BUG: kernel NULL pointer dereference, address: 00000000000000f0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 103b99067 P4D 103b99067 PUD 105bc9067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 1868 Comm: syz-executor.0 Not tainted 6.6.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:__lock_acquire+0x35/0x490 kernel/locking/lockdep.c:5008
Code: 83 ec 18 65 4c 8b 35 ba cf f4 7e 83 3d 0f 85 5e 01 00 0f 84 05 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 74 f6 ff
RSP: 0018:ffffc90001a07c10 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000e8
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88810c249b00 R15: 00000000000000e8
FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000f0 CR3: 0000000106e84000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 lock_acquire+0xd8/0x1f0 kernel/locking/lockdep.c:5753
 down_write+0x29/0x80 kernel/locking/rwsem.c:1573
 __unmap_hugepage_range_final+0x5a/0x1c0 mm/hugetlb.c:5445
 unmap_vmas+0x6b/0xa0 mm/memory.c:1731
 exit_mmap+0x1b4/0x500 mm/mmap.c:3230
 __mmput+0x28/0xf0 kernel/fork.c:1349
 exit_mm+0xa9/0x110 kernel/exit.c:567
 do_exit+0x242/0xa50 kernel/exit.c:861
 __do_sys_exit kernel/exit.c:991 [inline]
 __se_sys_exit kernel/exit.c:989 [inline]
 __x64_sys_exit+0x12/0x20 kernel/exit.c:989
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f327928cae9
Code: Unable to access opcode bytes at 0x7f327928cabf.
RSP: 002b:00007f3278e0ef98 EFLAGS: 00000246 ORIG_RAX: 000000000000003c
RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f327928cae9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f32792d847a R08: 0000000000000058 R09: 0000000000000058
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000006 R14: 00007f32793abf80 R15: 00007ffee81e63a8
 </TASK>
Modules linked in:
CR2: 00000000000000f0
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0x35/0x490 kernel/locking/lockdep.c:5008
Code: 83 ec 18 65 4c 8b 35 ba cf f4 7e 83 3d 0f 85 5e 01 00 0f 84 05 02 00 00 4c 89 cb 89 cd 41 89 d5 49 89 ff 83 fe 01 77 0c 89 f0 <49> 8b 44 c7 08 48 85 c0 75 1b 4c 89 ff 31 d2 45 89 c4 e8 74 f6 ff
RSP: 0018:ffffc90001a07c10 EFLAGS: 00010097

RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000e8
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88810c249b00 R15: 00000000000000e8
FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000f0 CR3: 0000000106e84000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	83 ec 18             	sub    $0x18,%esp
   3:	65 4c 8b 35 ba cf f4 	mov    %gs:0x7ef4cfba(%rip),%r14        # 0x7ef4cfc5
   a:	7e
   b:	83 3d 0f 85 5e 01 00 	cmpl   $0x0,0x15e850f(%rip)        # 0x15e8521
  12:	0f 84 05 02 00 00    	je     0x21d
  18:	4c 89 cb             	mov    %r9,%rbx
  1b:	89 cd                	mov    %ecx,%ebp
  1d:	41 89 d5             	mov    %edx,%r13d
  20:	49 89 ff             	mov    %rdi,%r15
  23:	83 fe 01             	cmp    $0x1,%esi
  26:	77 0c                	ja     0x34
  28:	89 f0                	mov    %esi,%eax
* 2a:	49 8b 44 c7 08       	mov    0x8(%r15,%rax,8),%rax <-- trapping instruction
  2f:	48 85 c0             	test   %rax,%rax
  32:	75 1b                	jne    0x4f
  34:	4c 89 ff             	mov    %r15,%rdi
  37:	31 d2                	xor    %edx,%edx
  39:	45 89 c4             	mov    %r8d,%r12d
  3c:	e8                   	.byte 0xe8
  3d:	74 f6                	je     0x35
  3f:	ff                   	.byte 0xff