BUG: kernel NULL pointer dereference, address: 0000000000000009 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 331e4067 P4D 331e4067 PUD 34a92067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 UID: 0 PID: 6472 Comm: syz.0.175 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:PageTail include/linux/page-flags.h:281 [inline] RIP: 0010:const_folio_flags include/linux/page-flags.h:309 [inline] RIP: 0010:folio_test_active include/linux/page-flags.h:518 [inline] RIP: 0010:slab_test_pfmemalloc mm/slab.h:176 [inline] RIP: 0010:pfmemalloc_match mm/slub.c:3547 [inline] RIP: 0010:___slab_alloc+0x1f4/0x14b0 mm/slub.c:3688 Code: f7 44 24 60 00 02 00 00 44 8b 74 24 10 0f 85 59 06 00 00 41 f7 c5 00 02 00 00 4c 8b 3c 24 0f 84 5c fe ff ff fb e9 56 fe ff ff <49> 8b 44 24 08 a8 01 0f 85 d6 07 00 00 0f 1f 44 00 00 49 f7 04 24 RSP: 0018:ffffc9000c975e78 EFLAGS: 00010246 RAX: 618cef7bcbaf9a00 RBX: 00000000ffffffff RCX: ffffffff82779645 RDX: 00000000ffffffff RSI: 0000000000008c40 RDI: ffff88802e7b6dc0 RBP: ffff88802e7b6dc0 R08: ffffe8ffffd73160 R09: 0000000000000400 R10: dffffc0000000000 R11: fffffbfff20328bf R12: 0000000000000001 R13: 0000000000008c40 R14: 00000000ffffffff R15: ffff88802e7b6dc0 FS: 00007f38605f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000009 CR3: 0000000078d30000 CR4: 0000000000350ef0 Call Trace: __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_noprof+0x268/0x380 mm/slub.c:4160 jbd2_alloc+0x155/0x1b0 fs/jbd2/journal.c:2787 jbd2_journal_get_undo_access+0x1d1/0x310 fs/jbd2/transaction.c:1395 __ocfs2_journal_access+0x4de/0x8b0 fs/ocfs2/journal.c:692 ocfs2_block_group_set_bits+0x29e/0x9a0 fs/ocfs2/suballoc.c:1387 ocfs2_search_chain+0x1b27/0x26c0 fs/ocfs2/suballoc.c:1900 ocfs2_claim_suballoc_bits+0x11ef/0x2560 fs/ocfs2/suballoc.c:1985 __ocfs2_claim_clusters+0x332/0xa40 fs/ocfs2/suballoc.c:2395 ocfs2_claim_clusters fs/ocfs2/suballoc.c:2432 [inline] ocfs2_block_group_alloc_contig fs/ocfs2/suballoc.c:432 [inline] ocfs2_block_group_alloc fs/ocfs2/suballoc.c:699 [inline] ocfs2_reserve_suballoc_bits+0x115e/0x4e70 fs/ocfs2/suballoc.c:832 ocfs2_reserve_new_metadata_blocks+0x41c/0x9c0 fs/ocfs2/suballoc.c:982 ocfs2_reserve_new_metadata fs/ocfs2/suballoc.c:1025 [inline] ocfs2_lock_allocators+0x2a9/0x630 fs/ocfs2/suballoc.c:2735 ocfs2_extend_allocation+0x4ed/0x1bf0 fs/ocfs2/file.c:589 ocfs2_allocate_unwritten_extents+0x398/0x9f0 fs/ocfs2/file.c:1496 __ocfs2_change_file_space+0x97d/0xfd0 fs/ocfs2/file.c:2023 ocfs2_fallocate+0x2e4/0x350 fs/ocfs2/file.c:2138 vfs_fallocate+0x56b/0x6e0 fs/open.c:327 do_vfs_ioctl+0x258c/0x2e40 fs/ioctl.c:885 __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x80/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f386277ff19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f38605f6058 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f3862945fa0 RCX: 00007f386277ff19 RDX: 0000000020000080 RSI: 0000000040305828 RDI: 0000000000000004 RBP: 00007f38627f3986 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f3862945fa0 R15: 00007ffe86e60eb8 Modules linked in: CR2: 0000000000000009 ---[ end trace 0000000000000000 ]--- RIP: 0010:PageTail include/linux/page-flags.h:281 [inline] RIP: 0010:const_folio_flags include/linux/page-flags.h:309 [inline] RIP: 0010:folio_test_active include/linux/page-flags.h:518 [inline] RIP: 0010:slab_test_pfmemalloc mm/slab.h:176 [inline] RIP: 0010:pfmemalloc_match mm/slub.c:3547 [inline] RIP: 0010:___slab_alloc+0x1f4/0x14b0 mm/slub.c:3688 Code: f7 44 24 60 00 02 00 00 44 8b 74 24 10 0f 85 59 06 00 00 41 f7 c5 00 02 00 00 4c 8b 3c 24 0f 84 5c fe ff ff fb e9 56 fe ff ff <49> 8b 44 24 08 a8 01 0f 85 d6 07 00 00 0f 1f 44 00 00 49 f7 04 24 RSP: 0018:ffffc9000c975e78 EFLAGS: 00010246 RAX: 618cef7bcbaf9a00 RBX: 00000000ffffffff RCX: ffffffff82779645 RDX: 00000000ffffffff RSI: 0000000000008c40 RDI: ffff88802e7b6dc0 RBP: ffff88802e7b6dc0 R08: ffffe8ffffd73160 R09: 0000000000000400 R10: dffffc0000000000 R11: fffffbfff20328bf R12: 0000000000000001 R13: 0000000000008c40 R14: 00000000ffffffff R15: ffff88802e7b6dc0 FS: 00007f38605f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000009 CR3: 0000000078d30000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: f7 44 24 60 00 02 00 testl $0x200,0x60(%rsp) 7: 00 8: 44 8b 74 24 10 mov 0x10(%rsp),%r14d d: 0f 85 59 06 00 00 jne 0x66c 13: 41 f7 c5 00 02 00 00 test $0x200,%r13d 1a: 4c 8b 3c 24 mov (%rsp),%r15 1e: 0f 84 5c fe ff ff je 0xfffffe80 24: fb sti 25: e9 56 fe ff ff jmp 0xfffffe80 * 2a: 49 8b 44 24 08 mov 0x8(%r12),%rax <-- trapping instruction 2f: a8 01 test $0x1,%al 31: 0f 85 d6 07 00 00 jne 0x80d 37: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 3c: 49 rex.WB 3d: f7 .byte 0xf7 3e: 04 24 add $0x24,%al