BUG: sleeping function called from invalid context in do_page_fault

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: f8788d86 Linux 5.6-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16c2fd29e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9833e26bab355358
dashboard link: https://syzkaller.appspot.com/bug?extid=7f59c1e54e5ce4d95cf7
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7f59c1...@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1400
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 4262, name: udevd
1 lock held by udevd/4262:
#0: ffff888093e19518 (&mm->mmap_sem#2){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1383 [inline]
#0: ffff888093e19518 (&mm->mmap_sem#2){++++}, at: do_page_fault+0x34b/0x12e1 arch/x86/mm/fault.c:1517
irq event stamp: 5474812
hardirqs last enabled at (5474811): [<ffffffff81b3e158>] kmem_cache_free+0x98/0x320 mm/slab.c:3695
hardirqs last disabled at (5474812): [<ffffffff8100a81a>] syscall_return_slowpath arch/x86/entry/common.c:277 [inline]
hardirqs last disabled at (5474812): [<ffffffff8100a81a>] do_syscall_64+0x20a/0x790 arch/x86/entry/common.c:304
softirqs last enabled at (5473952): [<ffffffff882006cd>] __do_softirq+0x6cd/0x98c kernel/softirq.c:319
softirqs last disabled at (5473911): [<ffffffff8147908b>] invoke_softirq kernel/softirq.c:373 [inline]
softirqs last disabled at (5473911): [<ffffffff8147908b>] irq_exit+0x19b/0x1e0 kernel/softirq.c:413
CPU: 1 PID: 4262 Comm: udevd Not tainted 5.6.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
___might_sleep.cold+0x1fb/0x23e kernel/sched/core.c:6798
__might_sleep+0x95/0x190 kernel/sched/core.c:6751
do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
do_page_fault+0x378/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900015d7f20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888093e16640 RCX: ffffffff8100a857
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: ffffc900015d7f48 R08: ffff888093e16640 R09: ffffed10127c2cc9
R10: ffffed10127c2cc8 R11: ffff888093e16647 R12: ffffc900015d7f58
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 63623fd4 Merge tag 'for-linus' of git://git.kernel.org/pub..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1274ee2de00000

kernel config: https://syzkaller.appspot.com/x/.config?x=9833e26bab355358
dashboard link: https://syzkaller.appspot.com/bug?extid=7f59c1e54e5ce4d95cf7
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1664b01de00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7f59c1...@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1400

in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 9745, name: syz-executor.2
1 lock held by syz-executor.2/9745:
#0: ffff8880976b9898 (&mm->mmap_sem#2){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1383 [inline]
#0: ffff8880976b9898 (&mm->mmap_sem#2){++++}, at: do_page_fault+0x34b/0x12e1 arch/x86/mm/fault.c:1517
irq event stamp: 171752
hardirqs last enabled at (171751): [<ffffffff83a6991b>] __free_object+0x93b/0x10d0 lib/debugobjects.c:360
hardirqs last disabled at (171752): [<ffffffff8100a81a>] syscall_return_slowpath arch/x86/entry/common.c:277 [inline]
hardirqs last disabled at (171752): [<ffffffff8100a81a>] do_syscall_64+0x20a/0x790 arch/x86/entry/common.c:304
softirqs last enabled at (163232): [<ffffffff882006cd>] __do_softirq+0x6cd/0x98c kernel/softirq.c:319
softirqs last disabled at (163157): [<ffffffff8147a08b>] invoke_softirq kernel/softirq.c:373 [inline]
softirqs last disabled at (163157): [<ffffffff8147a08b>] irq_exit+0x19b/0x1e0 kernel/softirq.c:413
CPU: 1 PID: 9745 Comm: syz-executor.2 Not tainted 5.6.0-rc3-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
___might_sleep.cold+0x1fb/0x23e kernel/sched/core.c:6798
__might_sleep+0x95/0x190 kernel/sched/core.c:6751
do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
do_page_fault+0x378/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

RSP: 0018:ffffc9000224ff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88809b036480 RCX: ffffffff8100a857

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001

RBP: ffffc9000224ff48 R08: ffff88809b036480 R09: ffffed1013606c91
R10: ffffed1013606c90 R11: ffff88809b036487 R12: ffffc9000224ff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9745 Comm: syz-executor.2 Not tainted 5.6.0-rc3-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc9000224f4d8 EFLAGS: 00010082
RAX: ffff88809b036480 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a920
RBP: ffffc9000224f518 R08: ffff88809b036480 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a920
R13: ffffc9000224f598 R14: ffffc9000224f678 R15: ffffc9000224f578
FS: 0000000001d56940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000a06a5000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_stack+0x39/0x3b arch/x86/kernel/dumpstack.c:293

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
___might_sleep.cold+0x1fb/0x23e kernel/sched/core.c:6798
__might_sleep+0x95/0x190 kernel/sched/core.c:6751
do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
do_page_fault+0x378/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

RSP: 0018:ffffc9000224ff20 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff88809b036480 RCX: ffffffff8100a857

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001

RBP: ffffc9000224ff48 R08: ffff88809b036480 R09: ffffed1013606c91
R10: ffffed1013606c90 R11: ffff88809b036487 R12: ffffc9000224ff58
R13: 0000000000000000 R14: 0000000000004000 R15: 0000000000000000
entry_SYSCALL_64_after_hwframe+0x49/0xbe
invalid opcode: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 9745 Comm: syz-executor.2 Not tainted 5.6.0-rc3-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc9000224ea60 EFLAGS: 00010847
RAX: ffff88809b036480 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a920
RBP: ffffc9000224eaa0 R08: ffff88809b036480 R09: ffffed1015d24b6e
R10: ffffed1015d24b6d R11: ffff8880ae925b6f R12: 000000000045a920
R13: ffffc9000224eb20 R14: ffffc9000224ec00 R15: ffffc9000224eb00
FS: 0000000001d56940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000a06a5000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
printk_safe_log_store+0x106/0x270 kernel/printk/printk_safe.c:93
vprintk_safe kernel/printk/printk_safe.c:346 [inline]
vprintk_func+0x131/0x189 kernel/printk/printk_safe.c:383
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_regs arch/x86/kernel/dumpstack.c:447 [inline]
show_regs.cold+0x1a/0x1f arch/x86/kernel/dumpstack.c:437
__die_body+0x1b/0x60 arch/x86/kernel/dumpstack.c:392
__die+0x26/0x37 arch/x86/kernel/dumpstack.c:406
die+0x2b/0x50 arch/x86/kernel/dumpstack.c:419
do_trap_no_signal arch/x86/kernel/traps.c:207 [inline]
do_trap+0x101/0x230 arch/x86/kernel/traps.c:246
do_error_trap+0xd6/0x200 arch/x86/kernel/traps.c:273
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:in_gate_area_no_mm+0x3a/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:344
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <60> ff 48 89 de e8 7c b7 74 00 48 81 fb 00 00 60 ff 74 10 e8 ce b5
RSP: 0018:ffffc9000224f4d8 EFLAGS: 00010082
RAX: ffff88809b036480 RBX: 0000000000000000 RCX: ffffffff816c3c90
RDX: 0000000000000000 RSI: ffffffff816c3cbb RDI: 000000000045a920
RBP: ffffc9000224f518 R08: ffff88809b036480 R09: fffffbfff1708c62
R10: fffffbfff1708c61 R11: ffffffff8b846309 R12: 000000000045a920
R13: ffffc9000224f598 R14: ffffc9000224f678 R15: ffffc9000224f578
__sprint_symbol+0xb7/0x1e0 kernel/kallsyms.c:365
sprint_symbol+0x25/0x30 kernel/kallsyms.c:396
symbol_string+0x16f/0x230 lib/vsprintf.c:961
pointer+0x17b/0x740 lib/vsprintf.c:2188
vsnprintf+0x6b6/0x19a0 lib/vsprintf.c:2578
vscnprintf+0x2d/0x80 lib/vsprintf.c:2677
vprintk_store+0x44/0x4a0 kernel/printk/printk.c:1917
vprintk_emit+0x135/0x700 kernel/printk/printk.c:1978
vprintk_default+0x28/0x30 kernel/printk/printk.c:2023
vprintk_func+0x7e/0x189 kernel/printk/printk_safe.c:386
printk+0xba/0xed kernel/printk/printk.c:2056
show_ip+0x27/0x38 arch/x86/kernel/dumpstack.c:124
show_iret_regs+0x14/0x38 arch/x86/kernel/dumpstack.c:131
__show_regs+0x1c/0x60 arch/x86/kernel/process_64.c:74
show_regs_if_on_stack.constprop.0+0x39/0x3c arch/x86/kernel/dumpstack.c:149
show_trace_log_lvl+0x25d/0x28c arch/x86/kernel/dumpstack.c:274
show_stack+0x39/0x3b arch/x86/kernel/dumpstack.c:293

__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
___might_sleep.cold+0x1fb/0x23e kernel/sched/core.c:6798
__might_sleep+0x95/0x190 kernel/sched/core.c:6751
do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
do_page_fault+0x378/0x12e1 arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:189 [inline]
RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
RIP: 0010:do_syscall_64+0x2c9/0x790 arch/x86/entry/common.c:304
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Lost 37 message(s)!

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 30bb5572 Merge tag 'ktest-v5.6' of git://git.kernel.org/pu..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12000075e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2e311dba9a02ba9

dashboard link: https://syzkaller.appspot.com/bug?extid=7f59c1e54e5ce4d95cf7
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16657709e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=107c39c3e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7f59c1...@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1400

in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 9434, name: syz-executor278
1 lock held by syz-executor278/9434:
#0: ffff88808d27c2d8 (&mm->mmap_sem#2){++++}, at: do_user_addr_fault arch/x86/mm/fault.c:1383 [inline]
#0: ffff88808d27c2d8 (&mm->mmap_sem#2){++++}, at: do_page_fault+0x34c/0x12da arch/x86/mm/fault.c:1517
irq event stamp: 17432
hardirqs last enabled at (17431): [<ffffffff83926883>] __free_object+0x8b3/0xee0 lib/debugobjects.c:360
hardirqs last disabled at (17432): [<ffffffff8100b376>] syscall_return_slowpath arch/x86/entry/common.c:277 [inline]
hardirqs last disabled at (17432): [<ffffffff8100b376>] do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
hardirqs last disabled at (17432): [<ffffffff8100b376>] do_fast_syscall_32+0x386/0xe8f arch/x86/entry/common.c:408
softirqs last enabled at (14944): [<ffffffff8129cd63>] memcpy include/linux/string.h:381 [inline]
softirqs last enabled at (14944): [<ffffffff8129cd63>] fpu__copy+0x173/0x8b0 arch/x86/kernel/fpu/core.c:195
softirqs last disabled at (14942): [<ffffffff8129cc91>] fpu__copy+0xa1/0x8b0 arch/x86/kernel/fpu/core.c:183
CPU: 1 PID: 9434 Comm: syz-executor278 Not tainted 5.6.0-rc5-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x188/0x20d lib/dump_stack.c:118
___might_sleep.cold+0x1f4/0x23d kernel/sched/core.c:6798
do_user_addr_fault arch/x86/mm/fault.c:1400 [inline]
do_page_fault+0x379/0x12da arch/x86/mm/fault.c:1517
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]

RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]

RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 97284067 P4D 97284067 PUD 91391067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9434 Comm: syz-executor278 Tainted: G W 5.6.0-rc5-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]

RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]

RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000092e5840
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096341000 CR4: 00000000001406e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
Modules linked in:
CR2: 0000000000000000
---[ end trace 8c5506cbd0e3ecc5 ]---
RIP: 0010:prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]

RIP: 0010:syscall_return_slowpath arch/x86/entry/common.c:278 [inline]

RIP: 0010:do_syscall_32_irqs_on arch/x86/entry/common.c:352 [inline]
RIP: 0010:do_fast_syscall_32+0x4d1/0xe8f arch/x86/entry/common.c:408
Code: ff df 48 c1 ea 03 80 3c 02 00 0f 85 f6 08 00 00 4c 8b 3b 31 ff 45 89 fd 41 81 e5 0e 38 00 00 44 89 ee e8 22 60 71 00 45 85 00 <00> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RSP: 0018:ffffc900020d7f18 EFLAGS: 00010006
RAX: 0000000000000000 RBX: ffff88808e8fc380 RCX: ffffffff8100b4be
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc900020d7f58 R08: ffff88808e8fc380 R09: ffffed1011d1f871
R10: ffffed1011d1f870 R11: ffff88808e8fc387 R12: 00000000f7f3ce39
R13: 0000000000000000 R14: ffffc900020d7fd8 R15: 0000000020024000
FS: 0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000092e5840
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000096341000 CR4: 00000000001406e0