general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f]
CPU: 1 PID: 4819 Comm: kworker/1:11 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: kafsd afs_process_async_call
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]
RIP: 0010:__mutex_lock+0xe8/0xae0 kernel/locking/mutex.c:747
Code: c0 40 71 c1 96 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 56 09 00 00 83 3d 45 5d 88 0c 00 75 21 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 cc 46 9a f7 48 39 5b 60 0f 85 d9 08 00 00
RSP: 0018:ffffc900035c7960 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000038 RCX: ffffffff96c17103
RDX: ffff8880724b403c RSI: ffffffff8a8c2920 RDI: 0000000000000098
RBP: ffffc900035c7ac0 R08: ffffffff89639e86 R09: 000000000000000b
R10: 00000000fffffffb R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c33a9e9 CR3: 00000000284fe000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rxrpc_kernel_abort_call+0x26/0x70 net/rxrpc/sendmsg.c:853
 afs_deliver_to_call+0x6ab/0x1200 fs/afs/rxrpc.c:-1
 afs_process_async_call+0x7e/0xe0 fs/afs/rxrpc.c:703
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:582 [inline]
RIP: 0010:__mutex_lock+0xe8/0xae0 kernel/locking/mutex.c:747
Code: c0 40 71 c1 96 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 56 09 00 00 83 3d 45 5d 88 0c 00 75 21 48 8d 7b 60 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 cc 46 9a f7 48 39 5b 60 0f 85 d9 08 00 00
RSP: 0018:ffffc900035c7960 EFLAGS: 00010202
RAX: 0000000000000013 RBX: 0000000000000038 RCX: ffffffff96c17103
RDX: ffff8880724b403c RSI: ffffffff8a8c2920 RDI: 0000000000000098
RBP: ffffc900035c7ac0 R08: ffffffff89639e86 R09: 000000000000000b
R10: 00000000fffffffb R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6864bf0980 CR3: 000000002f430000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	c0 40 71 c1          	rolb   $0xc1,0x71(%rax)
   4:	96                   	xchg   %eax,%esi
   5:	48 c1 e8 03          	shr    $0x3,%rax
   9:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
   e:	84 c0                	test   %al,%al
  10:	0f 85 56 09 00 00    	jne    0x96c
  16:	83 3d 45 5d 88 0c 00 	cmpl   $0x0,0xc885d45(%rip)        # 0xc885d62
  1d:	75 21                	jne    0x40
  1f:	48 8d 7b 60          	lea    0x60(%rbx),%rdi
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 05                	je     0x36
  31:	e8 cc 46 9a f7       	call   0xf79a4702
  36:	48 39 5b 60          	cmp    %rbx,0x60(%rbx)
  3a:	0f 85 d9 08 00 00    	jne    0x919