general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2058 [inline]
RIP: 0010:f2fs_in_warm_node_list+0x4b/0x1b0 fs/f2fs/node.c:315
Code: 81 c6 d0 00 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 13 bb 8d ff 4d 8b 36 49 83 c6 30 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 f6 ba 8d ff 4d 8b 26 4c 8d 73 18
RSP: 0018:ffffc90000007cb8 EFLAGS: 00010206
RAX: 0000000000000006 RBX: ffffea0004d7c480 RCX: ffff888100326540
RDX: 0000000000000100 RSI: ffffea0004d7c480 RDI: ffff88814262c000
RBP: ffffc90000007cd8 R08: ffffffff8792e0af R09: 1ffffffff0f25c15
R10: dffffc0000000000 R11: fffffbfff0f25c16 R12: ffff88814da39bb8
R13: ffffea0004d7c480 R14: 0000000000000030 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd6ada86ff8 CR3: 000000012adba000 CR4: 00000000003526b0
DR0: 0000000000000004 DR1: 0000000000000010 DR2: 000000007fffdffd
DR3: 0000000000001000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
f2fs_write_end_io+0x53a/0xb30 fs/f2fs/data.c:382
bio_endio+0x6eb/0x7e0 block/bio.c:1557
req_bio_endio block/blk-mq.c:788 [inline]
blk_update_request+0x4b1/0xe20 block/blk-mq.c:933
blk_mq_end_request+0x41/0x80 block/blk-mq.c:1058
lo_complete_rq+0x131/0x250 drivers/block/loop.c:365
blk_complete_reqs block/blk-mq.c:1138 [inline]
blk_done_softirq+0x116/0x160 block/blk-mq.c:1143
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
common_interrupt+0xbe/0xe0 arch/x86/kernel/irq.c:242
</IRQ>
<TASK>
asm_common_interrupt+0x27/0x40 arch/x86/include/asm/idtentry.h:682
RIP: 0010:finish_task_switch+0x173/0x7c0 kernel/sched/core.c:5302
Code: 80 3c 2b 00 74 08 4c 89 f7 e8 99 8a 69 00 4d 8b 2e 4d 85 ed 0f 85 cd 00 00 00 4c 89 e7 e8 45 98 b3 03 fb 49 8d 9f 48 0b 00 00 <48> 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 0f b6 04 28
RSP: 0018:ffffc900000d7d08 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff888100327088 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff85ca66c0 RDI: 00000000ffffffff
RBP: ffffc900000d7d50 R08: ffff8881149b8007 R09: 1ffff11022937000
R10: dffffc0000000000 R11: ffffed1022937001 R12: ffff8881f6e37d80
R13: 0000000000000000 R14: ffff8881f6e388e0 R15: ffff888100326540
context_switch kernel/sched/core.c:5428 [inline]
__schedule+0xbea/0x14b0 kernel/sched/core.c:6755
schedule+0xbd/0x170 kernel/sched/core.c:6831
smpboot_thread_fn+0x527/0x8e0 kernel/smpboot.c:160
kthread+0x281/0x320 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:2058 [inline]
RIP: 0010:f2fs_in_warm_node_list+0x4b/0x1b0 fs/f2fs/node.c:315
Code: 81 c6 d0 00 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 13 bb 8d ff 4d 8b 36 49 83 c6 30 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 f6 ba 8d ff 4d 8b 26 4c 8d 73 18
RSP: 0018:ffffc90000007cb8 EFLAGS: 00010206
RAX: 0000000000000006 RBX: ffffea0004d7c480 RCX: ffff888100326540
RDX: 0000000000000100 RSI: ffffea0004d7c480 RDI: ffff88814262c000
RBP: ffffc90000007cd8 R08: ffffffff8792e0af R09: 1ffffffff0f25c15
R10: dffffc0000000000 R11: fffffbfff0f25c16 R12: ffff88814da39bb8
R13: ffffea0004d7c480 R14: 0000000000000030 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd6ada86ff8 CR3: 000000012adba000 CR4: 00000000003526b0
DR0: 0000000000000004 DR1: 0000000000000010 DR2: 000000007fffdffd
DR3: 0000000000001000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 81 c6 d0 00 00 00 add $0xd0,%esi
6: 4c 89 f0 mov %r14,%rax
9: 48 c1 e8 03 shr $0x3,%rax
d: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
12: 74 08 je 0x1c
14: 4c 89 f7 mov %r14,%rdi
17: e8 13 bb 8d ff call 0xff8dbb2f
1c: 4d 8b 36 mov (%r14),%r14
1f: 49 83 c6 30 add $0x30,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 f6 ba 8d ff call 0xff8dbb2f
39: 4d 8b 26 mov (%r14),%r12
3c: 4c 8d 73 18 lea 0x18(%rbx),%r14