general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 10332 Comm: syz.8.2929 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:2912 [inline]
RIP: 0010:update_sit_entry+0x5a4/0xfd0 fs/f2fs/segment.c:2339
Code: 80 3c 08 00 74 08 48 89 df e8 38 3b 92 ff 4c 89 75 b0 48 8b 1b 48 03 5d a8 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 0b 09 00 00 44 0f b6 33 44 89 f0 44 08 e8
RSP: 0000:ffffc900010de658 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88810f843b40 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900010de6d0 R08: ffff88810edb8029 R09: 1ffff11021db7005
R10: dffffc0000000000 R11: ffffed1021db7006 R12: ffff88811284c000
R13: 0000000000000004 R14: ffff88811284c0c0 R15: ffff88810f924878
FS:  00007fc058e296c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00001ffffffffff8 CR3: 000000011e138000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 f2fs_allocate_data_block+0x10c9/0x3880 fs/f2fs/segment.c:3481
 do_write_page+0x2be/0x7e0 fs/f2fs/segment.c:3569
 f2fs_outplace_write_data+0xf6/0x240 fs/f2fs/segment.c:3635
 f2fs_convert_inline_page+0x7f7/0xeb0 fs/f2fs/inline.c:197
 f2fs_convert_inline_inode+0x631/0x700 fs/f2fs/inline.c:247
 f2fs_preallocate_blocks fs/f2fs/file.c:4664 [inline]
 f2fs_file_write_iter+0xe23/0x27c0 fs/f2fs/file.c:4906
 __kernel_write+0x5a5/0x9d0 fs/read_write.c:550
 dump_emit+0x255/0x380 fs/coredump.c:855
 writenote+0x1bd/0x2f0 fs/binfmt_elf.c:1465
 write_note_info+0x14d/0x320 fs/binfmt_elf.c:1925
 elf_core_dump+0x26ef/0x2c20 fs/binfmt_elf.c:2277
 do_coredump+0x1be6/0x2910 fs/coredump.c:817
 get_signal+0xf4c/0x1300 kernel/signal.c:2779
 arch_do_signal_or_restart+0xe7/0x11b0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:145 [inline]
 exit_to_user_mode_loop+0xa2/0xe0 kernel/entry/common.c:169
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:287
 irqentry_exit+0x12/0x60 kernel/entry/common.c:375
 exc_general_protection+0x1ca/0x250 arch/x86/kernel/traps.c:557
 asm_exc_general_protection+0x1e/0x30 arch/x86/include/asm/idtentry.h:565
RIP: 0033:0x7fc05a3cee61
Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:00002000000005b0 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fc05a647fa0 RCX: 00007fc05a3cee59
RDX: 00002000000005c0 RSI: 00002000000005b0 RDI: 0000000083300000
RBP: 00007fc05a464e6f R08: 0000200000000640 R09: 0000200000000640
R10: 0000200000000600 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fc05a648038 R14: 00007fc05a647fa0 R15: 00007fffe0ddf708
Modules linked in:
---[ end trace 0f39a5b175715fea ]---
RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:2912 [inline]
RIP: 0010:update_sit_entry+0x5a4/0xfd0 fs/f2fs/segment.c:2339
Code: 80 3c 08 00 74 08 48 89 df e8 38 3b 92 ff 4c 89 75 b0 48 8b 1b 48 03 5d a8 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 0b 09 00 00 44 0f b6 33 44 89 f0 44 08 e8
RSP: 0000:ffffc900010de658 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: ffff88810f843b40 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900010de6d0 R08: ffff88810edb8029 R09: 1ffff11021db7005
R10: dffffc0000000000 R11: ffffed1021db7006 R12: ffff88811284c000
R13: 0000000000000004 R14: ffff88811284c0c0 R15: ffff88810f924878
FS:  00007fc058e296c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555591ebd948 CR3: 000000011e138000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1)
   4:	74 08                	je     0xe
   6:	48 89 df             	mov    %rbx,%rdi
   9:	e8 38 3b 92 ff       	call   0xff923b46
   e:	4c 89 75 b0          	mov    %r14,-0x50(%rbp)
  12:	48 8b 1b             	mov    (%rbx),%rbx
  15:	48 03 5d a8          	add    -0x58(%rbp),%rbx
  19:	48 89 d8             	mov    %rbx,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  27:	fc ff df
* 2a:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 0b 09 00 00    	jne    0x941
  36:	44 0f b6 33          	movzbl (%rbx),%r14d
  3a:	44 89 f0             	mov    %r14d,%eax
  3d:	44 08 e8             	or     %r13b,%al