EXT4-fs (loop2): mounted filesystem 00000007-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
BUG: kernel NULL pointer dereference, address: 0000000000000000
BUG: unable to handle page fault for address: ffffc900036f0000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 15800067 P4D 15800067 PUD 166e7067 PMD 1f862067 PTE 0
Thread overran stack, or stack corrupted
Oops: Oops: 0002 [#1] PREEMPT SMP KASAN PTI
CPU: 0 UID: 0 PID: 5491 Comm: syz.2.43 Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:number+0x85b/0xf90 lib/vsprintf.c:551
Code: 4b 8d 5c 37 02 48 3b 5c 24 10 73 22 e8 fe ef de f5 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 8e 00 00 00 48 8b 44 24 38 <88> 03 eb 05 e8 dc ef de f5 4b 8d 5c 37 03 48 3b 5c 24 10 73 1e e8
RSP: 0018:ffffc900036ec480 EFLAGS: 00010086
RAX: 00000000ffff1030 RBX: ffffc900036f0000 RCX: ffffffff8bb4d169
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffc900036f0000
RBP: ffffc900036ec590 R08: ffffffff8bb4d01f R09: 0000000000000000
R10: ffffc900036ec500 R11: fffff520006dd8a3 R12: 0000000000000003
R13: dffffc0000000000 R14: 00000000000035ec R15: ffffc900036eca12
FS: 00007fa69b54d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900036f0000 CR3: 000000002a90a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
pointer_string lib/vsprintf.c:742 [inline]
pointer+0x422/0x1210 lib/vsprintf.c:2490
</TASK>
Modules linked in:
CR2: ffffc900036f0000
---[ end trace 0000000000000000 ]---
RIP: 0010:number+0x85b/0xf90 lib/vsprintf.c:551
Code: 4b 8d 5c 37 02 48 3b 5c 24 10 73 22 e8 fe ef de f5 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 8e 00 00 00 48 8b 44 24 38 <88> 03 eb 05 e8 dc ef de f5 4b 8d 5c 37 03 48 3b 5c 24 10 73 1e e8
RSP: 0018:ffffc900036ec480 EFLAGS: 00010086
RAX: 00000000ffff1030 RBX: ffffc900036f0000 RCX: ffffffff8bb4d169
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffffc900036f0000
RBP: ffffc900036ec590 R08: ffffffff8bb4d01f R09: 0000000000000000
R10: ffffc900036ec500 R11: fffff520006dd8a3 R12: 0000000000000003
R13: dffffc0000000000 R14: 00000000000035ec R15: ffffc900036eca12
FS: 00007fa69b54d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900036f0000 CR3: 000000002a90a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 4b 8d 5c 37 02 lea 0x2(%r15,%r14,1),%rbx
5: 48 3b 5c 24 10 cmp 0x10(%rsp),%rbx
a: 73 22 jae 0x2e
c: e8 fe ef de f5 call 0xf5def00f
11: 48 89 d8 mov %rbx,%rax
14: 48 c1 e8 03 shr $0x3,%rax
18: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax
1d: 84 c0 test %al,%al
1f: 0f 85 8e 00 00 00 jne 0xb3
25: 48 8b 44 24 38 mov 0x38(%rsp),%rax
* 2a: 88 03 mov %al,(%rbx) <-- trapping instruction
2c: eb 05 jmp 0x33
2e: e8 dc ef de f5 call 0xf5def00f
33: 4b 8d 5c 37 03 lea 0x3(%r15,%r14,1),%rbx
38: 48 3b 5c 24 10 cmp 0x10(%rsp),%rbx
3d: 73 1e jae 0x5d
3f: e8 .byte 0xe8