BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 10fa01067 P4D 10fa01067 PUD 10fa07067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 4075 Comm: syz-executor.0 Not tainted 5.18.0-rc3-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:sctp_sched_prio_free+0x105/0x250 net/sctp/stream_sched_prio.c:221 Code: f7 e5 48 89 d8 48 c1 ea 07 48 89 d1 48 69 d2 aa 00 00 00 48 c1 e1 0c 48 29 d0 48 8d 04 40 4c 8d 2c c1 4c 89 ee e8 1b a5 39 fe <48> 83 78 08 00 74 2f e8 ef 22 3c fd 4c 89 ee 4c 89 e7 e8 04 a5 39 RSP: 0018:ffffc90003d7f9e8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88810ef68cc0 RSI: ffffffff8233be70 RDI: 0000000000000003 RBP: c0c0c0c0c0c0c0c1 R08: 0000000000000000 R09: 0000000000000004 R10: ffffffff8233be0e R11: 0000000000000000 R12: ffff88810fa94560 R13: 0000000000000000 R14: ffffc90003d7f9f0 R15: ffffc90003d7fbc0 FS: 00005555567d4400(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010eca7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sctp_stream_free+0x28/0xb0 net/sctp/stream.c:190 sctp_association_free+0xda/0x2a0 net/sctp/associola.c:353 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:940 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1324 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1195 [inline] sctp_do_sm+0x1cc9/0x2290 net/sctp/sm_sideeffect.c:1166 sctp_assoc_bh_rcv+0x1e3/0x300 net/sctp/associola.c:1054 sctp_inq_push+0x93/0xc0 net/sctp/inqueue.c:80 sctp_backlog_rcv+0xa2/0x4f0 net/sctp/input.c:344 sk_backlog_rcv include/net/sock.h:1051 [inline] __release_sock+0xbe/0x140 net/core/sock.c:2794 release_sock+0x32/0xd0 net/core/sock.c:3327 sctp_close+0x212/0x490 net/sctp/socket.c:1533 inet_release+0x7c/0xe0 net/ipv4/af_inet.c:428 inet6_release+0x31/0x50 net/ipv6/af_inet6.c:481 __sock_release+0x47/0xd0 net/socket.c:650 sock_close+0x15/0x20 net/socket.c:1318 __fput+0x105/0x430 fs/file_table.c:317 task_work_run+0x73/0xb0 kernel/task_work.c:164 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x154/0x160 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f1f0683bd2b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007fff35b83480 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f1f0683bd2b RDX: 00007f1f069a07f0 RSI: ffffffffffffffff RDI: 0000000000000003 RBP: 00007f1f0699d960 R08: 0000000000000000 R09: 00007f1f069a07f8 R10: 00007fff35b83580 R11: 0000000000000293 R12: 0000000000010774 R13: 00007fff35b83580 R14: 00007f1f0699bf60 R15: 0000000000000032 Modules linked in: CR2: 0000000000000008 ---[ end trace 0000000000000000 ]--- RIP: 0010:sctp_sched_prio_free+0x105/0x250 net/sctp/stream_sched_prio.c:221 Code: f7 e5 48 89 d8 48 c1 ea 07 48 89 d1 48 69 d2 aa 00 00 00 48 c1 e1 0c 48 29 d0 48 8d 04 40 4c 8d 2c c1 4c 89 ee e8 1b a5 39 fe <48> 83 78 08 00 74 2f e8 ef 22 3c fd 4c 89 ee 4c 89 e7 e8 04 a5 39 RSP: 0018:ffffc90003d7f9e8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88810ef68cc0 RSI: ffffffff8233be70 RDI: 0000000000000003 RBP: c0c0c0c0c0c0c0c1 R08: 0000000000000000 R09: 0000000000000004 R10: ffffffff8233be0e R11: 0000000000000000 R12: ffff88810fa94560 R13: 0000000000000000 R14: ffffc90003d7f9f0 R15: ffffc90003d7fbc0 FS: 00005555567d4400(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010eca7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: f7 e5 mul %ebp 2: 48 89 d8 mov %rbx,%rax 5: 48 c1 ea 07 shr $0x7,%rdx 9: 48 89 d1 mov %rdx,%rcx c: 48 69 d2 aa 00 00 00 imul $0xaa,%rdx,%rdx 13: 48 c1 e1 0c shl $0xc,%rcx 17: 48 29 d0 sub %rdx,%rax 1a: 48 8d 04 40 lea (%rax,%rax,2),%rax 1e: 4c 8d 2c c1 lea (%rcx,%rax,8),%r13 22: 4c 89 ee mov %r13,%rsi 25: e8 1b a5 39 fe callq 0xfe39a545 * 2a: 48 83 78 08 00 cmpq $0x0,0x8(%rax) <-- trapping instruction 2f: 74 2f je 0x60 31: e8 ef 22 3c fd callq 0xfd3c2325 36: 4c 89 ee mov %r13,%rsi 39: 4c 89 e7 mov %r12,%rdi 3c: e8 .byte 0xe8 3d: 04 a5 add $0xa5,%al 3f: 39 .byte 0x39