general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] CPU: 0 PID: 19816 Comm: syz-executor.3 Not tainted 6.2.0-syzkaller-13175-g16b7c970cc81 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline] RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline] RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline] RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063 Code: 89 c6 e8 fa e6 7b fd 85 db 58 0f 85 8f 00 00 00 e8 9c ea 7b fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4 RSP: 0018:ffffc90006b27368 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff84091914 RDI: 0000000000000038 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffc31df8 R13: ffff88805754c800 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f708b784c18 CR3: 00000000311dc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: submit_bio_noacct_nocheck+0x7e/0xcd0 block/blk-core.c:687 submit_bio_noacct+0x952/0x1b80 block/blk-core.c:807 submit_bio block/blk-core.c:843 [inline] submit_bio+0x8f/0x1c0 block/blk-core.c:831 ext4_io_submit+0xa6/0x140 fs/ext4/page-io.c:378 ext4_do_writepages+0x157c/0x3750 fs/ext4/inode.c:2896 ext4_writepages+0x27c/0x5e0 fs/ext4/inode.c:2964 do_writepages+0x1a8/0x640 mm/page-writeback.c:2551 filemap_fdatawrite_wbc mm/filemap.c:390 [inline] filemap_fdatawrite_wbc+0x147/0x1b0 mm/filemap.c:380 __filemap_fdatawrite_range+0xb8/0xf0 mm/filemap.c:423 ext4_alloc_da_blocks+0x25f/0x3d0 fs/ext4/inode.c:3218 ext4_release_file+0x181/0x370 fs/ext4/file.c:158 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xad3/0x2a40 kernel/exit.c:869 do_group_exit+0xd4/0x2a0 kernel/exit.c:1019 get_signal+0x2315/0x25b0 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:309 exc_page_fault+0xc0/0x170 arch/x86/mm/fault.c:1557 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 002b:00000000200000a8 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f84b21abf80 RCX: 00007f84b208c169 RDX: 00000000200000c0 RSI: 00000000200000a0 RDI: 0000000040800000 RBP: 00007f84b20e7ca1 R08: 0000000020000180 R09: 0000000020000180 R10: 0000000020000140 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ffde4d24b0f R14: 00007f84b2e1b300 R15: 0000000000022000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline] RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline] RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline] RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063 Code: 89 c6 e8 fa e6 7b fd 85 db 58 0f 85 8f 00 00 00 e8 9c ea 7b fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4 RSP: 0018:ffffc90006b27368 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000007 RSI: ffffffff84091914 RDI: 0000000000000038 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffc31df8 R13: ffff88805754c800 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f708b784c18 CR3: 00000000311dc000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess): 0: 89 c6 mov %eax,%esi 2: e8 fa e6 7b fd callq 0xfd7be701 7: 85 db test %ebx,%ebx 9: 58 pop %rax a: 0f 85 8f 00 00 00 jne 0x9f 10: e8 9c ea 7b fd callq 0xfd7beab1 15: 48 8d 7d 38 lea 0x38(%rbp),%rdi 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 dd 02 00 00 jne 0x311 34: 48 8b 5d 38 mov 0x38(%rbp),%rbx 38: 31 ff xor %edi,%edi 3a: 49 89 dc mov %rbx,%r12 3d: 41 rex.B 3e: 83 .byte 0x83 3f: e4 .byte 0xe4