general protection fault, probably for non-canonical address 0xdffffc00000000bd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000005e8-0x00000000000005ef]
CPU: 1 PID: 9829 Comm: kworker/u4:12 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:mm_has_notifiers include/linux/mmu_notifier.h:283 [inline]
RIP: 0010:mmu_notifier_invalidate_range_start+0x7e/0xf0 include/linux/mmu_notifier.h:457
Code: 08 4d 8d 7e 08 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 61 ba 0c 00 bb e8 05 00 00 49 03 1f 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 ba 0c 00 48 83 3b 00 74 27 e8
RSP: 0018:ffffc9000492e778 EFLAGS: 00010206
RAX: 00000000000000bd RBX: 00000000000005e8 RCX: ffff8880197789f0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000492e988 R08: dffffc0000000000 R09: fffffbfff1fa2fc3
R10: fffffbfff1fa2fc3 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffc9000492e890 R14: ffffc9000492e8e0 R15: ffffc9000492e8e8
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000034a15000 CR4: 00000000001526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 page_mkclean_one+0x325/0x7a0 mm/rmap.c:921
 rmap_walk_file+0x413/0x610 mm/rmap.c:2352
 rmap_walk mm/rmap.c:2370 [inline]
 page_mkclean+0x32c/0x460 mm/rmap.c:1003
 clear_page_dirty_for_io+0x392/0x960 mm/page-writeback.c:2727
 mpage_submit_page fs/ext4/inode.c:2086 [inline]
 mpage_process_page_bufs+0x7cf/0xae0 fs/ext4/inode.c:2220
 mpage_prepare_extent_to_map+0xa4e/0xe90 fs/ext4/inode.c:2632
 ext4_writepages+0xc2d/0x4080 fs/ext4/inode.c:2760
 do_writepages+0x49d/0x760 mm/page-writeback.c:2364
 __writeback_single_inode+0xd4/0x590 fs/fs-writeback.c:1616
 writeback_sb_inodes+0xd29/0x29e0 fs/fs-writeback.c:1881
 __writeback_inodes_wb fs/fs-writeback.c:1950 [inline]
 wb_writeback+0x515/0x9b0 fs/fs-writeback.c:2055
 wb_check_old_data_flush fs/fs-writeback.c:2155 [inline]
 wb_do_writeback fs/fs-writeback.c:2208 [inline]
 wb_workfn+0xad5/0x1430 fs/fs-writeback.c:2237
 process_one_work+0x853/0x1140 kernel/workqueue.c:2297
 worker_thread+0xac1/0x1320 kernel/workqueue.c:2444
 kthread+0x453/0x480 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30
Modules linked in:
---[ end trace 93924d210b7cb848 ]---
RIP: 0010:mm_has_notifiers include/linux/mmu_notifier.h:283 [inline]
RIP: 0010:mmu_notifier_invalidate_range_start+0x7e/0xf0 include/linux/mmu_notifier.h:457
Code: 08 4d 8d 7e 08 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 61 ba 0c 00 bb e8 05 00 00 49 03 1f 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 43 ba 0c 00 48 83 3b 00 74 27 e8
RSP: 0018:ffffc9000492e778 EFLAGS: 00010206
RAX: 00000000000000bd RBX: 00000000000005e8 RCX: ffff8880197789f0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000492e988 R08: dffffc0000000000 R09: fffffbfff1fa2fc3
R10: fffffbfff1fa2fc3 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffc9000492e890 R14: ffffc9000492e8e0 R15: ffffc9000492e8e8
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f033bde8718 CR3: 0000000150dca000 CR4: 00000000001526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	08 4d 8d             	or     %cl,-0x73(%rbp)
   3:	7e 08                	jle    0xd
   5:	4c 89 f8             	mov    %r15,%rax
   8:	48 c1 e8 03          	shr    $0x3,%rax
   c:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  11:	74 08                	je     0x1b
  13:	4c 89 ff             	mov    %r15,%rdi
  16:	e8 61 ba 0c 00       	callq  0xcba7c
  1b:	bb e8 05 00 00       	mov    $0x5e8,%ebx
  20:	49 03 1f             	add    (%r15),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 43 ba 0c 00       	callq  0xcba7c
  39:	48 83 3b 00          	cmpq   $0x0,(%rbx)
  3d:	74 27                	je     0x66
  3f:	e8                   	.byte 0xe8