general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 1 PID: 113 Comm: jfsCommit Not tainted 6.6.98-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:207 [inline] RIP: 0010:lmLogSync+0xfc/0x9c0 fs/jfs/jfs_logmgr.c:935 Code: bb 84 fe 4d 8d 7e d8 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 a2 6a dd fe 4d 8b 3f 49 83 c7 40 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 86 6a dd fe 49 8b 3f e8 ce 8b b3 fe RSP: 0018:ffffc90002cc7c40 EFLAGS: 00010202 RAX: 0000000000000008 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffff888019795a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90002cc7d48 R08: 0000000000000003 R09: 0000000000000000 R10: ffffc90002cc7ca0 R11: fffff52000598f98 R12: ffff888023622000 R13: dffffc0000000000 R14: ffff888077064838 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3011eff8 CR3: 000000005c90d000 CR4: 00000000003506e0 Call Trace: jfs_syncpt+0x7b/0x90 fs/jfs/jfs_logmgr.c:1041 txEnd+0x2e5/0x520 fs/jfs/jfs_txnmgr.c:549 txLazyCommit fs/jfs/jfs_txnmgr.c:2684 [inline] jfs_lazycommit+0x5a6/0xa60 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:write_special_inodes fs/jfs/jfs_logmgr.c:207 [inline] RIP: 0010:lmLogSync+0xfc/0x9c0 fs/jfs/jfs_logmgr.c:935 Code: bb 84 fe 4d 8d 7e d8 4c 89 f8 48 c1 e8 03 80 3c 18 00 74 08 4c 89 ff e8 a2 6a dd fe 4d 8b 3f 49 83 c7 40 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 86 6a dd fe 49 8b 3f e8 ce 8b b3 fe RSP: 0018:ffffc90002cc7c40 EFLAGS: 00010202 RAX: 0000000000000008 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffff888019795a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90002cc7d48 R08: 0000000000000003 R09: 0000000000000000 R10: ffffc90002cc7ca0 R11: fffff52000598f98 R12: ffff888023622000 R13: dffffc0000000000 R14: ffff888077064838 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3011eff8 CR3: 000000005c90d000 CR4: 00000000003506e0 ---------------- Code disassembly (best guess): 0: bb 84 fe 4d 8d mov $0x8d4dfe84,%ebx 5: 7e d8 jle 0xffffffdf 7: 4c 89 f8 mov %r15,%rax a: 48 c1 e8 03 shr $0x3,%rax e: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 12: 74 08 je 0x1c 14: 4c 89 ff mov %r15,%rdi 17: e8 a2 6a dd fe call 0xfedd6abe 1c: 4d 8b 3f mov (%r15),%r15 1f: 49 83 c7 40 add $0x40,%r15 23: 4c 89 f8 mov %r15,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 86 6a dd fe call 0xfedd6abe 38: 49 8b 3f mov (%r15),%rdi 3b: e8 ce 8b b3 fe call 0xfeb38c0e