general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.0.0-rc7-syzkaller-00029-g3800a713b607 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:relay_switch_subbuf+0x2c2/0x6b0 Code: 49 8b 1f 48 83 c3 50 eb 10 e8 7a ec fe ff 49 8d 9d d8 00 00 00 4c 8b 24 24 48 89 d8 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df <42> 80 3c 38 00 74 08 48 89 df e8 6f a1 52 00 4c 01 33 f0 83 44 24 RSP: 0018:ffffc90000157800 EFLAGS: 00010006 RAX: 000000000000000a RBX: 0000000000000050 RCX: dffffc0000000000 RDX: 0000000080000103 RSI: 0000000000000044 RDI: ffff8880799316c8 RBP: ffff88807e8be808 R08: ffffffff818aa7fa R09: 0000000000000000 R10: fffff5200297c211 R11: 1ffff9200297c20e R12: ffff888079931628 R13: ffff888079931600 R14: 0000000000000038 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555630848 CR3: 00000000431f8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: relay_reserve include/linux/relay.h:248 [inline] trace_note+0x54b/0x6f0 kernel/trace/blktrace.c:95 trace_note_tsk+0xb9/0x150 kernel/trace/blktrace.c:126 __blk_add_trace+0x9ef/0xd60 kernel/trace/blktrace.c:268 blk_add_trace_rq+0x2ab/0x2e0 kernel/trace/blktrace.c:846 trace_block_rq_complete+0x22d/0x280 include/trace/events/block.h:147 blk_update_request+0x36/0x1040 block/blk-mq.c:795 blk_mq_end_request+0x39/0x70 block/blk-mq.c:951 blk_complete_reqs block/blk-mq.c:1022 [inline] blk_done_softirq+0x119/0x160 block/blk-mq.c:1027 __do_softirq+0x382/0x793 kernel/softirq.c:571 run_ksoftirqd+0xc1/0x120 kernel/softirq.c:934 smpboot_thread_fn+0x533/0x9d0 kernel/smpboot.c:164 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:relay_switch_subbuf+0x2c2/0x6b0 Code: 49 8b 1f 48 83 c3 50 eb 10 e8 7a ec fe ff 49 8d 9d d8 00 00 00 4c 8b 24 24 48 89 d8 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df <42> 80 3c 38 00 74 08 48 89 df e8 6f a1 52 00 4c 01 33 f0 83 44 24 RSP: 0018:ffffc90000157800 EFLAGS: 00010006 RAX: 000000000000000a RBX: 0000000000000050 RCX: dffffc0000000000 RDX: 0000000080000103 RSI: 0000000000000044 RDI: ffff8880799316c8 RBP: ffff88807e8be808 R08: ffffffff818aa7fa R09: 0000000000000000 R10: fffff5200297c211 R11: 1ffff9200297c20e R12: ffff888079931628 R13: ffff888079931600 R14: 0000000000000038 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555630848 CR3: 00000000431f8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 49 8b 1f mov (%r15),%rbx 3: 48 83 c3 50 add $0x50,%rbx 7: eb 10 jmp 0x19 9: e8 7a ec fe ff callq 0xfffeec88 e: 49 8d 9d d8 00 00 00 lea 0xd8(%r13),%rbx 15: 4c 8b 24 24 mov (%rsp),%r12 19: 48 89 d8 mov %rbx,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15 27: fc ff df * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 6f a1 52 00 callq 0x52a1a8 39: 4c 01 33 add %r14,(%rbx) 3c: f0 lock 3d: 83 .byte 0x83 3e: 44 rex.R 3f: 24 .byte 0x24