general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 377 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:2946 [inline] RIP: 0010:update_sit_entry+0x5a1/0xf40 fs/f2fs/segment.c:2256 Code: 8b 45 c8 48 8d 58 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 ac 81 90 ff 48 8b 1b 4c 01 f3 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 86 08 00 00 44 0f b6 33 44 89 f0 44 8b RSP: 0018:ffffc90000b069e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888111cd0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000b06a60 R08: ffff8881118be029 R09: 1ffff11022317c05 R10: dffffc0000000000 R11: ffffed1022317c06 R12: 1ffff11022317030 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881113de000 FS: 0000555587bf8500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001ffffffffe00 CR3: 000000012c1aa000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: f2fs_allocate_data_block+0x13b0/0x3140 fs/f2fs/segment.c:3457 do_write_page+0x12e/0x9f0 fs/f2fs/segment.c:3547 f2fs_outplace_write_data+0xf6/0x240 fs/f2fs/segment.c:3621 f2fs_convert_inline_page+0x7eb/0xfc0 fs/f2fs/inline.c:198 f2fs_convert_inline_inode+0x554/0x610 fs/f2fs/inline.c:250 f2fs_preallocate_blocks fs/f2fs/file.c:4536 [inline] f2fs_file_write_iter+0x933/0x29f0 fs/f2fs/file.c:4777 __kernel_write+0x521/0x970 fs/read_write.c:539 __dump_emit+0x255/0x380 fs/coredump.c:880 dump_emit+0x36a/0x3d0 fs/coredump.c:917 writenote+0x1bd/0x2f0 fs/binfmt_elf.c:1465 write_note_info fs/binfmt_elf.c:1929 [inline] elf_core_dump+0x2926/0x2ff0 fs/binfmt_elf.c:2272 do_coredump+0x13c2/0x27d0 fs/coredump.c:831 get_signal+0x387/0x1430 kernel/signal.c:2893 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:320 irqentry_exit+0x12/0x40 kernel/entry/common.c:411 exc_page_fault+0x5e/0xb0 arch/x86/mm/fault.c:1563 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:606 RIP: 0033:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 002b:00002000000001c8 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f47f8b8ffa0 RCX: 00007f47f8916e59 RDX: 0000200000000200 RSI: 00002000000001c0 RDI: 0000000000001000 RBP: 00007f47f89ace6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f47f8b8ffac R14: 00007f47f8b8ffa0 R15: 00007f47f8b8ffa0 Modules linked in: ---[ end trace 9cc21f3ca44d76c2 ]--- RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:2946 [inline] RIP: 0010:update_sit_entry+0x5a1/0xf40 fs/f2fs/segment.c:2256 Code: 8b 45 c8 48 8d 58 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 ac 81 90 ff 48 8b 1b 4c 01 f3 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 86 08 00 00 44 0f b6 33 44 89 f0 44 8b RSP: 0018:ffffc90000b069e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888111cd0000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000b06a60 R08: ffff8881118be029 R09: 1ffff11022317c05 R10: dffffc0000000000 R11: ffffed1022317c06 R12: 1ffff11022317030 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881113de000 FS: 0000555587bf8500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000003466540 CR3: 000000012c1aa000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 8b 45 c8 mov -0x38(%rbp),%eax 3: 48 8d 58 18 lea 0x18(%rax),%rbx 7: 48 89 d8 mov %rbx,%rax a: 48 c1 e8 03 shr $0x3,%rax e: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 13: 74 08 je 0x1d 15: 48 89 df mov %rbx,%rdi 18: e8 ac 81 90 ff call 0xff9081c9 1d: 48 8b 1b mov (%rbx),%rbx 20: 4c 01 f3 add %r14,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 86 08 00 00 jne 0x8bd 37: 44 0f b6 33 movzbl (%rbx),%r14d 3b: 44 89 f0 mov %r14d,%eax 3e: 44 rex.R 3f: 8b .byte 0x8b