RIP: 0033:0x7f5d1539ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5d1627bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5d15615fa0 RCX: 00007f5d1539ce59 RDX: 00000000ffffff03 RSI: 0000200000000280 RDI: 0000000000000008 RBP: 00007f5d15432e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5d15616038 R14: 00007f5d15615fa0 R15: 00007ffff08a8668 Mem-Info: active_anon:7085 inactive_anon:97 isolated_anon:6 active_file:6 inactive_file:33900 isolated_file:0 unevictable:1768 dirty:5 writeback:0 slab_reclaimable:7135 slab_unreclaimable:30987 mapped:10014 shmem:6310 pagetables:713 sec_pagetables:290 bounce:0 kernel_misc_reclaimable:0 free:34062 free_pcp:1898 free_cma:0 Node 0 active_anon:100kB inactive_anon:260kB active_file:12kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:32kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:3104kB pagetables:1044kB sec_pagetables:1084kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB Node 1 active_anon:28200kB inactive_anon:340kB active_file:0kB inactive_file:135604kB unevictable:7072kB isolated(anon):0kB isolated(file):0kB mapped:40120kB dirty:20kB writeback:0kB shmem:25240kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:6688kB pagetables:1820kB sec_pagetables:76kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB Node 0 DMA free:1368kB boost:0kB min:760kB low:948kB high:1136kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:52kB local_pcp:52kB free_cma:0kB lowmem_reserve[]: 0 112 112 112 112 Node 0 DMA32 free:5276kB boost:0kB min:4292kB low:5364kB high:6436kB reserved_highatomic:0KB free_highatomic:0KB active_anon:720kB inactive_anon:180kB active_file:0kB inactive_file:8kB unevictable:0kB writepending:0kB zspages:0kB present:770052kB managed:115004kB mlocked:0kB bounce:0kB free_pcp:440kB local_pcp:440kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 1 DMA32 free:127056kB boost:0kB min:34304kB low:42880kB high:51456kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30324kB inactive_anon:376kB active_file:0kB inactive_file:135604kB unevictable:7072kB writepending:20kB zspages:1748kB present:786288kB managed:690812kB mlocked:0kB bounce:0kB free_pcp:6656kB local_pcp:6656kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 0 Node 0 DMA: 2*4kB (UE) 0*8kB 1*16kB (U) 0*32kB 3*64kB (UE) 1*128kB (E) 0*256kB 0*512kB 1*1024kB (E) 0*2048kB 0*4096kB = 1368kB Node 0 DMA32: 37*4kB (UME) 20*8kB (UME) 6*16kB (UE) 11*32kB (UME) 23*64kB (ME) 14*128kB (UME) 5*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 5300kB Node 1 DMA32: 1*4kB (U) 1*8kB (E) 1*16kB (M) 1*32kB (M) 1*64kB (U) 2*128kB (UE) 3*256kB (UME) 0*512kB 1*1024kB (E) 2*2048kB (ME) 29*4096kB (M) = 125052kB Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB 41675 total pagecache pages 248 pages in swap cache Free swap = 121056kB Total swap = 124996kB 393083 pages RAM 0 pages HighMem/MovableOnly 187789 pages reserved 0 pages cma reserved ERROR: (device loop0): txBegin: read-only filesystem ERROR: (device loop0): remounting filesystem as read-only jfs_dirty_inode called on read-only volume Is remount racy? jfs_dirty_inode called on read-only volume Is remount racy? jfs_dirty_inode called on read-only volume Is remount racy? Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cd: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f] CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:JFS_SBI fs/jfs/jfs_incore.h:217 [inline] RIP: 0010:txEnd+0xb4/0x530 fs/jfs/jfs_txnmgr.c:508 Code: 49 8d 5e 20 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 9c c8 ca fe 41 bf 68 06 00 00 4c 03 3b 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 7d c8 ca fe 49 8b 1f 48 83 c3 30 RSP: 0018:ffffc9000fa677c0 EFLAGS: 00010202 RAX: 00000000000000cd RBX: ffffc90000e91020 RCX: 0000000000000000 RDX: 0000000000000006 RSI: ffffffff8dfe9274 RDI: 00000000ffffffff RBP: ffffc9000fa67a38 R08: ffffffff90331ef7 R09: 1ffffffff20663de R10: dffffc0000000000 R11: fffffbfff20663df R12: 00000000ffffffe2 R13: dffffc0000000000 R14: ffffc90000e91000 R15: 0000000000000668 FS: 00007f5d1627c6c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f759ac67218 CR3: 000000001aa6d000 CR4: 0000000000352ef0 Call Trace: jfs_create+0x2e9/0xae0 fs/jfs/namei.c:160 lookup_open fs/namei.c:4508 [inline] open_last_lookups fs/namei.c:4608 [inline] path_openat+0x133a/0x3830 fs/namei.c:4856 do_file_open+0x23e/0x4a0 fs/namei.c:4888 do_sys_openat2+0x115/0x200 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_sys_creat fs/open.c:1452 [inline] __se_sys_creat fs/open.c:1446 [inline] __x64_sys_creat+0x8f/0xc0 fs/open.c:1446 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5d1539ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5d1627bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 00007f5d15615fa0 RCX: 00007f5d1539ce59 RDX: 0000000000000000 RSI: 122dfb579e447c7a RDI: 0000200000000040 RBP: 00007f5d15432e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5d15616038 R14: 00007f5d15615fa0 R15: 00007ffff08a8668 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:JFS_SBI fs/jfs/jfs_incore.h:217 [inline] RIP: 0010:txEnd+0xb4/0x530 fs/jfs/jfs_txnmgr.c:508 Code: 49 8d 5e 20 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 9c c8 ca fe 41 bf 68 06 00 00 4c 03 3b 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 7d c8 ca fe 49 8b 1f 48 83 c3 30 RSP: 0018:ffffc9000fa677c0 EFLAGS: 00010202 RAX: 00000000000000cd RBX: ffffc90000e91020 RCX: 0000000000000000 RDX: 0000000000000006 RSI: ffffffff8dfe9274 RDI: 00000000ffffffff RBP: ffffc9000fa67a38 R08: ffffffff90331ef7 R09: 1ffffffff20663de R10: dffffc0000000000 R11: fffffbfff20663df R12: 00000000ffffffe2 R13: dffffc0000000000 R14: ffffc90000e91000 R15: 0000000000000668 FS: 00007f5d1627c6c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f759ac67218 CR3: 000000001aa6d000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: 49 8d 5e 20 lea 0x20(%r14),%rbx 4: 48 89 d8 mov %rbx,%rax 7: 48 c1 e8 03 shr $0x3,%rax b: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 10: 74 08 je 0x1a 12: 48 89 df mov %rbx,%rdi 15: e8 9c c8 ca fe call 0xfecac8b6 1a: 41 bf 68 06 00 00 mov $0x668,%r15d 20: 4c 03 3b add (%rbx),%r15 23: 4c 89 f8 mov %r15,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 ff mov %r15,%rdi 34: e8 7d c8 ca fe call 0xfecac8b6 39: 49 8b 1f mov (%r15),%rbx 3c: 48 83 c3 30 add $0x30,%rbx