BUG: unable to handle page fault for address: fffffbfff920008f
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffe4067 P4D 23ffe4067 PUD 23ffe3067 PMD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 6115 Comm: syz.1.37 Not tainted 6.14.0-syzkaller-10514-g7f2ff7b62617 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline]
RIP: 0010:rcu_segcblist_advance+0x69/0x3f0 kernel/rcu/rcu_segcblist.c:474
Code: 84 81 03 00 00 4c 8d 73 08 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 91 f4 80 00 49 8b 2e 48 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 ef e8 78 f4 80 00 48 83 7d 00 00 0f 84
RSP: 0018:ffffc900047a7518 EFLAGS: 00010012
RAX: 1ffffffff920008f RBX: ffffe8ffffc78240 RCX: 36284c9e74c51400
RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc78240
RBP: ffffffffc900047a R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffe70
R13: 1ffffd1ffff8f049 R14: ffffe8ffffc78248 R15: dffffc0000000000
FS:  00007fc8570196c0(0000) GS:ffff888124fb7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff920008f CR3: 00000000445ce000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 srcu_gp_start_if_needed+0x71d/0x12a0 kernel/rcu/srcutree.c:1316
 __call_srcu kernel/rcu/srcutree.c:1389 [inline]
 __synchronize_srcu+0x370/0x420 kernel/rcu/srcutree.c:1441
 bch2_fs_btree_iter_exit+0x3e8/0x480 fs/bcachefs/btree_iter.c:3619
 __bch2_fs_free fs/bcachefs/super.c:568 [inline]
 bch2_fs_release+0x230/0x7d0 fs/bcachefs/super.c:621
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x231/0x480 lib/kobject.c:737
 deactivate_locked_super+0xc6/0x130 fs/super.c:473
 bch2_fs_get_tree+0xd41/0x18d0 fs/bcachefs/fs.c:2294
 vfs_get_tree+0x92/0x2b0 fs/super.c:1759
 do_new_mount+0x2cf/0xb70 fs/namespace.c:3878
 do_mount fs/namespace.c:4218 [inline]
 __do_sys_mount fs/namespace.c:4429 [inline]
 __se_sys_mount+0x38c/0x400 fs/namespace.c:4406
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc85618e90a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc857018e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fc857018ef0 RCX: 00007fc85618e90a
RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 00007fc857018eb0
RBP: 00002000000000c0 R08: 00007fc857018ef0 R09: 0000000000a08042
R10: 0000000000a08042 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fc857018eb0 R14: 0000000000005927 R15: 0000200000000200
 </TASK>
Modules linked in:
CR2: fffffbfff920008f
---[ end trace 0000000000000000 ]---
RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline]
RIP: 0010:rcu_segcblist_advance+0x69/0x3f0 kernel/rcu/rcu_segcblist.c:474
Code: 84 81 03 00 00 4c 8d 73 08 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 91 f4 80 00 49 8b 2e 48 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 ef e8 78 f4 80 00 48 83 7d 00 00 0f 84
RSP: 0018:ffffc900047a7518 EFLAGS: 00010012
RAX: 1ffffffff920008f RBX: ffffe8ffffc78240 RCX: 36284c9e74c51400
RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc78240
RBP: ffffffffc900047a R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffe70
R13: 1ffffd1ffff8f049 R14: ffffe8ffffc78248 R15: dffffc0000000000
FS:  00007fc8570196c0(0000) GS:ffff888124fb7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff920008f CR3: 00000000445ce000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	84 81 03 00 00 4c    	test   %al,0x4c000003(%rcx)
   6:	8d 73 08             	lea    0x8(%rbx),%esi
   9:	4d 89 f5             	mov    %r14,%r13
   c:	49 c1 ed 03          	shr    $0x3,%r13
  10:	43 80 7c 3d 00 00    	cmpb   $0x0,0x0(%r13,%r15,1)
  16:	74 08                	je     0x20
  18:	4c 89 f7             	mov    %r14,%rdi
  1b:	e8 91 f4 80 00       	call   0x80f4b1
  20:	49 8b 2e             	mov    (%r14),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 ef             	mov    %rbp,%rdi
  34:	e8 78 f4 80 00       	call   0x80f4b1
  39:	48 83 7d 00 00       	cmpq   $0x0,0x0(%rbp)
  3e:	0f                   	.byte 0xf
  3f:	84                   	.byte 0x84