BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 3192 Comm: syz-executor.0 Not tainted 6.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 RIP: 0010:__lock_acquire+0x35/0x490 kernel/locking/lockdep.c:4946 Code: 83 ec 18 65 4c 8b 35 aa 60 f4 7e 83 3d b7 11 e4 02 00 0f 84 05 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 74 f6 ff RSP: 0018:ffffc90002edb840 EFLAGS: 00010097 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000050 RBP: 0000000000000002 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff888102ea5340 R15: 0000000000000050 FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000000003aa8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0xd8/0x1f0 kernel/locking/lockdep.c:5691 seqcount_lockdep_reader_access include/linux/seqlock.h:102 [inline] get_fs_root_rcu fs/d_path.c:243 [inline] d_path+0xd1/0x1f0 fs/d_path.c:285 audit_log_d_path+0x65/0x130 kernel/audit.c:2139 dump_common_audit_data security/lsm_audit.c:224 [inline] common_lsm_audit+0x3b3/0x840 security/lsm_audit.c:458 smack_log+0xad/0x130 security/smack/smack_access.c:383 smk_tskacc+0xb1/0xd0 security/smack/smack_access.c:253 smack_inode_getattr+0x8a/0xb0 security/smack/smack_lsm.c:1187 security_inode_getattr+0x32/0x50 security/security.c:2114 vfs_getattr+0x1b/0x40 fs/stat.c:167 ovl_getattr+0xa6/0x3e0 fs/overlayfs/inode.c:173 ima_check_last_writer security/integrity/ima/ima_main.c:171 [inline] ima_file_free+0xbd/0x130 security/integrity/ima/ima_main.c:203 __fput+0xc7/0x220 fs/file_table.c:315 task_work_run+0x7d/0xa0 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x2c7/0xa80 kernel/exit.c:871 do_group_exit+0x85/0xa0 kernel/exit.c:1021 get_signal+0x73c/0x7f0 kernel/signal.c:2874 arch_do_signal_or_restart+0x89/0x290 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop+0x61/0xb0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x64/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x2b/0x1d0 kernel/entry/common.c:297 do_syscall_64+0x4d/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f2fb727cae9 Code: Unable to access opcode bytes at 0x7f2fb727cabf. RSP: 002b:00007f2fb7fea178 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f2fb739bf88 RCX: 00007f2fb727cae9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f2fb739bf88 RBP: 00007f2fb739bf80 R08: 00007f2fb7fea6c0 R09: 00007f2fb7fea6c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2fb739bf8c R13: 0000000000000006 R14: 00007ffc02103b20 R15: 00007ffc02103c08 Modules linked in: CR2: 0000000000000058 ---[ end trace 0000000000000000 ]--- RIP: 0010:__lock_acquire+0x35/0x490 kernel/locking/lockdep.c:4946 Code: 83 ec 18 65 4c 8b 35 aa 60 f4 7e 83 3d b7 11 e4 02 00 0f 84 05 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 74 f6 ff RSP: 0018:ffffc90002edb840 EFLAGS: 00010097 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000050 RBP: 0000000000000002 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffff888102ea5340 R15: 0000000000000050 FS: 0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 0000000003aa8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 83 ec 18 sub $0x18,%esp 3: 65 4c 8b 35 aa 60 f4 mov %gs:0x7ef460aa(%rip),%r14 # 0x7ef460b5 a: 7e b: 83 3d b7 11 e4 02 00 cmpl $0x0,0x2e411b7(%rip) # 0x2e411c9 12: 0f 84 05 02 00 00 je 0x21d 18: 4c 89 cb mov %r9,%rbx 1b: 89 cd mov %ecx,%ebp 1d: 41 89 d5 mov %edx,%r13d 20: 49 89 ff mov %rdi,%r15 23: 83 fe 01 cmp $0x1,%esi 26: 77 0c ja 0x34 28: 89 f0 mov %esi,%eax * 2a: 49 8b 44 c7 08 mov 0x8(%r15,%rax,8),%rax <-- trapping instruction 2f: 48 85 c0 test %rax,%rax 32: 75 1b jne 0x4f 34: 4c 89 ff mov %r15,%rdi 37: 31 d2 xor %edx,%edx 39: 45 89 c4 mov %r8d,%r12d 3c: e8 .byte 0xe8 3d: 74 f6 je 0x35 3f: ff .byte 0xff