==================================================================
BUG: KASAN: null-ptr-deref in ida_free+0x18f/0x2b0
Read of size 8 at addr 0000000000000000 by task syz-executor.7/11751

CPU: 0 PID: 11751 Comm: syz-executor.7 Not tainted 5.19.0-rc3-next-20220623 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 kasan_report+0xbe/0x1c0
 kasan_check_range+0xf9/0x1e0
 ida_free+0x18f/0x2b0
 dev_free+0xec/0x660
 raw_release+0x219/0x290
 __fput+0x272/0x9d0
 task_work_run+0xe2/0x1a0
 exit_to_user_mode_prepare+0x199/0x1a0
 syscall_exit_to_user_mode+0x19/0x40
 do_syscall_64+0x48/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fc3c19fe72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc78c53a70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fc3c19fe72b
RDX: ffffffffffffffbc RSI: ffffffff8132c60a RDI: 0000000000000004
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2dd2001c
R10: 000000000000006e R11: 0000000000000293 R12: 000000000010992f
R13: 00000000000003e8 R14: 00007fc3c1b5ef60 R15: 000000000010992e
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 41f28067 P4D 41f28067 PUD 44a5b067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 11751 Comm: syz-executor.7 Tainted: G    B             5.19.0-rc3-next-20220623 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:ida_free+0x18f/0x2b0
Code: e7 1f 07 00 e9 f1 00 00 00 e8 4d 7a 2e ff 4c 89 e8 be 08 00 00 00 48 c1 f8 06 4d 8d 04 c4 4c 89 c7 4c 89 04 24 e8 e1 4d 61 ff <4d> 0f a3 2c 24 41 0f 92 c7 31 ff 44 89 fe e8 ae 76 2e ff 45 84 ff
RSP: 0018:ffff888045fa7d08 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff11008bf4fa2 RCX: 0000000000000000
RDX: ffff888046d53580 RSI: ffffffff840ba39a RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000293 R15: 0000000000000000
FS:  00005555555a5400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000416f4000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 dev_free+0xec/0x660
 raw_release+0x219/0x290
 __fput+0x272/0x9d0
 task_work_run+0xe2/0x1a0
 exit_to_user_mode_prepare+0x199/0x1a0
 syscall_exit_to_user_mode+0x19/0x40
 do_syscall_64+0x48/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fc3c19fe72b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc78c53a70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fc3c19fe72b
RDX: ffffffffffffffbc RSI: ffffffff8132c60a RDI: 0000000000000004
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2dd2001c
R10: 000000000000006e R11: 0000000000000293 R12: 000000000010992f
R13: 00000000000003e8 R14: 00007fc3c1b5ef60 R15: 000000000010992e
 </TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:ida_free+0x18f/0x2b0
Code: e7 1f 07 00 e9 f1 00 00 00 e8 4d 7a 2e ff 4c 89 e8 be 08 00 00 00 48 c1 f8 06 4d 8d 04 c4 4c 89 c7 4c 89 04 24 e8 e1 4d 61 ff <4d> 0f a3 2c 24 41 0f 92 c7 31 ff 44 89 fe e8 ae 76 2e ff 45 84 ff
RSP: 0018:ffff888045fa7d08 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff11008bf4fa2 RCX: 0000000000000000
RDX: ffff888046d53580 RSI: ffffffff840ba39a RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000293 R15: 0000000000000000
FS:  00005555555a5400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000416f4000 CR4: 0000000000350ef0
note: syz-executor.7[11751] exited with preempt_count 1
loop6: detected capacity change from 0 to 40
SELinux: security_context_str_to_sid (system_u) failed with errno=-22
loop6: detected capacity change from 0 to 12
SELinux: security_context_str_to_sid (user_u) failed with errno=-22
loop6: detected capacity change from 0 to 7
loop6: detected capacity change from 0 to 40
SELinux: security_context_str_to_sid (system_u) failed with errno=-22
loop6: detected capacity change from 0 to 12
SELinux: security_context_str_to_sid (user_u) failed with errno=-22
loop6: detected capacity change from 0 to 7
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	00 e9                	add    %ch,%cl
   2:	f1                   	icebp
   3:	00 00                	add    %al,(%rax)
   5:	00 e8                	add    %ch,%al
   7:	4d 7a 2e             	rex.WRB jp 0x38
   a:	ff 4c 89 e8          	decl   -0x18(%rcx,%rcx,4)
   e:	be 08 00 00 00       	mov    $0x8,%esi
  13:	48 c1 f8 06          	sar    $0x6,%rax
  17:	4d 8d 04 c4          	lea    (%r12,%rax,8),%r8
  1b:	4c 89 c7             	mov    %r8,%rdi
  1e:	4c 89 04 24          	mov    %r8,(%rsp)
  22:	e8 e1 4d 61 ff       	callq  0xff614e08
* 27:	4d 0f a3 2c 24       	bt     %r13,(%r12) <-- trapping instruction
  2c:	41 0f 92 c7          	setb   %r15b
  30:	31 ff                	xor    %edi,%edi
  32:	44 89 fe             	mov    %r15d,%esi
  35:	e8 ae 76 2e ff       	callq  0xff2e76e8
  3a:	45 84 ff             	test   %r15b,%r15b