Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: krdsd rds_tcp_accept_worker
RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 net/rds/tcp_listen.c:319
Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 b1 3b f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00
RSP: 0018:ffffc90000b97960 EFLAGS: 00010212
RAX: 1ffff1100ed44a13 RBX: 0000000000000012 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8deeea76 RDI: 00000000ffffffff
RBP: ffffc90000b97ad8 R08: ffffffff90116eb7 R09: 1ffffffff2022dd6
R10: dffffc0000000000 R11: fffffbfff2022dd7 R12: ffff88805444c000
R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff92000172f34
FS:  0000000000000000(0000) GS:ffff88812556a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3090fff8 CR3: 0000000058cbe000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 rds_tcp_accept_worker+0x1d/0x70 net/rds/tcp.c:524
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 net/rds/tcp_listen.c:319
Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 b1 3b f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00
RSP: 0018:ffffc90000b97960 EFLAGS: 00010212
RAX: 1ffff1100ed44a13 RBX: 0000000000000012 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffffffff8deeea76 RDI: 00000000ffffffff
RBP: ffffc90000b97ad8 R08: ffffffff90116eb7 R09: 1ffffffff2022dd6
R10: dffffc0000000000 R11: fffffbfff2022dd7 R12: ffff88805444c000
R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff92000172f34
FS:  0000000000000000(0000) GS:ffff88812546a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f417d1e82f8 CR3: 000000003136c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	48 83 c3 18          	add    $0x18,%rbx
   6:	48 89 d8             	mov    %rbx,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  12:	74 08                	je     0x1c
  14:	48 89 df             	mov    %rbx,%rdi
  17:	e8 33 b1 3b f7       	call   0xf73bb14f
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	48 83 c3 12          	add    $0x12,%rbx
  23:	49 89 de             	mov    %rbx,%r14
  26:	49 c1 ee 03          	shr    $0x3,%r14
* 2a:	43 0f b6 04 2e       	movzbl (%r14,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 53 02 00 00    	jne    0x28a
  37:	44 0f b6 2b          	movzbl (%rbx),%r13d
  3b:	bf 08 00 00 00       	mov    $0x8,%edi