BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1e6aaf067 P4D 1e6aaf067 PUD 0 
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3682 Comm: syz.6.898 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010202
RAX: ffffffff8150a590 RBX: 0000000000000101 RCX: ffff8881deba0fc0
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881d8cff1c0
RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffb570
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d8cff1c0
FS:  00007f6a218126c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ddd16000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000f060a
Call Trace:
 <IRQ>
 call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448
 expire_timers kernel/time/timer.c:1493 [inline]
 __run_timers+0x81d/0xb60 kernel/time/timer.c:1817
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830
 __do_softirq+0x236/0x660 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x197/0x1c0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:539 [inline]
 smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
 </IRQ>
RIP: 0010:check_memory_region+0x1a8/0x280 mm/kasan/generic.c:191
Code: 56 07 4d 85 f6 4d 0f 49 d6 49 83 e2 f8 4d 29 d6 74 12 41 80 39 00 0f 85 a1 00 00 00 49 ff c1 49 ff ce 75 ee 5b 41 5e 41 5f 5d <c3> 84 db 75 61 f7 c3 00 ff 00 00 75 5e f7 c3 00 00 ff 00 75 5d 49
RSP: 0018:ffff8881d49a7608 EFLAGS: 00000256 ORIG_RAX: ffffffffffffff13
RAX: ffff8881f6f00001 RBX: ffff8881ebdaaf40 RCX: ffffffff8147f11d
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8619adc0
RBP: ffff8881d49a7610 R08: dffffc0000000000 R09: fffffbfff0c335b9
R10: fffffbfff0c335b9 R11: 1ffffffff0c335b8 R12: ffffffff8619add0
R13: ffffffff8619adc0 R14: ffffffff8619add0 R15: dffffc0000000000
 atomic64_read include/asm-generic/atomic-instrumented.h:836 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:28 [inline]
 __mutex_owner kernel/locking/mutex.c:77 [inline]
 mutex_spin_on_owner+0x23d/0x2e0 kernel/locking/mutex.c:568
 mutex_optimistic_spin kernel/locking/mutex.c:685 [inline]
 __mutex_lock_common kernel/locking/mutex.c:1063 [inline]
 __mutex_lock+0x661/0xe30 kernel/locking/mutex.c:1114
 __mutex_lock_killable_slowpath+0xe/0x10 kernel/locking/mutex.c:1381
 mutex_lock_killable+0xd3/0xe0 kernel/locking/mutex.c:1348
 rtnl_lock_killable+0x15/0x20 net/core/rtnetlink.c:78
 register_netdev+0x14/0x50 net/core/dev.c:9336
 vti6_init_net+0x2ae/0x360 net/ipv6/ip6_vti.c:1150
 ops_init+0x1ba/0x4a0 net/core/net_namespace.c:141
 setup_net+0x20c/0x9b0 net/core/net_namespace.c:348
 copy_net_ns+0x314/0x520 net/core/net_namespace.c:489
 create_new_namespaces+0x49c/0x590 kernel/nsproxy.c:103
 copy_namespaces+0x17e/0x1c0 kernel/nsproxy.c:161
 copy_process+0x1194/0x2cf0 kernel/fork.c:2055
 _do_fork+0x190/0x860 kernel/fork.c:2399
 __do_sys_clone kernel/fork.c:2557 [inline]
 __se_sys_clone kernel/fork.c:2538 [inline]
 __x64_sys_clone+0x12e/0x160 kernel/fork.c:2538
 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f6a231a9969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6a21811fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f6a233d0fa0 RCX: 00007f6a231a9969
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000061980200
RBP: 00007f6a2322bab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6a233d0fa0 R15: 00007ffe4f960f48
Modules linked in:
CR2: 0000000000000000
---[ end trace 12006d1c87611b82 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010202
RAX: ffffffff8150a590 RBX: 0000000000000101 RCX: ffff8881deba0fc0
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffff8881d8cff1c0
RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffb570
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d8cff1c0
FS:  00007f6a218126c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ddd16000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000f060a
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	4d 85 f6             	test   %r14,%r14
   3:	4d 0f 49 d6          	cmovns %r14,%r10
   7:	49 83 e2 f8          	and    $0xfffffffffffffff8,%r10
   b:	4d 29 d6             	sub    %r10,%r14
   e:	74 12                	je     0x22
  10:	41 80 39 00          	cmpb   $0x0,(%r9)
  14:	0f 85 a1 00 00 00    	jne    0xbb
  1a:	49 ff c1             	inc    %r9
  1d:	49 ff ce             	dec    %r14
  20:	75 ee                	jne    0x10
  22:	5b                   	pop    %rbx
  23:	41 5e                	pop    %r14
  25:	41 5f                	pop    %r15
  27:	5d                   	pop    %rbp
* 28:	c3                   	ret <-- trapping instruction
  29:	84 db                	test   %bl,%bl
  2b:	75 61                	jne    0x8e
  2d:	f7 c3 00 ff 00 00    	test   $0xff00,%ebx
  33:	75 5e                	jne    0x93
  35:	f7 c3 00 00 ff 00    	test   $0xff0000,%ebx
  3b:	75 5d                	jne    0x9a
  3d:	49                   	rex.WB