kworker/u4:4: attempt to access beyond end of device
loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427
Unable to handle kernel paging request at virtual address dfff800000000001
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff800000000001] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 66 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: writeback wb_workfn (flush-259:0)
pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : PageTail include/linux/page-flags.h:292 [inline]
pc : folio_flags include/linux/page-flags.h:319 [inline]
pc : folio_test_uptodate include/linux/page-flags.h:719 [inline]
pc : ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
lr : ext4_mb_load_buddy_gfp+0x1e8/0xec0 fs/ext4/mballoc.c:1535
sp : ffff80001fa76680
x29: ffff80001fa766e0 x28: 1ffff00003f4ed14 x27: dfff800000000000
x26: 0000000000000008 x25: 0000000000000004 x24: ffff0000c5a816f0
x23: ffff0000c5a816c0 x22: 0000000000000000 x21: 0000000000000001
x20: 1ffff00003f4ed14 x19: ffff80001fa76890 x18: 1fffe00033c2177e
x17: ffff8000163dd000 x16: ffff800011ba16d0 x15: 0000000000000000
x14: 0000000000000406 x13: 0000000000ff0100 x12: ffff800016647a88
x11: ff008000086f8b74 x10: 0000000000000000 x9 : 218e87fea1bbe100
x8 : 218e87fea1bbe100 x7 : ffff800008704dd0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 PageTail include/linux/page-flags.h:-1 [inline]
 folio_flags include/linux/page-flags.h:319 [inline]
 folio_test_uptodate include/linux/page-flags.h:719 [inline]
 ext4_mb_load_buddy_gfp+0x21c/0xec0 fs/ext4/mballoc.c:1536
 ext4_mb_load_buddy fs/ext4/mballoc.c:1641 [inline]
 ext4_mb_regular_allocator+0xfb4/0x2b60 fs/ext4/mballoc.c:2798
 ext4_mb_new_blocks+0xb78/0x4244 fs/ext4/mballoc.c:5793
 ext4_ext_map_blocks+0x12bc/0x5680 fs/ext4/extents.c:4369
 ext4_map_blocks+0x7b0/0x160c fs/ext4/inode.c:681
 mpage_map_one_extent fs/ext4/inode.c:2437 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2490 [inline]
 ext4_writepages+0x10a4/0x29f0 fs/ext4/inode.c:2859
 do_writepages+0x2c4/0x50c mm/page-writeback.c:2491
 __writeback_single_inode+0x164/0x157c fs/fs-writeback.c:1688
 writeback_sb_inodes+0x870/0x1470 fs/fs-writeback.c:1979
 __writeback_inodes_wb+0x104/0x370 fs/fs-writeback.c:2050
 wb_writeback+0x420/0xfdc fs/fs-writeback.c:2155
 wb_check_background_flush fs/fs-writeback.c:2221 [inline]
 wb_do_writeback fs/fs-writeback.c:2309 [inline]
 wb_workfn+0xb40/0xe18 fs/fs-writeback.c:2336
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: aa0003f6 d343ff55 f9000ff4 aa1c03f4 (387b6aa8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	aa0003f6 	mov	x22, x0
   4:	d343ff55 	lsr	x21, x26, #3
   8:	f9000ff4 	str	x20, [sp, #24]
   c:	aa1c03f4 	mov	x20, x28
* 10:	387b6aa8 	ldrb	w8, [x21, x27] <-- trapping instruction