BUG: unable to handle page fault for address: ffffed1013627a22
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 5ffcd067 P4D 5ffcd067 PUD 2fff7067 PMD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 103 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:txAllocPMap+0x32a/0x6b0 fs/jfs/jfs_txnmgr.c:2412
Code: db fe 48 89 1c 24 4d 8b 3c 24 41 be 01 00 00 00 48 c7 c0 60 dd 58 8e 48 c1 e8 03 48 89 44 24 28 4d 89 fc 4c 89 fb 48 c1 eb 03 <42> 0f b6 04 2b 84 c0 0f 85 32 01 00 00 41 0f b6 2c 24 89 ee 83 e6
RSP: 0000:ffffc900018b7b38 EFLAGS: 00010a06
RAX: 1ffffffff1cb1bac RBX: 1ffff11013627a22 RCX: 0000000000000000
RDX: ffff888000d28000 RSI: 0000000000000076 RDI: 0000000000000000
RBP: 0000000000000076 R08: ffffc900018b7bff R09: 0000000000000000
R10: ffffc900018b7bf0 R11: fffff52000316f80 R12: ffff88809b13d110
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88809b13d110
FS:  0000000000000000(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013627a22 CR3: 0000000011e8b000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 txUpdateMap+0x2a2/0x9c0 fs/jfs/jfs_txnmgr.c:2309
 txLazyCommit fs/jfs/jfs_txnmgr.c:2665 [inline]
 jfs_lazycommit+0x43f/0xa90 fs/jfs/jfs_txnmgr.c:2734
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Modules linked in:
CR2: ffffed1013627a22
---[ end trace 0000000000000000 ]---
RIP: 0010:txAllocPMap+0x32a/0x6b0 fs/jfs/jfs_txnmgr.c:2412
Code: db fe 48 89 1c 24 4d 8b 3c 24 41 be 01 00 00 00 48 c7 c0 60 dd 58 8e 48 c1 e8 03 48 89 44 24 28 4d 89 fc 4c 89 fb 48 c1 eb 03 <42> 0f b6 04 2b 84 c0 0f 85 32 01 00 00 41 0f b6 2c 24 89 ee 83 e6
RSP: 0000:ffffc900018b7b38 EFLAGS: 00010a06
RAX: 1ffffffff1cb1bac RBX: 1ffff11013627a22 RCX: 0000000000000000
RDX: ffff888000d28000 RSI: 0000000000000076 RDI: 0000000000000000
RBP: 0000000000000076 R08: ffffc900018b7bff R09: 0000000000000000
R10: ffffc900018b7bf0 R11: fffff52000316f80 R12: ffff88809b13d110
R13: dffffc0000000000 R14: 0000000000000001 R15: ffff88809b13d110
FS:  0000000000000000(0000) GS:ffff88808d22a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed1013627a22 CR3: 0000000011e8b000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	fe 48 89             	decb   -0x77(%rax)
   3:	1c 24                	sbb    $0x24,%al
   5:	4d 8b 3c 24          	mov    (%r12),%r15
   9:	41 be 01 00 00 00    	mov    $0x1,%r14d
   f:	48 c7 c0 60 dd 58 8e 	mov    $0xffffffff8e58dd60,%rax
  16:	48 c1 e8 03          	shr    $0x3,%rax
  1a:	48 89 44 24 28       	mov    %rax,0x28(%rsp)
  1f:	4d 89 fc             	mov    %r15,%r12
  22:	4c 89 fb             	mov    %r15,%rbx
  25:	48 c1 eb 03          	shr    $0x3,%rbx
* 29:	42 0f b6 04 2b       	movzbl (%rbx,%r13,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 32 01 00 00    	jne    0x168
  36:	41 0f b6 2c 24       	movzbl (%r12),%ebp
  3b:	89 ee                	mov    %ebp,%esi
  3d:	83                   	.byte 0x83
  3e:	e6                   	.byte 0xe6