Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 3042 Comm: kworker/u8:7 Not tainted 6.11.0-rc4-next-20240822-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: bat_events batadv_nc_worker
RIP: 0010:rb_set_parent include/linux/rbtree_augmented.h:185 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:305 [inline]
RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:329 [inline]
RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:340 [inline]
RIP: 0010:__dequeue_entity+0x7ef/0xd30 kernel/sched/fair.c:863
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ff e8 25 7c 94 00 49 89 2f 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 13 7b 94 00 48 8b 45 00 83 e0 01 4d
RSP: 0018:ffffc90000007428 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888029e29eb8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff888029e29e80 RDI: ffff88806a449eb0
RBP: 0000000000000000 R08: ffff88802b224147 R09: 1ffff11005644828
R10: dffffc0000000000 R11: ffffed1005644829 R12: ffff88806a449e90
R13: ffff888029e29e90 R14: ffff888029e29e90 R15: ffff88806a449ea0
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd77a65d98 CR3: 00000000673b6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
dequeue_entity+0x7b0/0x1a70 kernel/sched/fair.c:5516
dequeue_entities+0x234/0xfa0 kernel/sched/fair.c:7090
dequeue_task_fair+0xad/0x150 kernel/sched/fair.c:7178
detach_task kernel/sched/fair.c:9368 [inline]
detach_tasks kernel/sched/fair.c:9504 [inline]
sched_balance_rq+0x5d5b/0x8590 kernel/sched/fair.c:11648
sched_balance_domains+0x565/0xa90 kernel/sched/fair.c:12069
handle_softirqs+0x2c5/0x980 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1037 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1037
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:debug_lockdep_rcu_enabled+0x2a/0x40 kernel/rcu/update.c:321
Code: f3 0f 1e fa 31 c0 83 3d ef cc 5c 04 00 74 1e 83 3d 56 fc 5c 04 00 74 15 65 48 8b 0c 25 80 d7 03 00 31 c0 83 b9 dc 0a 00 00 00 <0f> 94 c0 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00
RSP: 0018:ffffc90009c17b50 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888025f1a140 RCX: ffff88802c275a00
RDX: 0000000000000000 RSI: ffffffff8c609f00 RDI: ffffffff8c609ec0
RBP: 0000000000000000 R08: ffffffff8b8960a1 R09: 1ffffffff26f6300
R10: dffffc0000000000 R11: fffffbfff26f6301 R12: ffff8880660bccc0
R13: 000000000000007e R14: ffff888025f1a140 R15: dffffc0000000000
rcu_read_unlock include/linux/rcupdate.h:878 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
batadv_nc_worker+0x1f3/0x610 net/batman-adv/network-coding.c:719
process_one_work kernel/workqueue.c:3232 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3313
worker_thread+0x86d/0xd10 kernel/workqueue.c:3390
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rb_set_parent include/linux/rbtree_augmented.h:185 [inline]
RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:305 [inline]
RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:329 [inline]
RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:340 [inline]
RIP: 0010:__dequeue_entity+0x7ef/0xd30 kernel/sched/fair.c:863
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ff e8 25 7c 94 00 49 89 2f 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 ef e8 13 7b 94 00 48 8b 45 00 83 e0 01 4d
RSP: 0018:ffffc90000007428 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff888029e29eb8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff888029e29e80 RDI: ffff88806a449eb0
RBP: 0000000000000000 R08: ffff88802b224147 R09: 1ffff11005644828
R10: dffffc0000000000 R11: ffffed1005644829 R12: ffff88806a449e90
R13: ffff888029e29e90 R14: ffff888029e29e90 R15: ffff88806a449ea0
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd77a65d98 CR3: 00000000673b6000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 7 bytes skipped:
0: df 80 3c 08 00 74 filds 0x7400083c(%rax)
6: 08 4c 89 ff or %cl,-0x1(%rcx,%rcx,4)
a: e8 25 7c 94 00 call 0x947c34
f: 49 89 2f mov %rbp,(%r15)
12: 48 89 e8 mov %rbp,%rax
15: 48 c1 e8 03 shr $0x3,%rax
19: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
20: fc ff df
* 23: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
27: 74 08 je 0x31
29: 48 89 ef mov %rbp,%rdi
2c: e8 13 7b 94 00 call 0x947b44
31: 48 8b 45 00 mov 0x0(%rbp),%rax
35: 83 e0 01 and $0x1,%eax
38: 4d rex.WRB