general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 5.19.0-syzkaller-02972-g200e340f2196 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
RIP: 0010:relay_switch_subbuf+0x2c2/0x6b0
Code: 49 8b 1f 48 83 c3 50 eb 10 e8 6a f0 fe ff 49 8d 9d d8 00 00 00 4c 8b 24 24 48 89 d8 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df <42> 80 3c 38 00 74 08 48 89 df e8 ff bb 51 00 4c 01 33 f0 83 44 24
RSP: 0018:ffffc90000147800 EFLAGS: 00010006
RAX: 000000000000000a RBX: 0000000000000050 RCX: dffffc0000000000
RDX: 0000000080000103 RSI: 000000000000008a RDI: ffff88803b727ac8
RBP: ffff8880172cec08 R08: ffffffff81892e5a R09: 0000000000000000
R10: fffff520030c5a10 R11: 1ffff920030c5a0e R12: ffff88803b727a28
R13: ffff88803b727a00 R14: 0000000000000078 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33722000 CR3: 0000000030b49000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 relay_reserve include/linux/relay.h:248 [inline]
 trace_note+0x54b/0x6f0 kernel/trace/blktrace.c:95
 trace_note_tsk+0xb9/0x150 kernel/trace/blktrace.c:126
 __blk_add_trace+0x9ef/0xd60 kernel/trace/blktrace.c:268
 blk_add_trace_rq+0x2ab/0x2e0 kernel/trace/blktrace.c:846
 trace_block_rq_complete+0x22a/0x280 include/trace/events/block.h:147
 blk_update_request+0x36/0x1040 block/blk-mq.c:795
 blk_mq_end_request+0x39/0x70 block/blk-mq.c:951
 blk_complete_reqs block/blk-mq.c:1022 [inline]
 blk_done_softirq+0x119/0x160 block/blk-mq.c:1027
 __do_softirq+0x382/0x793 kernel/softirq.c:571
 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934
 smpboot_thread_fn+0x533/0x9d0 kernel/smpboot.c:164
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:relay_switch_subbuf+0x2c2/0x6b0
Code: 49 8b 1f 48 83 c3 50 eb 10 e8 6a f0 fe ff 49 8d 9d d8 00 00 00 4c 8b 24 24 48 89 d8 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df <42> 80 3c 38 00 74 08 48 89 df e8 ff bb 51 00 4c 01 33 f0 83 44 24
RSP: 0018:ffffc90000147800 EFLAGS: 00010006
RAX: 000000000000000a RBX: 0000000000000050 RCX: dffffc0000000000
RDX: 0000000080000103 RSI: 000000000000008a RDI: ffff88803b727ac8
RBP: ffff8880172cec08 R08: ffffffff81892e5a R09: 0000000000000000
R10: fffff520030c5a10 R11: 1ffff920030c5a0e R12: ffff88803b727a28
R13: ffff88803b727a00 R14: 0000000000000078 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33722000 CR3: 0000000030b49000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	49 8b 1f             	mov    (%r15),%rbx
   3:	48 83 c3 50          	add    $0x50,%rbx
   7:	eb 10                	jmp    0x19
   9:	e8 6a f0 fe ff       	callq  0xfffef078
   e:	49 8d 9d d8 00 00 00 	lea    0xd8(%r13),%rbx
  15:	4c 8b 24 24          	mov    (%rsp),%r12
  19:	48 89 d8             	mov    %rbx,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
  27:	fc ff df
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 ff bb 51 00       	callq  0x51bc38
  39:	4c 01 33             	add    %r14,(%rbx)
  3c:	f0                   	lock
  3d:	83                   	.byte 0x83
  3e:	44                   	rex.R
  3f:	24                   	.byte 0x24