An anonymous fixed mmap with CONFIG_HUGETLB_PAGE=y will dereference NULL.  We
recur into the pagefault handler with mmap_sem held and lock up.