IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
PGD 22dd88067 P4D 22dd88067 PUD 22d1a8067 PMD 0 
Oops: 0000 [#1] SMP
CPU: 1 PID: 3055 Comm: syz-executor.0 Not tainted 4.19.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:__lock_acquire.isra.10+0x337/0x680 kernel/locking/lockdep.c:3294
Code: c7 c7 0f 69 58 82 e8 71 21 01 00 65 48 8b 3c 25 00 4f 01 00 e8 0b 12 00 00 e8 98 15 00 00 e8 c6 fb c5 00 45 31 e4 eb a8 89 f0 <49> 8b 44 c7 08 48 85 c0 0f 85 40 fd ff ff e9 1a fd ff ff 44 89 4d
RSP: 0018:ffffc900013a7cd0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
RBP: ffffc900013a7d00 R08: 0000000000000001 R09: 0000000000000000
R10: ffff88022b9fad80 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88022b9fad80 R15: 0000000000000018
FS:  00007f8bebb156c0(0000) GS:ffff880237b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000020 CR3: 000000022d19b000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 lock_acquire+0xc2/0x160 kernel/locking/lockdep.c:3900
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0x4a/0x70 kernel/locking/spinlock.c:152
 prepare_to_wait+0x26/0xb0 kernel/sched/wait.c:230
 nr_accept+0xa9/0x1d0 net/netrom/af_netrom.c:796
 __sys_accept4+0x100/0x210 net/socket.c:1590
 __do_sys_accept4 net/socket.c:1625 [inline]
 __se_sys_accept4 net/socket.c:1622 [inline]
 __x64_sys_accept4+0x19/0x20 net/socket.c:1622
 do_syscall_64+0x63/0x160 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f8bebfd4ae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8bebb150c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: ffffffffffffffda RBX: 00007f8bec0f4120 RCX: 00007f8bebfd4ae9
RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8bec02047a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f8bec0f4120 R15: 00007ffe05770478
Modules linked in:
CR2: 0000000000000020
---[ end trace 785aaf76be1e375b ]---
RIP: 0010:__lock_acquire.isra.10+0x337/0x680 kernel/locking/lockdep.c:3294
Code: c7 c7 0f 69 58 82 e8 71 21 01 00 65 48 8b 3c 25 00 4f 01 00 e8 0b 12 00 00 e8 98 15 00 00 e8 c6 fb c5 00 45 31 e4 eb a8 89 f0 <49> 8b 44 c7 08 48 85 c0 0f 85 40 fd ff ff e9 1a fd ff ff 44 89 4d
RSP: 0018:ffffc900013a7cd0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000018
RBP: ffffc900013a7d00 R08: 0000000000000001 R09: 0000000000000000
R10: ffff88022b9fad80 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88022b9fad80 R15: 0000000000000018
FS:  00007f8bebb156c0(0000) GS:ffff880237b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000020 CR3: 000000022d19b000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	c7 c7 0f 69 58 82    	mov    $0x8258690f,%edi
   6:	e8 71 21 01 00       	call   0x1217c
   b:	65 48 8b 3c 25 00 4f 	mov    %gs:0x14f00,%rdi
  12:	01 00
  14:	e8 0b 12 00 00       	call   0x1224
  19:	e8 98 15 00 00       	call   0x15b6
  1e:	e8 c6 fb c5 00       	call   0xc5fbe9
  23:	45 31 e4             	xor    %r12d,%r12d
  26:	eb a8                	jmp    0xffffffd0
  28:	89 f0                	mov    %esi,%eax
* 2a:	49 8b 44 c7 08       	mov    0x8(%r15,%rax,8),%rax <-- trapping instruction
  2f:	48 85 c0             	test   %rax,%rax
  32:	0f 85 40 fd ff ff    	jne    0xfffffd78
  38:	e9 1a fd ff ff       	jmp    0xfffffd57
  3d:	44                   	rex.R
  3e:	89                   	.byte 0x89
  3f:	4d                   	rex.WRB