Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
CPU: 0 UID: 0 PID: 20535 Comm: kworker/u8:9 Not tainted 6.11.0-rc7-syzkaller-00021-g7c6a3a65ace7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: loop1 loop_workfn
RIP: 0010:vfs_iter_write+0x39/0x610 fs/read_write.c:879
Code: 83 ec 20 89 4c 24 14 49 89 d4 49 89 f6 49 89 ff 48 bd 00 00 00 00 00 fc ff df e8 42 52 87 ff 4d 8d 6f 50 4c 89 eb 48 c1 eb 03 <0f> b6 04 2b 84 c0 0f 85 13 05 00 00 41 8b 6d 00 89 ee 83 e6 02 31
RSP: 0018:ffffc90003e8f6a8 EFLAGS: 00010216
RAX: ffffffff820c3a6e RBX: 000000000000000a RCX: ffff88805fc7bc00
RDX: 0000000000000000 RSI: ffffc90003e8f8f0 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff84b0f54e R09: ffffc90003e8f8f0
R10: dffffc0000000000 R11: fffff520007d1f23 R12: ffffc90003e8f940
R13: 0000000000000050 R14: ffffc90003e8f8f0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b9a2163a9 CR3: 0000000059f32000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 lo_write_bvec drivers/block/loop.c:243 [inline]
 lo_write_simple drivers/block/loop.c:264 [inline]
 do_req_filebacked drivers/block/loop.c:511 [inline]
 loop_handle_cmd drivers/block/loop.c:1910 [inline]
 loop_process_work+0x143b/0x2180 drivers/block/loop.c:1945
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2e/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_iter_write+0x39/0x610 fs/read_write.c:879
Code: 83 ec 20 89 4c 24 14 49 89 d4 49 89 f6 49 89 ff 48 bd 00 00 00 00 00 fc ff df e8 42 52 87 ff 4d 8d 6f 50 4c 89 eb 48 c1 eb 03 <0f> b6 04 2b 84 c0 0f 85 13 05 00 00 41 8b 6d 00 89 ee 83 e6 02 31
RSP: 0018:ffffc90003e8f6a8 EFLAGS: 00010216
RAX: ffffffff820c3a6e RBX: 000000000000000a RCX: ffff88805fc7bc00
RDX: 0000000000000000 RSI: ffffc90003e8f8f0 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff84b0f54e R09: ffffc90003e8f8f0
R10: dffffc0000000000 R11: fffff520007d1f23 R12: ffffc90003e8f940
R13: 0000000000000050 R14: ffffc90003e8f8f0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b904376058 CR3: 0000000053092000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	83 ec 20             	sub    $0x20,%esp
   3:	89 4c 24 14          	mov    %ecx,0x14(%rsp)
   7:	49 89 d4             	mov    %rdx,%r12
   a:	49 89 f6             	mov    %rsi,%r14
   d:	49 89 ff             	mov    %rdi,%r15
  10:	48 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbp
  17:	fc ff df
  1a:	e8 42 52 87 ff       	call   0xff875261
  1f:	4d 8d 6f 50          	lea    0x50(%r15),%r13
  23:	4c 89 eb             	mov    %r13,%rbx
  26:	48 c1 eb 03          	shr    $0x3,%rbx
* 2a:	0f b6 04 2b          	movzbl (%rbx,%rbp,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 13 05 00 00    	jne    0x549
  36:	41 8b 6d 00          	mov    0x0(%r13),%ebp
  3a:	89 ee                	mov    %ebp,%esi
  3c:	83 e6 02             	and    $0x2,%esi
  3f:	31                   	.byte 0x31