Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1607 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: rcu_gp srcu_invoke_callbacks
RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190 lib/list_debug.c:49
Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 af 58 47 fd 4c 8b 7b 08 48 89 d8 48 c1 e8
RSP: 0018:ffffc9000488f8e8 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffff888028e10000
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000008
RBP: dffffc0000000000 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e
R10: dffffc0000000000 R11: ffffffff84b089f0 R12: 1ffff1100e370ddf
R13: dffffc0000000000 R14: ffff888071b86ea0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881257a2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055894a2b1820 CR3: 0000000022fe6000 CR4: 00000000003526f0
Call Trace:
<TASK>
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:223 [inline]
list_del_init include/linux/list.h:295 [inline]
blk_mq_free_tags_callback+0x5a/0x180 block/blk-mq-tag.c:593
srcu_invoke_callbacks+0x208/0x450 kernel/rcu/srcutree.c:1807
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190 lib/list_debug.c:49
Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 af 58 47 fd 4c 8b 7b 08 48 89 d8 48 c1 e8
RSP: 0018:ffffc9000488f8e8 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffff888028e10000
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000008
RBP: dffffc0000000000 R08: ffffffff8fe4db77 R09: 1ffffffff1fc9b6e
R10: dffffc0000000000 R11: ffffffff84b089f0 R12: 1ffff1100e370ddf
R13: dffffc0000000000 R14: ffff888071b86ea0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881257a2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055894a2b1820 CR3: 0000000022fe6000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: f3 0f 1e fa endbr64
9: 41 57 push %r15
b: 41 56 push %r14
d: 41 55 push %r13
f: 41 54 push %r12
11: 53 push %rbx
12: 48 89 fb mov %rdi,%rbx
15: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13
1c: fc ff df
1f: 48 83 c7 08 add $0x8,%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 05 je 0x36
31: e8 af 58 47 fd call 0xfd4758e5
36: 4c 8b 7b 08 mov 0x8(%rbx),%r15
3a: 48 89 d8 mov %rbx,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
3f: e8 .byte 0xe8