syzbot

general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 0 PID: 6368 Comm: syz-executor Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:gfs2_remove_from_journal+0x3ac/0x680 fs/gfs2/meta_io.c:351
Code: e1 80 e1 07 80 c1 03 38 c1 7c 2c 4c 89 e7 e8 ab 2c 56 fe eb 22 e8 24 bf 10 fe 4c 8b 7c 24 10 4d 8d 67 2c 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 8b 01 00 00 41 ff 04 24 49 8d 7f 18 be
RSP: 0018:ffffc90002dff6e8 EFLAGS: 00010207
RAX: 0000000000000005 RBX: ffff888057151740 RCX: ffff888059630000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed100ef4d1e1
R10: ffffed100ef4d1e1 R11: 1ffff1100ef4d1e0 R12: 000000000000002c
R13: dffffc0000000000 R14: ffff888077a68000 R15: 0000000000000000
FS:  0000555573f55500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055597e499950 CR3: 00000000659d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 gfs2_discard fs/gfs2/aops.c:660 [inline]
 gfs2_invalidatepage+0x644/0x830 fs/gfs2/aops.c:693
 do_invalidatepage mm/truncate.c:157 [inline]
 truncate_cleanup_page+0x170/0x420 mm/truncate.c:176
 truncate_inode_pages_range+0x236/0xef0 mm/truncate.c:325
 gfs2_evict_inode+0xa81/0x11f0 fs/gfs2/super.c:1415
 evict+0x485/0x870 fs/inode.c:647
 gfs2_put_super+0x2fe/0x7d0 fs/gfs2/super.c:603
 generic_shutdown_super+0x130/0x300 fs/super.c:475
 kill_block_super+0x7c/0xe0 fs/super.c:1427
 deactivate_locked_super+0x93/0xf0 fs/super.c:335
 cleanup_mnt+0x418/0x4d0 fs/namespace.c:1143
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f94ff49fc97
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007fffbce54c68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f94ff52089d RCX: 00007f94ff49fc97
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fffbce54d20
RBP: 00007fffbce54d20 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fffbce55db0
R13: 00007f94ff52089d R14: 0000000000032757 R15: 00007fffbce55df0
 </TASK>
Modules linked in:
---[ end trace 1324c16f80f6d6bf ]---
RIP: 0010:gfs2_remove_from_journal+0x3ac/0x680 fs/gfs2/meta_io.c:351
Code: e1 80 e1 07 80 c1 03 38 c1 7c 2c 4c 89 e7 e8 ab 2c 56 fe eb 22 e8 24 bf 10 fe 4c 8b 7c 24 10 4d 8d 67 2c 4c 89 e0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 8b 01 00 00 41 ff 04 24 49 8d 7f 18 be
RSP: 0018:ffffc90002dff6e8 EFLAGS: 00010207
RAX: 0000000000000005 RBX: ffff888057151740 RCX: ffff888059630000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed100ef4d1e1
R10: ffffed100ef4d1e1 R11: 1ffff1100ef4d1e0 R12: 000000000000002c
R13: dffffc0000000000 R14: ffff888077a68000 R15: 0000000000000000
FS:  0000555573f55500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055597e499950 CR3: 00000000659d6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	e1 80                	loope  0xffffff82
   2:	e1 07                	loope  0xb
   4:	80 c1 03             	add    $0x3,%cl
   7:	38 c1                	cmp    %al,%cl
   9:	7c 2c                	jl     0x37
   b:	4c 89 e7             	mov    %r12,%rdi
   e:	e8 ab 2c 56 fe       	call   0xfe562cbe
  13:	eb 22                	jmp    0x37
  15:	e8 24 bf 10 fe       	call   0xfe10bf3e
  1a:	4c 8b 7c 24 10       	mov    0x10(%rsp),%r15
  1f:	4d 8d 67 2c          	lea    0x2c(%r15),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 0f b6 04 28       	movzbl (%rax,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 8b 01 00 00    	jne    0x1c2
  37:	41 ff 04 24          	incl   (%r12)
  3b:	49 8d 7f 18          	lea    0x18(%r15),%rdi
  3f:	be                   	.byte 0xbe