------------[ cut here ]------------
WARNING: block/blk-mq.c:2120 at blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2120, CPU#1: kworker/1:1H/4530
Modules linked in:
CPU: 1 UID: 0 PID: 4530 Comm: kworker/1:1H Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: kblockd blk_mq_run_work_fn
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2120
lr : blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2120
sp : ffff8000976777e0
x29: ffff8000976778c0 x28: 0000000000000000 x27: ffff0000c8ae2880
x26: 1fffe000191bc1c2 x25: ffff0000c8de0e48 x24: ffff0000c8ae2800
x23: dfff800000000000 x22: ffff0000c8de0e10 x21: ffff800097677a48
x20: ffff800097677a40 x19: ffff0000c8ae2948 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b44b000
x14: ffff80008bc832b0 x13: 0000000000000002 x12: 0000000000000000
x11: 0000000000000000 x10: ffff700012ecef12 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80008b7b0c38 x4 : 0000000000000000 x3 : 0000000000000010
x2 : 0000000000000000 x1 : ffff0000d12cd880 x0 : 0000000000000000
Call trace:
 blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2120 (P)
 __blk_mq_sched_dispatch_requests+0x250/0x10e8 block/blk-mq-sched.c:299
 blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329
 blk_mq_run_work_fn+0x214/0x2e4 block/blk-mq.c:2545
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 15100
hardirqs last  enabled at (15099): [<ffff8000868a1964>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:219 [inline]
hardirqs last  enabled at (15099): [<ffff8000868a1964>] _raw_spin_unlock_irq+0x30/0x80 kernel/locking/spinlock.c:229
hardirqs last disabled at (15100): [<ffff80008687d454>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (15086): [<ffff80008030ae24>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last  enabled at (15086): [<ffff80008030ae24>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (14729): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Unable to handle kernel paging request at virtual address dfff80000000002b
KASAN: null-ptr-deref in range [0x0000000000000158-0x000000000000015f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff80000000002b] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 4530 Comm: kworker/1:1H Tainted: G        W           syzkaller #0 PREEMPT 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: kblockd blk_mq_run_work_fn
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : nvme_map_data drivers/nvme/host/pci.c:1254 [inline]
pc : nvme_prep_rq+0x214/0x261c drivers/nvme/host/pci.c:1421
lr : nvme_prep_rq+0x1e4/0x261c drivers/nvme/host/pci.c:1420
sp : ffff800097677500
x29: ffff800097677730 x28: dfff800000000000 x27: ffff700012eceeac
x26: ffff800097677560 x25: 1fffe000191bc1ef x24: 1fffe000191bc1c3
x23: ffff0000c8de0e1c x22: ffff0000c8de0e10 x21: 0000000000000000
x20: 0000000000000158 x19: ffff0000c8de0e00 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b44b000
x14: ffff80008bc832b0 x13: 0000000000000002 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000
x8 : 000000000000002b x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80008b7b0c38 x4 : 0000000000000000 x3 : ffff8000827f26c8
x2 : 0000000000000028 x1 : ffff0000d12cd880 x0 : 0000000000000000
Call trace:
 nvme_map_data drivers/nvme/host/pci.c:1254 [inline] (P)
 nvme_prep_rq+0x214/0x261c drivers/nvme/host/pci.c:1421 (P)
 nvme_queue_rq+0xdc/0x4d4 drivers/nvme/host/pci.c:1461
 blk_mq_dispatch_rq_list+0x3d4/0x13a8 block/blk-mq.c:2130
 __blk_mq_sched_dispatch_requests+0x250/0x10e8 block/blk-mq-sched.c:299
 blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329
 blk_mq_run_work_fn+0x214/0x2e4 block/blk-mq.c:2545
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: 978e8bad f94002c8 91056114 d343fe88 (387c6908) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	978e8bad 	bl	0xfffffffffe3a2eb4
   4:	f94002c8 	ldr	x8, [x22]
   8:	91056114 	add	x20, x8, #0x158
   c:	d343fe88 	lsr	x8, x20, #3
* 10:	387c6908 	ldrb	w8, [x8, x28] <-- trapping instruction