Register r8 information: slab filp start 851eab40 pointer offset 0 size 160
Register r9 information: non-paged memory
Register r10 information: slab task_struct start 83d66000 pointer offset 0 size 3072
Register r11 information: 2-page vmalloc region starting at 0xdfa64000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2777
Register r12 information: slab task_struct start 83d66000 pointer offset 0 size 3072
Process syz.1.49 (pid: 3844, stack limit = 0xdfa64000)
Stack: (0xdfa65e80 to 0xdfa66000)
5e80: 80551244 83d66000 dfa65ebc dfa65e98 8027ca9c 802ac75c 00000000 843c8de8
5ea0: 00000000 83d66000 83d67480 851eab40 00000003 83d66000 dfa65ef4 dfa65ec8
5ec0: 8054c358 80539ba4 dfa65ef4 00000000 00000000 dbf77656 843c8de8 843c8de8
5ee0: 83d66c00 00000008 dfa65f14 dfa65ef8 8055137c 8054c320 0000ff08 00000000
5f00: 851eab41 00000000 dfa65fa4 dfa65f18 80519474 80551204 83d66000 00000001
5f20: ecac8b10 83d66000 dfa65f44 dfa65f38 818f6ee0 818f6db0 dfa65f5c dfa65f48
5f40: 8024b7e4 8027b09c 40000000 dfa65fb0 dfa65f84 dfa65f60 80202dc4 8024b7a0
5f60: 8261c90c dfa65fb0 0014a9d0 ecac8b10 80202cac dbf77656 dfa65fac 00000000
5f80: 00000000 002642dc 00000036 8020029c 83d66000 00000036 00000000 dfa65fa8
5fa0: 80200060 8051934c 00000000 00000000 00000003 0000ff08 00000000 00000000
5fc0: 00000000 00000000 002642dc 00000036 7ebdd766 7ebdd767 003d0f00 76b7c0bc
5fe0: 76b7bec8 76b7beb8 00018394 00130520 60000010 00000003 00000000 00000000
Call trace: 
[<80539b98>] (path_from_stashed) from [<8054c358>] (open_namespace+0x44/0xbc fs/nsfs.c:102)
 r10:83d66000 r9:00000003 r8:851eab40 r7:83d67480 r6:83d66000 r5:00000000
 r4:843c8de8
[<8054c314>] (open_namespace) from [<8055137c>] (pidfd_ioctl+0x184/0x4c4 fs/pidfs.c:196)
 r6:00000008 r5:83d66c00 r4:843c8de8
[<805511f8>] (pidfd_ioctl) from [<80519474>] (vfs_ioctl fs/ioctl.c:51 [inline])
[<805511f8>] (pidfd_ioctl) from [<80519474>] (do_vfs_ioctl fs/ioctl.c:861 [inline])
[<805511f8>] (pidfd_ioctl) from [<80519474>] (__do_sys_ioctl fs/ioctl.c:905 [inline])
[<805511f8>] (pidfd_ioctl) from [<80519474>] (sys_ioctl+0x134/0xda4 fs/ioctl.c:893)
 r7:00000000 r6:851eab41 r5:00000000 r4:0000ff08
[<80519340>] (sys_ioctl) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdfa65fa8 to 0xdfa65ff0)
5fa0:                   00000000 00000000 00000003 0000ff08 00000000 00000000
5fc0: 00000000 00000000 002642dc 00000036 7ebdd766 7ebdd767 003d0f00 76b7c0bc
5fe0: 76b7bec8 76b7beb8 00018394 00130520
 r10:00000036 r9:83d66000 r8:8020029c r7:00000036 r6:002642dc r5:00000000
 r4:00000000
Code: e24dd01c e1a07001 e5911004 ee1dcf70 (e5905000) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e24dd01c 	sub	sp, sp, #28
   4:	e1a07001 	mov	r7, r1
   8:	e5911004 	ldr	r1, [r1, #4]
   c:	ee1dcf70 	mrc	15, 0, ip, cr13, cr0, {3}
* 10:	e5905000 	ldr	r5, [r0] <-- trapping instruction