BUG: unable to handle kernel NULL pointer dereference in ext4_mb_add

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	BUG: unable to handle kernel NULL pointer dereference in ext4_mb_add_groupinfo ext4				2	144d	161d	0/28	auto-obsoleted due to no activity on 2024/09/24 01:48
EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode
BUG: kernel NULL pointer dereference, address: 000000000000000b
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 8000000026b5e067 P4D 8000000026b5e067 PUD 533fd067 PMD 0 
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 6160 Comm: syz.0.34 Not tainted 6.12.0-rc6-syzkaller-00192-gf1dce1f09380 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:PageTail include/linux/page-flags.h:281 [inline]
RIP: 0010:const_folio_flags include/linux/page-flags.h:309 [inline]
RIP: 0010:folio_test_active include/linux/page-flags.h:518 [inline]
RIP: 0010:slab_test_pfmemalloc mm/slab.h:171 [inline]
RIP: 0010:pfmemalloc_match mm/slub.c:3550 [inline]
RIP: 0010:___slab_alloc+0x1f4/0x14b0 mm/slub.c:3691
Code: f7 44 24 60 00 02 00 00 44 8b 74 24 10 0f 85 59 06 00 00 41 f7 c5 00 02 00 00 4c 8b 3c 24 0f 84 5c fe ff ff fb e9 56 fe ff ff <49> 8b 44 24 08 a8 01 0f 85 d6 07 00 00 0f 1f 44 00 00 49 f7 04 24
RSP: 0018:ffffc9000501f6d8 EFLAGS: 00010246
RAX: 717b3d8d7e7ae100 RBX: 00000000ffffffff RCX: ffffffff825fe9e3
RDX: 00000000ffffffff RSI: 0000000000000d40 RDI: ffff888078f81500
RBP: ffff888078f81500 R08: ffffe8ffffc68140 R09: 0000000000000120
R10: dffffc0000000000 R11: fffffbfff2037bb6 R12: 0000000000000003
R13: 0000000000000d40 R14: 00000000ffffffff R15: ffff888078f81500
FS:  00007f69d7bf66c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000000b CR3: 0000000012b7e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __slab_alloc+0x58/0xa0 mm/slub.c:3908
 __slab_alloc_node mm/slub.c:3961 [inline]
 slab_alloc_node mm/slub.c:4122 [inline]
 kmem_cache_alloc_noprof+0x1c1/0x2a0 mm/slub.c:4141
 ext4_mb_add_groupinfo+0x6c3/0xfa0 fs/ext4/mballoc.c:3356
 ext4_mb_init_backend fs/ext4/mballoc.c:3435 [inline]
 ext4_mb_init+0x15ab/0x27e0 fs/ext4/mballoc.c:3733
 __ext4_fill_super fs/ext4/super.c:5512 [inline]
 ext4_fill_super+0x5f4c/0x6e60 fs/ext4/super.c:5686
 get_tree_bdev_flags+0x48c/0x5c0 fs/super.c:1636
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4057 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f69d977feba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f69d7bf5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f69d7bf5ef0 RCX: 00007f69d977feba
RDX: 0000000020000040 RSI: 0000000020000180 RDI: 00007f69d7bf5eb0
RBP: 0000000020000040 R08: 00007f69d7bf5ef0 R09: 000000000001000e
R10: 000000000001000e R11: 0000000000000246 R12: 0000000020000180
R13: 00007f69d7bf5eb0 R14: 0000000000000445 R15: 0000000020000300
 </TASK>
Modules linked in:
CR2: 000000000000000b
---[ end trace 0000000000000000 ]---
RIP: 0010:PageTail include/linux/page-flags.h:281 [inline]
RIP: 0010:const_folio_flags include/linux/page-flags.h:309 [inline]
RIP: 0010:folio_test_active include/linux/page-flags.h:518 [inline]
RIP: 0010:slab_test_pfmemalloc mm/slab.h:171 [inline]
RIP: 0010:pfmemalloc_match mm/slub.c:3550 [inline]
RIP: 0010:___slab_alloc+0x1f4/0x14b0 mm/slub.c:3691
Code: f7 44 24 60 00 02 00 00 44 8b 74 24 10 0f 85 59 06 00 00 41 f7 c5 00 02 00 00 4c 8b 3c 24 0f 84 5c fe ff ff fb e9 56 fe ff ff <49> 8b 44 24 08 a8 01 0f 85 d6 07 00 00 0f 1f 44 00 00 49 f7 04 24
RSP: 0018:ffffc9000501f6d8 EFLAGS: 00010246
RAX: 717b3d8d7e7ae100 RBX: 00000000ffffffff RCX: ffffffff825fe9e3
RDX: 00000000ffffffff RSI: 0000000000000d40 RDI: ffff888078f81500
RBP: ffff888078f81500 R08: ffffe8ffffc68140 R09: 0000000000000120
R10: dffffc0000000000 R11: fffffbfff2037bb6 R12: 0000000000000003
R13: 0000000000000d40 R14: 00000000ffffffff R15: ffff888078f81500
FS:  00007f69d7bf66c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000000b CR3: 0000000012b7e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	f7 44 24 60 00 02 00 	testl  $0x200,0x60(%rsp)
   7:	00
   8:	44 8b 74 24 10       	mov    0x10(%rsp),%r14d
   d:	0f 85 59 06 00 00    	jne    0x66c
  13:	41 f7 c5 00 02 00 00 	test   $0x200,%r13d
  1a:	4c 8b 3c 24          	mov    (%rsp),%r15
  1e:	0f 84 5c fe ff ff    	je     0xfffffe80
  24:	fb                   	sti
  25:	e9 56 fe ff ff       	jmp    0xfffffe80
* 2a:	49 8b 44 24 08       	mov    0x8(%r12),%rax <-- trapping instruction
  2f:	a8 01                	test   $0x1,%al
  31:	0f 85 d6 07 00 00    	jne    0x80d
  37:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  3c:	49                   	rex.WB
  3d:	f7                   	.byte 0xf7
  3e:	04 24                	add    $0x24,%al