general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 PID: 6247 Comm: segctord Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:nilfs_dat_commit_end+0x58/0x6b0 fs/nilfs2/dat.c:205
Code: 18 4c 89 f8 48 c1 e8 03 48 89 44 24 08 42 80 3c 28 00 74 08 4c 89 ff e8 06 6b 98 fe 4d 8b 37 49 83 c6 10 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 e9 6a 98 fe 4d 8b 36 bf 01 00 00
RSP: 0018:ffffc900032a7318 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888025184b18 RCX: ffff8880247a8000
RDX: 0000000000000000 RSI: ffff888025184b18 RDI: ffff8880734ea7c8
RBP: 0000000000000000 R08: ffff88805e27c82f R09: 1ffff1100bc4f905
R10: dffffc0000000000 R11: ffffed100bc4f906 R12: ffff8880734ea7c8
R13: dffffc0000000000 R14: 0000000000000010 R15: ffff888025184b30
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe36b11438 CR3: 000000007dcf6000 CR4: 00000000003506f0
Call Trace:
<TASK>
nilfs_dat_commit_update+0x28/0x40 fs/nilfs2/dat.c:261
nilfs_btree_commit_update_v+0x93/0x410 fs/nilfs2/btree.c:1958
nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2031 [inline]
nilfs_btree_propagate_v fs/nilfs2/btree.c:2064 [inline]
nilfs_btree_propagate+0x95e/0xcf0 fs/nilfs2/btree.c:2108
nilfs_bmap_propagate+0x74/0x120 fs/nilfs2/bmap.c:345
nilfs_collect_file_data+0x4f/0xd0 fs/nilfs2/segment.c:587
nilfs_segctor_apply_buffers+0x15d/0x320 fs/nilfs2/segment.c:1050
nilfs_segctor_scan_file+0x2a3/0x950 fs/nilfs2/segment.c:1089
nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1208 [inline]
nilfs_segctor_collect fs/nilfs2/segment.c:1535 [inline]
nilfs_segctor_do_construct+0x1b48/0x68a0 fs/nilfs2/segment.c:2091
nilfs_segctor_construct+0x17b/0x690 fs/nilfs2/segment.c:2454
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2562 [inline]
nilfs_segctor_thread+0x536/0x10d0 fs/nilfs2/segment.c:2646
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:nilfs_dat_commit_end+0x58/0x6b0 fs/nilfs2/dat.c:205
Code: 18 4c 89 f8 48 c1 e8 03 48 89 44 24 08 42 80 3c 28 00 74 08 4c 89 ff e8 06 6b 98 fe 4d 8b 37 49 83 c6 10 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 e9 6a 98 fe 4d 8b 36 bf 01 00 00
RSP: 0018:ffffc900032a7318 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888025184b18 RCX: ffff8880247a8000
RDX: 0000000000000000 RSI: ffff888025184b18 RDI: ffff8880734ea7c8
RBP: 0000000000000000 R08: ffff88805e27c82f R09: 1ffff1100bc4f905
----------------
Code disassembly (best guess):
0: 18 4c 89 f8 sbb %cl,-0x8(%rcx,%rcx,4)
4: 48 c1 e8 03 shr $0x3,%rax
8: 48 89 44 24 08 mov %rax,0x8(%rsp)
d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
12: 74 08 je 0x1c
14: 4c 89 ff mov %r15,%rdi
17: e8 06 6b 98 fe call 0xfe986b22
1c: 4d 8b 37 mov (%r15),%r14
1f: 49 83 c6 10 add $0x10,%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 e9 6a 98 fe call 0xfe986b22
39: 4d 8b 36 mov (%r14),%r14
3c: bf .byte 0xbf
3d: 01 00 add %eax,(%rax)