BUG: unable to handle page fault for address: fffffbfff920008f
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 23ffe4067 P4D 23ffe4067 PUD 23ffe3067 PMD 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 6115 Comm: syz.1.37 Not tainted 6.14.0-syzkaller-10514-g7f2ff7b62617 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline]
RIP: 0010:rcu_segcblist_advance+0x69/0x3f0 kernel/rcu/rcu_segcblist.c:474
Code: 84 81 03 00 00 4c 8d 73 08 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 91 f4 80 00 49 8b 2e 48 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 ef e8 78 f4 80 00 48 83 7d 00 00 0f 84
RSP: 0018:ffffc900047a7518 EFLAGS: 00010012
RAX: 1ffffffff920008f RBX: ffffe8ffffc78240 RCX: 36284c9e74c51400
RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc78240
RBP: ffffffffc900047a R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffe70
R13: 1ffffd1ffff8f049 R14: ffffe8ffffc78248 R15: dffffc0000000000
FS: 00007fc8570196c0(0000) GS:ffff888124fb7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff920008f CR3: 00000000445ce000 CR4: 0000000000350ef0
Call Trace:
<TASK>
srcu_gp_start_if_needed+0x71d/0x12a0 kernel/rcu/srcutree.c:1316
__call_srcu kernel/rcu/srcutree.c:1389 [inline]
__synchronize_srcu+0x370/0x420 kernel/rcu/srcutree.c:1441
bch2_fs_btree_iter_exit+0x3e8/0x480 fs/bcachefs/btree_iter.c:3619
__bch2_fs_free fs/bcachefs/super.c:568 [inline]
bch2_fs_release+0x230/0x7d0 fs/bcachefs/super.c:621
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x231/0x480 lib/kobject.c:737
deactivate_locked_super+0xc6/0x130 fs/super.c:473
bch2_fs_get_tree+0xd41/0x18d0 fs/bcachefs/fs.c:2294
vfs_get_tree+0x92/0x2b0 fs/super.c:1759
do_new_mount+0x2cf/0xb70 fs/namespace.c:3878
do_mount fs/namespace.c:4218 [inline]
__do_sys_mount fs/namespace.c:4429 [inline]
__se_sys_mount+0x38c/0x400 fs/namespace.c:4406
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc85618e90a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc857018e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fc857018ef0 RCX: 00007fc85618e90a
RDX: 00002000000000c0 RSI: 0000200000000040 RDI: 00007fc857018eb0
RBP: 00002000000000c0 R08: 00007fc857018ef0 R09: 0000000000a08042
R10: 0000000000a08042 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fc857018eb0 R14: 0000000000005927 R15: 0000200000000200
</TASK>
Modules linked in:
CR2: fffffbfff920008f
---[ end trace 0000000000000000 ]---
RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline]
RIP: 0010:rcu_segcblist_advance+0x69/0x3f0 kernel/rcu/rcu_segcblist.c:474
Code: 84 81 03 00 00 4c 8d 73 08 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 91 f4 80 00 49 8b 2e 48 89 e8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 ef e8 78 f4 80 00 48 83 7d 00 00 0f 84
RSP: 0018:ffffc900047a7518 EFLAGS: 00010012
RAX: 1ffffffff920008f RBX: ffffe8ffffc78240 RCX: 36284c9e74c51400
RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc78240
RBP: ffffffffc900047a R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: fffffffffffffe70
R13: 1ffffd1ffff8f049 R14: ffffe8ffffc78248 R15: dffffc0000000000
FS: 00007fc8570196c0(0000) GS:ffff888124fb7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffbfff920008f CR3: 00000000445ce000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 84 81 03 00 00 4c test %al,0x4c000003(%rcx)
6: 8d 73 08 lea 0x8(%rbx),%esi
9: 4d 89 f5 mov %r14,%r13
c: 49 c1 ed 03 shr $0x3,%r13
10: 43 80 7c 3d 00 00 cmpb $0x0,0x0(%r13,%r15,1)
16: 74 08 je 0x20
18: 4c 89 f7 mov %r14,%rdi
1b: e8 91 f4 80 00 call 0x80f4b1
20: 49 8b 2e mov (%r14),%rbp
23: 48 89 e8 mov %rbp,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 ef mov %rbp,%rdi
34: e8 78 f4 80 00 call 0x80f4b1
39: 48 83 7d 00 00 cmpq $0x0,0x0(%rbp)
3e: 0f .byte 0xf
3f: 84 .byte 0x84