general protection fault, probably for non-canonical address 0xdffffc0000000007: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f]
CPU: 1 PID: 4943 Comm: syz-executor.0 Not tainted 6.3.0-syzkaller-00436-g173ea743bf7a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline]
RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063
Code: 89 c6 e8 ba 80 87 fd 85 db 58 0f 85 8f 00 00 00 e8 5c 84 87 fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4
RSP: 0018:ffffc90005647010 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90003e71000
RDX: 0000000000000007 RSI: ffffffff83fba234 RDI: 0000000000000038
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffb064f8
R13: ffff88802aeae800 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0063) knlGS:00000000f7f32b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002c024000 CR3: 000000001c7ff000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
submit_bio_noacct_nocheck+0x7e/0xb90 block/blk-core.c:687
submit_bio_noacct+0x952/0x1a30 block/blk-core.c:807
submit_bio block/blk-core.c:843 [inline]
submit_bio+0x8f/0x1c0 block/blk-core.c:831
mpage_bio_submit fs/mpage.c:64 [inline]
mpage_readahead+0x41c/0x580 fs/mpage.c:359
read_pages+0x1a2/0xd40 mm/readahead.c:161
page_cache_ra_unbounded+0x477/0x5e0 mm/readahead.c:270
do_page_cache_ra mm/readahead.c:300 [inline]
page_cache_ra_order+0x6ec/0xa00 mm/readahead.c:560
ondemand_readahead+0x6b3/0x1080 mm/readahead.c:682
page_cache_sync_ra+0x1c9/0x200 mm/readahead.c:709
page_cache_sync_readahead include/linux/pagemap.h:1208 [inline]
filemap_get_pages+0x28d/0x1620 mm/filemap.c:2598
filemap_read+0x35e/0xc70 mm/filemap.c:2693
blkdev_read_iter+0x3eb/0x760 block/fops.c:606
call_read_iter include/linux/fs.h:1845 [inline]
generic_file_splice_read+0x182/0x4b0 fs/splice.c:403
do_splice_to+0x1b9/0x240 fs/splice.c:886
splice_direct_to_actor+0x2ab/0x8a0 fs/splice.c:957
do_splice_direct+0x1ab/0x280 fs/splice.c:1066
do_sendfile+0xb19/0x12c0 fs/read_write.c:1254
__do_compat_sys_sendfile fs/read_write.c:1343 [inline]
__se_compat_sys_sendfile fs/read_write.c:1326 [inline]
__ia32_compat_sys_sendfile+0x1e1/0x220 fs/read_write.c:1326
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f37579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7f325cc EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000000004
RDX: 0000000000000000 RSI: 000000000008a002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ref_is_percpu include/linux/percpu-refcount.h:174 [inline]
RIP: 0010:percpu_ref_get_many include/linux/percpu-refcount.h:204 [inline]
RIP: 0010:percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
RIP: 0010:blk_cgroup_bio_start+0x469/0x770 block/blk-cgroup.c:2063
Code: 89 c6 e8 ba 80 87 fd 85 db 58 0f 85 8f 00 00 00 e8 5c 84 87 fd 48 8d 7d 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 dd 02 00 00 48 8b 5d 38 31 ff 49 89 dc 41 83 e4
RSP: 0018:ffffc90005647010 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc90003e71000
RDX: 0000000000000007 RSI: ffffffff83fba234 RDI: 0000000000000038
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000094001 R12: ffffe8ffffb064f8
R13: ffff88802aeae800 R14: 0000000000000001 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0063) knlGS:00000000f7f32b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002c024000 CR3: 000000001c7ff000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 c6 mov %eax,%esi
2: e8 ba 80 87 fd callq 0xfd8780c1
7: 85 db test %ebx,%ebx
9: 58 pop %rax
a: 0f 85 8f 00 00 00 jne 0x9f
10: e8 5c 84 87 fd callq 0xfd878471
15: 48 8d 7d 38 lea 0x38(%rbp),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 dd 02 00 00 jne 0x311
34: 48 8b 5d 38 mov 0x38(%rbp),%rbx
38: 31 ff xor %edi,%edi
3a: 49 89 dc mov %rbx,%r12
3d: 41 rex.B
3e: 83 .byte 0x83
3f: e4 .byte 0xe4