BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 1edb8b067 P4D 1edb8b067 PUD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10548 Comm: syz-executor.3 Tainted: G W 5.4.274-syzkaller-00002-g6f97bd951d82 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010206 RAX: ffffffff8154d7aa RBX: 0000000000000100 RCX: ffff8881d29ade80 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e1a6f1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffe258 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e1a6f1c0 FS: 0000555555e14480(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001dd9af000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: call_timer_fn+0x36/0x390 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x879/0xbe0 kernel/time/timer.c:1817 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x195/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:538 [inline] smp_apic_timer_interrupt+0x11a/0x460 arch/x86/kernel/apic/apic.c:1149 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:unwind_next_frame+0xad/0x1ea0 arch/x86/kernel/unwind_orc.c:413 Code: f2 f2 00 4a 89 44 3b 09 4a 89 44 3b 11 4a 89 44 3b 19 4a 89 44 3b 21 4a 89 44 3b 29 4a 89 44 3b 31 42 c7 44 3b 39 f2 f2 f2 00 <66> 42 c7 44 3b 3d f3 f3 42 c6 44 3b 3f f3 48 89 f8 48 c1 e8 03 48 RSP: 0018:ffff8881f34c7580 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff13 RAX: 00f2f2f200f2f2f2 RBX: 1ffff1103e698ec4 RCX: 1bb51f7819ec8400 RDX: dffffc0000000000 RSI: ffff8881f34c7500 RDI: ffff8881f34c7800 RBP: ffff8881f34c7870 R08: dffffc0000000000 R09: ffff8881f34c79d0 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8881f34c7988 R13: ffff8881f34c7980 R14: ffff8881f34c7980 R15: dffffc0000000000 __unwind_start+0x708/0x890 arch/x86/kernel/unwind_orc.c:691 unwind_start arch/x86/include/asm/unwind.h:60 [inline] arch_stack_walk+0xdd/0x140 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x118/0x1c0 kernel/stacktrace.c:123 save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] kasan_set_free_info mm/kasan/common.c:345 [inline] __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487 slab_free_hook mm/slub.c:1455 [inline] slab_free_freelist_hook mm/slub.c:1494 [inline] slab_free mm/slub.c:3080 [inline] kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096 putname fs/namei.c:262 [inline] do_unlinkat+0x7e8/0x8b0 fs/namei.c:4233 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f9d442df6d7 Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc67791638 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d442df6d7 RDX: 00007ffc67791660 RSI: 00007ffc677916f0 RDI: 00007ffc677916f0 RBP: 00007ffc677916f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc677927a0 R13: 00007f9d4433c6c6 R14: 0000000000036ff2 R15: 000000000000001e Modules linked in: CR2: 0000000000000000 ---[ end trace f82231be39620fe0 ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f6e09d18 EFLAGS: 00010206 RAX: ffffffff8154d7aa RBX: 0000000000000100 RCX: ffff8881d29ade80 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e1a6f1c0 RBP: ffff8881f6e09ec8 R08: ffffffff8154d3ee R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffe258 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e1a6f1c0 FS: 0000555555e14480(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001dd9af000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: f2 f2 00 4a 89 repnz repnz add %cl,-0x77(%rdx) 5: 44 3b 09 cmp (%rcx),%r9d 8: 4a 89 44 3b 11 mov %rax,0x11(%rbx,%r15,1) d: 4a 89 44 3b 19 mov %rax,0x19(%rbx,%r15,1) 12: 4a 89 44 3b 21 mov %rax,0x21(%rbx,%r15,1) 17: 4a 89 44 3b 29 mov %rax,0x29(%rbx,%r15,1) 1c: 4a 89 44 3b 31 mov %rax,0x31(%rbx,%r15,1) 21: 42 c7 44 3b 39 f2 f2 movl $0xf2f2f2,0x39(%rbx,%r15,1) 28: f2 00 * 2a: 66 42 c7 44 3b 3d f3 movw $0xf3f3,0x3d(%rbx,%r15,1) <-- trapping instruction 31: f3 32: 42 c6 44 3b 3f f3 movb $0xf3,0x3f(%rbx,%r15,1) 38: 48 89 f8 mov %rdi,%rax 3b: 48 c1 e8 03 shr $0x3,%rax 3f: 48 rex.W