BUG: kernel NULL pointer dereference, address: 0000000000000060 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8000000172db3067 P4D 8000000172db3067 PUD 172db1067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.2.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_stream_has_data+0xb/0x20 net/vmw_vsock/af_vsock.c:864 Code: 89 d8 5b 41 5e 41 5f 5d c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 87 08 05 00 00 <4c> 8b 58 60 41 ff e3 cc 90 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 RSP: 0018:ffffc900000bbd28 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888178918200 RCX: 0000000000000001 RDX: 0000000091012168 RSI: 0000000000000001 RDI: ffff88817b0107c0 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888178918208 R13: ffff88817b0107c0 R14: ffff88817b0107c0 R15: ffffffff84072ad0 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 000000011822a000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: virtio_transport_do_close+0x1e/0x100 net/vmw_vsock/virtio_transport_common.c:908 virtio_transport_recv_pkt+0x64c/0xc50 vsock_loopback_work+0x148/0x170 net/vmw_vsock/vsock_loopback.c:122 process_one_work+0x25b/0x4d0 kernel/workqueue.c:2289 worker_thread+0x218/0x370 kernel/workqueue.c:2436 kthread+0xd8/0xf0 kernel/kthread.c:376 ret_from_fork+0x29/0x50 arch/x86/entry/entry_64.S:308 Modules linked in: CR2: 0000000000000060 ---[ end trace 0000000000000000 ]--- RIP: 0010:vsock_stream_has_data+0xb/0x20 net/vmw_vsock/af_vsock.c:864 Code: 89 d8 5b 41 5e 41 5f 5d c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 87 08 05 00 00 <4c> 8b 58 60 41 ff e3 cc 90 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 RSP: 0018:ffffc900000bbd28 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888178918200 RCX: 0000000000000001 RDX: 0000000091012168 RSI: 0000000000000001 RDI: ffff88817b0107c0 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888178918208 R13: ffff88817b0107c0 R14: ffff88817b0107c0 R15: ffffffff84072ad0 FS: 0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000060 CR3: 000000011822a000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 89 d8 mov %ebx,%eax 2: 5b pop %rbx 3: 41 5e pop %r14 5: 41 5f pop %r15 7: 5d pop %rbp 8: c3 ret 9: cc int3 a: cc int3 b: cc int3 c: cc int3 d: 66 90 xchg %ax,%ax f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: f3 0f 1e fa endbr64 23: 48 8b 87 08 05 00 00 mov 0x508(%rdi),%rax * 2a: 4c 8b 58 60 mov 0x60(%rax),%r11 <-- trapping instruction 2e: 41 ff e3 jmp *%r11 31: cc int3 32: 90 nop 33: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 3a: 00 00 00 3d: 66 90 xchg %ax,%ax 3f: 90 nop