Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 5883 Comm: syz.1.44 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 RSP: 0000:ffffc9000604f640 EFLAGS: 00010003 RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 RBP: ffffc9000604f828 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e R10: dffffc0000000000 R11: fffffbfff1f9e71f R12: ffff8880b863c658 R13: ffff888125a6b000 R14: 1ffff110170c7922 R15: 0000000000000014 FS: 00005555788ac500(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c4565ba CR3: 0000000040eee000 CR4: 00000000003526f0 Call Trace: preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:679 RIP: 0010:set_pte_range+0x7b/0x890 mm/memory.c:5562 Code: 1f 49 8d 6f 28 48 89 e8 48 c1 e8 03 48 89 44 24 48 42 0f b6 04 28 84 c0 0f 85 75 07 00 00 8b 75 00 83 e6 01 31 ff 89 74 24 24 b0 60 ac ff 48 89 5c 24 08 48 83 c3 18 48 89 d8 48 c1 e8 03 42 RSP: 0000:ffffc9000604f950 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff8880585f4780 RCX: ffff88802e1abe00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000604fd88 R08: 000000110c459000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffff9400022e5c1 R12: 0000000000000001 R13: dffffc0000000000 R14: ffffea0001172e00 R15: ffffc9000604fd60 filemap_map_order0_folio mm/filemap.c:3878 [inline] filemap_map_pages+0xbeb/0x1c70 mm/filemap.c:3948 do_fault_around mm/memory.c:5818 [inline] do_read_fault mm/memory.c:5851 [inline] do_fault mm/memory.c:5994 [inline] do_pte_missing+0x1646/0x2940 mm/memory.c:4566 handle_pte_fault mm/memory.c:6379 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0xdc2/0x14d0 mm/memory.c:6686 do_user_addr_fault+0xa73/0x1340 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7ff125d21756 Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80 RSP: 002b:00007fff6b86e080 EFLAGS: 00010202 RAX: 000000110c454000 RBX: ffffffff8b416692 RCX: 0000000000000002 RDX: 0000000000000692 RSI: 000000000000059a RDI: 0000000000000004 RBP: 0000000000000000 R08: 00007ff1260b0000 R09: 00007ff1260b2000 R10: 000000008b416696 R11: 0000000000000005 R12: 00007ff1260c6038 R13: 000000000000003d R14: ffffffff8b416692 R15: 00007ff126bf5720 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 RSP: 0000:ffffc9000604f640 EFLAGS: 00010003 RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 RBP: ffffc9000604f828 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e R10: dffffc0000000000 R11: fffffbfff1f9e71f R12: ffff8880b863c658 R13: ffff888125a6b000 R14: 1ffff110170c7922 R15: 0000000000000014 FS: 00005555788ac500(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c4565ba CR3: 0000000040eee000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 24 80 and $0x80,%al 2: 00 00 add %al,(%rax) 4: 00 e8 add %ch,%al 6: 80 97 f2 f6 48 8b 84 adcb $0x84,-0x74b7090e(%rdi) d: 24 80 and $0x80,%al f: 00 00 add %al,(%rax) 11: 00 48 8b add %cl,-0x75(%rax) 14: 18 4c 8d 7b sbb %cl,0x7b(%rbp,%rcx,4) 18: 14 4c adc $0x4c,%al 1a: 89 f8 mov %edi,%eax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction 2e: 84 c0 test %al,%al 30: 0f 85 87 04 00 00 jne 0x4bd 36: 45 8b 3f mov (%r15),%r15d 39: 49 83 ff 08 cmp $0x8,%r15 3d: 0f .byte 0xf 3e: 83 .byte 0x83 3f: 98 cwtl