======================================================= general protection fault, probably for non-canonical address 0x5088000000fff: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 5013 Comm: syz-executor676 Not tainted 6.5.0-rc5-syzkaller-00021-ga027b2eca0b7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 RIP: 0010:memcpy_orig+0x105/0x120 arch/x86/lib/memcpy_64.S:160 Code: 00 00 00 00 00 83 fa 04 72 1b 8b 0e 44 8b 44 16 fc 89 0f 44 89 44 17 fc c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 83 ea 01 72 19 <0f> b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 44 88 47 01 44 88 0c RSP: 0018:ffffc900033bf0e8 EFLAGS: 00010246 RAX: ffffc900033bf1a8 RBX: ffff88802089e680 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0005088000000fff RDI: ffffc900033bf1a8 RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000001000 R10: 0000000000001000 R11: ffffffff81d826e5 R12: 0000000000000fff R13: 0000000000001000 R14: 0000000000000001 R15: 0000000000000001 FS: 0000555555f72380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffca307d000 CR3: 000000007dab8000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: memcpy_from_page include/linux/highmem.h:417 [inline] hfsplus_bnode_read+0x101/0x250 fs/hfsplus/bnode.c:32 hfsplus_bnode_read_u16 fs/hfsplus/bnode.c:45 [inline] hfsplus_bnode_find+0x85c/0xcb0 fs/hfsplus/bnode.c:522 hfsplus_bmap_alloc+0x10a/0x830 fs/hfsplus/btree.c:390 hfs_btree_inc_height.isra.0+0x100/0x8b0 fs/hfsplus/brec.c:475 hfsplus_brec_insert+0x9fe/0xc50 fs/hfsplus/brec.c:75 __hfsplus_ext_write_extent+0x49c/0x5e0 fs/hfsplus/extents.c:107 __hfsplus_ext_cache_extent fs/hfsplus/extents.c:186 [inline] hfsplus_ext_read_extent+0x84c/0xb00 fs/hfsplus/extents.c:218 hfsplus_file_extend+0x699/0xf90 fs/hfsplus/extents.c:461 hfsplus_get_block+0x1ae/0x9e0 fs/hfsplus/extents.c:245 __block_write_begin_int+0x3c0/0x1470 fs/buffer.c:2128 __block_write_begin fs/buffer.c:2178 [inline] block_write_begin+0xb1/0x490 fs/buffer.c:2239 cont_write_begin+0x52f/0x730 fs/buffer.c:2597 hfsplus_write_begin+0x87/0x140 fs/hfsplus/inode.c:52 cont_expand_zero fs/buffer.c:2524 [inline] cont_write_begin+0x336/0x730 fs/buffer.c:2587 hfsplus_write_begin+0x87/0x140 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x11f/0x200 fs/buffer.c:2488 hfsplus_setattr+0x193/0x310 fs/hfsplus/inode.c:263 notify_change+0x670/0x1160 fs/attr.c:483 do_truncate+0x15c/0x220 fs/open.c:66 do_sys_ftruncate+0x6a2/0x790 fs/open.c:194 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f33d2a3e639 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 61 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffca307c308 EFLAGS: 00000246 ORIG_RAX: 000000000000004d RAX: ffffffffffffffda RBX: 00007ffca307c4d8 RCX: 00007f33d2a3e639 RDX: 0000000000000000 RSI: 0000000000048280 RDI: 0000000000000004 RBP: 00007f33d2ab1610 R08: 0000000000000000 R09: 00007ffca307c4d8 R10: 00000000000005f1 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffca307c4c8 R14: 0000000000000001 R15: 0000000000000001 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:memcpy_orig+0x105/0x120 arch/x86/lib/memcpy_64.S:160 Code: 00 00 00 00 00 83 fa 04 72 1b 8b 0e 44 8b 44 16 fc 89 0f 44 89 44 17 fc c3 66 66 2e 0f 1f 84 00 00 00 00 00 90 83 ea 01 72 19 <0f> b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 44 88 47 01 44 88 0c RSP: 0018:ffffc900033bf0e8 EFLAGS: 00010246 RAX: ffffc900033bf1a8 RBX: ffff88802089e680 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0005088000000fff RDI: ffffc900033bf1a8 RBP: 0000000000000001 R08: 0000000000000007 R09: 0000000000001000 R10: 0000000000001000 R11: ffffffff81d826e5 R12: 0000000000000fff R13: 0000000000001000 R14: 0000000000000001 R15: 0000000000000001 FS: 0000555555f72380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000557e772793c0 CR3: 000000007dab8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 00 83 fa 04 72 1b add %al,0x1b7204fa(%rbx) a: 8b 0e mov (%rsi),%ecx c: 44 8b 44 16 fc mov -0x4(%rsi,%rdx,1),%r8d 11: 89 0f mov %ecx,(%rdi) 13: 44 89 44 17 fc mov %r8d,-0x4(%rdi,%rdx,1) 18: c3 ret 19: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 20: 00 00 00 00 24: 90 nop 25: 83 ea 01 sub $0x1,%edx 28: 72 19 jb 0x43 * 2a: 0f b6 0e movzbl (%rsi),%ecx <-- trapping instruction 2d: 74 12 je 0x41 2f: 4c 0f b6 46 01 movzbq 0x1(%rsi),%r8 34: 4c 0f b6 0c 16 movzbq (%rsi,%rdx,1),%r9 39: 44 88 47 01 mov %r8b,0x1(%rdi) 3d: 44 rex.R 3e: 88 .byte 0x88 3f: 0c .byte 0xc