BUG: kernel NULL pointer dereference, address: 00000000000000c4
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 800000010ff22067 P4D 800000010ff22067 PUD 0 
Oops: Oops: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 2997 Comm: syz.3.47 Not tainted 6.16.0-rc4-syzkaller #0 PREEMPT(undef) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4857 [inline]
RIP: 0010:__lock_acquire+0x29e/0x2100 kernel/locking/lockdep.c:5190
Code: f1 02 73 10 48 69 c1 c8 00 00 00 48 8d 80 d0 3a c6 83 eb 16 83 3d 31 5c f5 08 00 75 0b 90 e8 89 42 56 00 48 8b 3c 24 90 31 c0 <0f> b6 98 c4 00 00 00 41 8b 46 20 25 ff 1f 00 00 48 0f a3 05 ea d1
RSP: 0018:ffffc9000174bb40 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810d6b5194 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000001626 RDI: ffff88810e6bd340
RBP: 0000000000000001 R08: 0000000000058000 R09: 0000000000008000
R10: 0000000000000000 R11: 000000000000000d R12: 0000000000000001
R13: 0000000000018000 R14: ffff88810e6bddf8 R15: 0000000000008000
FS:  00007f7f4567f6c0(0000) GS:ffff8882b4a12000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000c4 CR3: 0000000117a54000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 lock_acquire+0xe9/0x270 kernel/locking/lockdep.c:5871
 vma_start_read include/linux/mmap_lock.h:185 [inline]
 lock_next_vma+0x10d/0x600 mm/mmap_lock.c:220
 get_next_vma+0xa6/0xe0 fs/proc/task_mmu.c:182
 query_vma_find_by_addr fs/proc/task_mmu.c:516 [inline]
 query_matching_vma+0x8b/0xf0 fs/proc/task_mmu.c:545
 do_procmap_query fs/proc/task_mmu.c:630 [inline]
 procfs_procmap_ioctl+0x27d/0x6a0 fs/proc/task_mmu.c:748
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x6c/0xc0 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xa6/0x2c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7f45c0e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7f4567f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7f45e35fa0 RCX: 00007f7f45c0e929
RDX: 0000200000000180 RSI: 00000000c0686611 RDI: 0000000000000003
RBP: 00007f7f45c90b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f7f45e35fa0 R15: 00007ffeca0e83e8
 </TASK>
Modules linked in:
CR2: 00000000000000c4
---[ end trace 0000000000000000 ]---
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4857 [inline]
RIP: 0010:__lock_acquire+0x29e/0x2100 kernel/locking/lockdep.c:5190
Code: f1 02 73 10 48 69 c1 c8 00 00 00 48 8d 80 d0 3a c6 83 eb 16 83 3d 31 5c f5 08 00 75 0b 90 e8 89 42 56 00 48 8b 3c 24 90 31 c0 <0f> b6 98 c4 00 00 00 41 8b 46 20 25 ff 1f 00 00 48 0f a3 05 ea d1
RSP: 0018:ffffc9000174bb40 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88810d6b5194 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000001626 RDI: ffff88810e6bd340
RBP: 0000000000000001 R08: 0000000000058000 R09: 0000000000008000
R10: 0000000000000000 R11: 000000000000000d R12: 0000000000000001
R13: 0000000000018000 R14: ffff88810e6bddf8 R15: 0000000000008000
FS:  00007f7f4567f6c0(0000) GS:ffff8882b4a12000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000c4 CR3: 0000000117a54000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	f1                   	int1
   1:	02 73 10             	add    0x10(%rbx),%dh
   4:	48 69 c1 c8 00 00 00 	imul   $0xc8,%rcx,%rax
   b:	48 8d 80 d0 3a c6 83 	lea    -0x7c39c530(%rax),%rax
  12:	eb 16                	jmp    0x2a
  14:	83 3d 31 5c f5 08 00 	cmpl   $0x0,0x8f55c31(%rip)        # 0x8f55c4c
  1b:	75 0b                	jne    0x28
  1d:	90                   	nop
  1e:	e8 89 42 56 00       	call   0x5642ac
  23:	48 8b 3c 24          	mov    (%rsp),%rdi
  27:	90                   	nop
  28:	31 c0                	xor    %eax,%eax
* 2a:	0f b6 98 c4 00 00 00 	movzbl 0xc4(%rax),%ebx <-- trapping instruction
  31:	41 8b 46 20          	mov    0x20(%r14),%eax
  35:	25 ff 1f 00 00       	and    $0x1fff,%eax
  3a:	48                   	rex.W
  3b:	0f                   	.byte 0xf
  3c:	a3                   	.byte 0xa3
  3d:	05                   	.byte 0x5
  3e:	ea                   	(bad)
  3f:	d1                   	.byte 0xd1