Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 0 UID: 0 PID: 20535 Comm: kworker/u8:9 Not tainted 6.11.0-rc7-syzkaller-00021-g7c6a3a65ace7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: loop1 loop_workfn
RIP: 0010:vfs_iter_write+0x39/0x610 fs/read_write.c:879
Code: 83 ec 20 89 4c 24 14 49 89 d4 49 89 f6 49 89 ff 48 bd 00 00 00 00 00 fc ff df e8 42 52 87 ff 4d 8d 6f 50 4c 89 eb 48 c1 eb 03 <0f> b6 04 2b 84 c0 0f 85 13 05 00 00 41 8b 6d 00 89 ee 83 e6 02 31
RSP: 0018:ffffc90003e8f6a8 EFLAGS: 00010216
RAX: ffffffff820c3a6e RBX: 000000000000000a RCX: ffff88805fc7bc00
RDX: 0000000000000000 RSI: ffffc90003e8f8f0 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff84b0f54e R09: ffffc90003e8f8f0
R10: dffffc0000000000 R11: fffff520007d1f23 R12: ffffc90003e8f940
R13: 0000000000000050 R14: ffffc90003e8f8f0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b9a2163a9 CR3: 0000000059f32000 CR4: 0000000000350ef0
Call Trace:
<TASK>
lo_write_bvec drivers/block/loop.c:243 [inline]
lo_write_simple drivers/block/loop.c:264 [inline]
do_req_filebacked drivers/block/loop.c:511 [inline]
loop_handle_cmd drivers/block/loop.c:1910 [inline]
loop_process_work+0x143b/0x2180 drivers/block/loop.c:1945
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0xa2e/0x1830 kernel/workqueue.c:3312
worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_iter_write+0x39/0x610 fs/read_write.c:879
Code: 83 ec 20 89 4c 24 14 49 89 d4 49 89 f6 49 89 ff 48 bd 00 00 00 00 00 fc ff df e8 42 52 87 ff 4d 8d 6f 50 4c 89 eb 48 c1 eb 03 <0f> b6 04 2b 84 c0 0f 85 13 05 00 00 41 8b 6d 00 89 ee 83 e6 02 31
RSP: 0018:ffffc90003e8f6a8 EFLAGS: 00010216
RAX: ffffffff820c3a6e RBX: 000000000000000a RCX: ffff88805fc7bc00
RDX: 0000000000000000 RSI: ffffc90003e8f8f0 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff84b0f54e R09: ffffc90003e8f8f0
R10: dffffc0000000000 R11: fffff520007d1f23 R12: ffffc90003e8f940
R13: 0000000000000050 R14: ffffc90003e8f8f0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b904376058 CR3: 0000000053092000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 83 ec 20 sub $0x20,%esp
3: 89 4c 24 14 mov %ecx,0x14(%rsp)
7: 49 89 d4 mov %rdx,%r12
a: 49 89 f6 mov %rsi,%r14
d: 49 89 ff mov %rdi,%r15
10: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
17: fc ff df
1a: e8 42 52 87 ff call 0xff875261
1f: 4d 8d 6f 50 lea 0x50(%r15),%r13
23: 4c 89 eb mov %r13,%rbx
26: 48 c1 eb 03 shr $0x3,%rbx
* 2a: 0f b6 04 2b movzbl (%rbx,%rbp,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 13 05 00 00 jne 0x549
36: 41 8b 6d 00 mov 0x0(%r13),%ebp
3a: 89 ee mov %ebp,%esi
3c: 83 e6 02 and $0x2,%esi
3f: 31 .byte 0x31