Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
Mem abort info:
  ESR = 0x0000000096000045
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000045, ISS2 = 0x00000000
  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
user pgtable: 4k pages, 52-bit VAs, pgdp=0000000043998180
[0000000000000088] pgd=0800000046771003, p4d=080000004cbff003, pud=0000000000000000
Internal error: Oops: 0000000096000045 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3207 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller-00021-ge0cce98fe279 #0
Hardware name: linux,dummy-virt (DT)
pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:990 [inline]
pc : detach_timer kernel/time/timer.c:934 [inline]
pc : expire_timers kernel/time/timer.c:1826 [inline]
pc : __run_timers+0x1ec/0x254 kernel/time/timer.c:2417
lr : __run_timers+0x198/0x254 kernel/time/timer.c:2414
sp : ffff800080003e50
x29: ffff800080003e50 x28: ffff800080003ed8 x27: ffff8000825d79c0
x26: fff000007f8cd6e8 x25: fff000007f8cd6a8 x24: ffff800080003ec8
x23: 0000000000000002 x22: dead000000000122 x21: ffff8000825b2d48
x20: fff000007f8cd680 x19: fcf000000d93abd8 x18: 0000000000000001
x17: fff07ffffd319000 x16: ffff800080000000 x15: 00004c4b40000000
x14: 000000000000021f x13: 000000000000021f x12: 0000000000000001
x11: 0000000000000009 x10: 0000000000000004 x9 : 0000000000000b56
x8 : 0000000000000001 x7 : ffff800080003ee0 x6 : 00000000000000bf
x5 : 000000000028a24d x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000100002fc1 x1 : ffff800080003ed8 x0 : 0000000000000080
Call trace:
 __hlist_del include/linux/list.h:989 [inline]
 detach_timer kernel/time/timer.c:934 [inline]
 expire_timers kernel/time/timer.c:1826 [inline]
 __run_timers+0x1ec/0x254 kernel/time/timer.c:2417
 __run_timer_base kernel/time/timer.c:2428 [inline]
 __run_timer_base kernel/time/timer.c:2421 [inline]
 run_timer_base kernel/time/timer.c:2437 [inline]
 run_timer_softirq+0x8c/0xfc kernel/time/timer.c:2447
 handle_softirqs+0x10c/0x240 kernel/softirq.c:554
 __do_softirq+0x14/0x20 kernel/softirq.c:588
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:81
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:86
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbc/0xd8 kernel/softirq.c:649
 __el1_irq arch/arm64/kernel/entry-common.c:537 [inline]
 el1_interrupt+0x38/0x64 arch/arm64/kernel/entry-common.c:551
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __list_del_entry_valid include/linux/list.h:124 [inline]
 __list_del_entry include/linux/list.h:215 [inline]
 list_del include/linux/list.h:229 [inline]
 __rmqueue_pcplist+0xa8/0xbcc mm/page_alloc.c:2921
 rmqueue_pcplist mm/page_alloc.c:2953 [inline]
 rmqueue mm/page_alloc.c:2990 [inline]
 get_page_from_freelist+0x710/0x1560 mm/page_alloc.c:3399
 __alloc_pages_noprof+0x170/0xd58 mm/page_alloc.c:4660
 alloc_pages_bulk_noprof+0x370/0x608 mm/page_alloc.c:4608
 alloc_pages_bulk_array_mempolicy_noprof+0xbc/0x544 mm/mempolicy.c:2547
 vm_area_alloc_pages mm/vmalloc.c:3532 [inline]
 __vmalloc_area_node mm/vmalloc.c:3642 [inline]
 __vmalloc_node_range_noprof+0x254/0x848 mm/vmalloc.c:3823
 __vmalloc_node_noprof mm/vmalloc.c:3888 [inline]
 vzalloc_noprof+0x94/0xa4 mm/vmalloc.c:3961
 alloc_counters.isra.0+0x20/0x13c net/ipv4/netfilter/arp_tables.c:660
 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:837 [inline]
 get_entries net/ipv6/netfilter/ip6_tables.c:1039 [inline]
 do_ip6t_get_ctl+0x27c/0x49c net/ipv6/netfilter/ip6_tables.c:1677
 nf_getsockopt+0x60/0x8c net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x134/0x204 net/ipv6/ipv6_sockglue.c:1494
 tcp_getsockopt+0x20/0x48 net/ipv4/tcp.c:4399
 sock_common_getsockopt+0x1c/0x28 net/core/sock.c:3699
 do_sock_getsockopt+0x13c/0x288 net/socket.c:2374
 __sys_getsockopt+0x78/0xd0 net/socket.c:2403
 __do_sys_getsockopt net/socket.c:2413 [inline]
 __se_sys_getsockopt net/socket.c:2410 [inline]
 __arm64_sys_getsockopt+0x24/0x34 net/socket.c:2410
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x48/0x118 arch/arm64/kernel/syscall.c:48
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:133
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:152
 el0_svc+0x34/0xf8 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
Code: f9000693 a9400660 f9000020 b4000040 (f9000401) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f9000693 	str	x19, [x20, #8]
   4:	a9400660 	ldp	x0, x1, [x19]
   8:	f9000020 	str	x0, [x1]
   c:	b4000040 	cbz	x0, 0x14
* 10:	f9000401 	str	x1, [x0, #8] <-- trapping instruction