BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000010f568067 P4D 800000010f568067 PUD 1123c6067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 2182 Comm: syz-executor.1 Not tainted 6.5.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:__lock_acquire+0x35/0x4c0 kernel/locking/lockdep.c:5016 Code: 83 ec 18 65 4c 8b 35 da a7 f2 7e 83 3d a7 5c 71 02 00 0f 84 0c 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 e4 f5 ff RSP: 0018:ffffc90002103910 EFLAGS: 00010097 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881123e0000 R15: 0000000000000018 FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000113c88000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0xd8/0x1f0 kernel/locking/lockdep.c:5761 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __pte_offset_map_lock+0xad/0x130 mm/pgtable-generic.c:329 pte_offset_map_lock include/linux/mm.h:2849 [inline] zap_pte_range mm/memory.c:1412 [inline] zap_pmd_range mm/memory.c:1575 [inline] zap_pud_range mm/memory.c:1604 [inline] zap_p4d_range mm/memory.c:1625 [inline] unmap_page_range+0x4a9/0xe20 mm/memory.c:1646 unmap_vmas+0xe2/0x150 mm/memory.c:1732 exit_mmap+0x1bb/0x4c0 mm/mmap.c:3203 __mmput+0x3d/0x110 kernel/fork.c:1348 exit_mm+0xa9/0x110 kernel/exit.c:567 do_exit+0x23a/0xa50 kernel/exit.c:861 do_group_exit+0x85/0xa0 kernel/exit.c:1024 get_signal+0x743/0x7f0 kernel/signal.c:2881 arch_do_signal_or_restart+0x89/0x2a0 arch/x86/kernel/signal.c:308 exit_to_user_mode_loop+0x61/0xc0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x64/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x2c/0x1e0 kernel/entry/common.c:297 do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6f/0xd9 RIP: 0033:0x7f433ce7dd29 Code: Unable to access opcode bytes at 0x7f433ce7dcff. RSP: 002b:00007f433dc65178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f433cfac058 RCX: 00007f433ce7dd29 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f433cfac058 RBP: 00007f433cfac050 R08: 00007f433dc656c0 R09: 00007f433dc656c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f433cfac05c R13: 000000000000006e R14: 00007f433d0cf9b0 R15: 00007f433d0cfa98 Modules linked in: CR2: 0000000000000020 ---[ end trace 0000000000000000 ]--- RIP: 0010:__lock_acquire+0x35/0x4c0 kernel/locking/lockdep.c:5016 Code: 83 ec 18 65 4c 8b 35 da a7 f2 7e 83 3d a7 5c 71 02 00 0f 84 0c 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 e4 f5 ff RSP: 0018:ffffc90002103910 EFLAGS: 00010097 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff8881123e0000 R15: 0000000000000018 FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000113c88000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 83 ec 18 sub $0x18,%esp 3: 65 4c 8b 35 da a7 f2 mov %gs:0x7ef2a7da(%rip),%r14 # 0x7ef2a7e5 a: 7e b: 83 3d a7 5c 71 02 00 cmpl $0x0,0x2715ca7(%rip) # 0x2715cb9 12: 0f 84 0c 02 00 00 je 0x224 18: 4c 89 cb mov %r9,%rbx 1b: 89 cd mov %ecx,%ebp 1d: 41 89 d5 mov %edx,%r13d 20: 49 89 ff mov %rdi,%r15 23: 83 fe 01 cmp $0x1,%esi 26: 77 0c ja 0x34 28: 89 f0 mov %esi,%eax * 2a: 49 8b 44 c7 08 mov 0x8(%r15,%rax,8),%rax <-- trapping instruction 2f: 48 85 c0 test %rax,%rax 32: 75 1b jne 0x4f 34: 4c 89 ff mov %r15,%rdi 37: 31 d2 xor %edx,%edx 39: 45 89 c4 mov %r8d,%r12d 3c: e8 .byte 0xe8 3d: e4 f5 in $0xf5,%al 3f: ff .byte 0xff