general protection fault, probably for non-canonical address 0xdffffc00000000ba: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000005d0-0x00000000000005d7] CPU: 1 PID: 4167 Comm: syz-executor137 Not tainted 5.15.185-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:bio_associate_blkg_from_css+0x128/0x9c0 block/blk-cgroup.c:1878 Code: df 41 80 3c 04 00 74 08 48 89 df e8 72 59 f3 fd 41 be d0 05 00 00 4c 03 33 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 4a 59 f3 fd 41 bf 90 00 00 00 4d 03 RSP: 0018:ffffc90002daf910 EFLAGS: 00010202 RAX: 00000000000000ba RBX: ffff8880202d08c8 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffffffff96249f60 RDI: ffff8880202d08c0 RBP: 1ffff1100405a121 R08: dffffc0000000000 R09: fffffbfff1ff3619 R10: fffffbfff1ff3619 R11: 1ffffffff1ff3618 R12: 1ffff1100405a119 R13: ffff8880202d0908 R14: 00000000000005d0 R15: ffff88807a46d96c FS: 000055556586f380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555658786f8 CR3: 000000007f380000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bio_associate_blkg+0x23a/0x340 block/blk-cgroup.c:1904 lbmStartIO+0x204/0x4c0 fs/jfs/jfs_logmgr.c:2130 lbmWrite+0x361/0x480 fs/jfs/jfs_logmgr.c:2079 lmNextPage+0x386/0xa00 fs/jfs/jfs_logmgr.c:-1 lmWriteRecord+0xf9d/0x1aa0 fs/jfs/jfs_logmgr.c:537 lmLogSync+0x438/0x9c0 fs/jfs/jfs_logmgr.c:977 jfs_syncpt+0x77/0x90 fs/jfs/jfs_logmgr.c:1049 jfs_sync_fs+0x83/0xa0 fs/jfs/super.c:690 sync_filesystem+0xe6/0x220 fs/sync.c:56 generic_shutdown_super+0x6b/0x300 fs/super.c:448 kill_block_super+0x7c/0xe0 fs/super.c:1427 deactivate_locked_super+0x93/0xf0 fs/super.c:335 cleanup_mnt+0x418/0x4d0 fs/namespace.c:1139 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa0b9eab347 Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffd7c99c0a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00000000000148ee RCX: 00007fa0b9eab347 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd7c99c160 RBP: 00007ffd7c99c160 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000202 R12: 00007ffd7c99d1d0 R13: 00005555658706c0 R14: 0000000000000039 R15: 431bde82d7b634db Modules linked in: ---[ end trace 116a9589c37a52dc ]--- RIP: 0010:bio_associate_blkg_from_css+0x128/0x9c0 block/blk-cgroup.c:1878 Code: df 41 80 3c 04 00 74 08 48 89 df e8 72 59 f3 fd 41 be d0 05 00 00 4c 03 33 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 f7 e8 4a 59 f3 fd 41 bf 90 00 00 00 4d 03 RSP: 0018:ffffc90002daf910 EFLAGS: 00010202 RAX: 00000000000000ba RBX: ffff8880202d08c8 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffffffff96249f60 RDI: ffff8880202d08c0 RBP: 1ffff1100405a121 R08: dffffc0000000000 R09: fffffbfff1ff3619 R10: fffffbfff1ff3619 R11: 1ffffffff1ff3618 R12: 1ffff1100405a119 R13: ffff8880202d0908 R14: 00000000000005d0 R15: ffff88807a46d96c FS: 000055556586f380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555658786f8 CR3: 000000007f380000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: df 41 80 filds -0x80(%rcx) 3: 3c 04 cmp $0x4,%al 5: 00 74 08 48 add %dh,0x48(%rax,%rcx,1) 9: 89 df mov %ebx,%edi b: e8 72 59 f3 fd call 0xfdf35982 10: 41 be d0 05 00 00 mov $0x5d0,%r14d 16: 4c 03 33 add (%rbx),%r14 19: 4c 89 f0 mov %r14,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 f7 mov %r14,%rdi 33: e8 4a 59 f3 fd call 0xfdf35982 38: 41 bf 90 00 00 00 mov $0x90,%r15d 3e: 4d rex.WRB 3f: 03 .byte 0x3