Oops: general protection fault, probably for non-canonical address 0xe3fffa2201ab07dd: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x1ffff1100d583ee8-0x1ffff1100d583eef]
CPU: 1 UID: 0 PID: 23281 Comm: syz.0.3817 Not tainted 6.10.0-rc7-next-20240710-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:__dev_flush+0x5b/0x160
Code: 48 89 ef e8 47 ec 3e 00 48 8b 5d 00 48 39 eb 0f 84 ff 00 00 00 48 89 2c 24 49 89 dd 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 48 89 df e8 15 ec 3e 00 48 8b 03 48 89 44
RSP: 0018:ffffc90000a18af0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 1ffff1100d583ee8 RCX: ffff888025d90000
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffffc90002ee7810
RBP: ffffc90002ee7810 R08: ffffffff896cfc2a R09: 1ffffffff1f5f87d
R10: dffffc0000000000 R11: fffffbfff1f5f87e R12: 0000000000000000
R13: 03fffe2201ab07dd R14: 0000000000000000 R15: ffffc90002ee7810
FS:  00007f3d058906c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6120234160 CR3: 00000000696fc000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 xdp_do_check_flushed+0x129/0x240 net/core/filter.c:4300
 __napi_poll+0xe4/0x490 net/core/dev.c:6774
 napi_poll net/core/dev.c:6840 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:6962
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:unwind_next_frame+0x193c/0x2a00 arch/x86/kernel/unwind_orc.c:641
Code: 42 0f b6 44 2d 00 84 c0 0f 85 61 0e 00 00 48 8b 44 24 20 c6 00 00 4c 8b 74 24 48 48 8b 6c 24 28 48 8b 44 24 38 42 0f b6 04 28 <84> c0 0f 85 ea 0b 00 00 48 8b 44 24 78 42 0f b6 04 28 84 c0 0f 85
RSP: 0018:ffffc90002ee6ea8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90002ee6fb8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90002ee6fe0
RBP: ffffffff903e73fa R08: ffffc90002ee6fdf R09: 0000000000000000
R10: ffffc90002ee6fd0 R11: fffff520005dcdfc R12: ffffc90002ee7578
R13: dffffc0000000000 R14: ffffc90002ee6fd0 R15: 1ffff920005dcdf0
 arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 save_stack+0xfb/0x1f0 mm/page_owner.c:156
 __set_page_owner+0x92/0x800 mm/page_owner.c:320
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493
 prep_new_page mm/page_alloc.c:1501 [inline]
 get_page_from_freelist+0x2ccb/0x2d80 mm/page_alloc.c:3480
 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4738
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
 folio_alloc_mpol_noprof+0x36/0x50 mm/mempolicy.c:2281
 shmem_alloc_folio mm/shmem.c:1726 [inline]
 shmem_alloc_and_add_folio+0x2ce/0x14e0 mm/shmem.c:1786
 shmem_get_folio_gfp+0x8dc/0x2370 mm/shmem.c:2192
 shmem_get_folio mm/shmem.c:2297 [inline]
 shmem_write_begin+0x170/0x4d0 mm/shmem.c:2902
 generic_perform_write+0x399/0x840 mm/filemap.c:4019
 shmem_file_write_iter+0xfc/0x120 mm/shmem.c:3078
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0xa72/0xc90 fs/read_write.c:590
 ksys_write+0x1a0/0x2c0 fs/read_write.c:643
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3d04b7475f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 8c 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 8c 02 00 48
RSP: 002b:00007f3d0588fe00 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007f3d04b7475f
RDX: 0000000001000000 RSI: 00007f3cfa800000 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000055b8
R10: 0000000000000002 R11: 0000000000000293 R12: 0000000000000008
R13: 00007f3d0588ff00 R14: 00007f3d0588fec0 R15: 00007f3cfa800000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__dev_flush+0x5b/0x160
Code: 48 89 ef e8 47 ec 3e 00 48 8b 5d 00 48 39 eb 0f 84 ff 00 00 00 48 89 2c 24 49 89 dd 49 c1 ed 03 48 b8 00 00 00 00 00 fc ff df <41> 80 7c 05 00 00 74 08 48 89 df e8 15 ec 3e 00 48 8b 03 48 89 44
RSP: 0018:ffffc90000a18af0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 1ffff1100d583ee8 RCX: ffff888025d90000
RDX: 0000000000000101 RSI: 0000000000000000 RDI: ffffc90002ee7810
RBP: ffffc90002ee7810 R08: ffffffff896cfc2a R09: 1ffffffff1f5f87d
R10: dffffc0000000000 R11: fffffbfff1f5f87e R12: 0000000000000000
R13: 03fffe2201ab07dd R14: 0000000000000000 R15: ffffc90002ee7810
FS:  00007f3d058906c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6120234160 CR3: 00000000696fc000 CR4: 00000000003506f0
----------------
Code disassembly (best guess):
   0:	48 89 ef             	mov    %rbp,%rdi
   3:	e8 47 ec 3e 00       	call   0x3eec4f
   8:	48 8b 5d 00          	mov    0x0(%rbp),%rbx
   c:	48 39 eb             	cmp    %rbp,%rbx
   f:	0f 84 ff 00 00 00    	je     0x114
  15:	48 89 2c 24          	mov    %rbp,(%rsp)
  19:	49 89 dd             	mov    %rbx,%r13
  1c:	49 c1 ed 03          	shr    $0x3,%r13
  20:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  27:	fc ff df
* 2a:	41 80 7c 05 00 00    	cmpb   $0x0,0x0(%r13,%rax,1) <-- trapping instruction
  30:	74 08                	je     0x3a
  32:	48 89 df             	mov    %rbx,%rdi
  35:	e8 15 ec 3e 00       	call   0x3eec4f
  3a:	48 8b 03             	mov    (%rbx),%rax
  3d:	48                   	rex.W
  3e:	89                   	.byte 0x89
  3f:	44                   	rex.R