Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 8346 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline] RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline] RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743 Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 7c 04 b9 fd 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc90003a672a0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802aa50000 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff888032538b70 RBP: 0000000000000000 R08: ffff8881423f6c17 R09: 1ffff1102847ed82 R10: dffffc0000000000 R11: ffffed102847ed83 R12: 0000000000000800 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888032538b40 FS: 0000555555acc500(0000) GS:ffff888125ecc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd2e545b58 CR3: 000000007d002000 CR4: 00000000003526f0 Call Trace: bio_attempt_back_merge+0x4ae/0x930 block/blk-merge.c:940 blk_attempt_plug_merge+0x145/0x1d0 block/blk-merge.c:1073 blk_mq_attempt_bio_merge block/blk-mq.c:3022 [inline] blk_mq_submit_bio+0x1aad/0x26e0 block/blk-mq.c:3186 __submit_bio+0x207/0x5a0 block/blk-core.c:637 __submit_bio_noacct_mq block/blk-core.c:724 [inline] submit_bio_noacct_nocheck+0x2eb/0xa50 block/blk-core.c:755 submit_bio_wait+0x104/0x200 block/bio.c:1389 blkdev_issue_discard+0x113/0x1b0 block/blk-lib.c:95 sb_issue_discard include/linux/blkdev.h:1280 [inline] gfs2_rgrp_send_discards+0x412/0x8b0 fs/gfs2/rgrp.c:1342 maybe_release_space fs/gfs2/lops.c:83 [inline] gfs2_unpin+0x381/0x9c0 fs/gfs2/lops.c:115 buf_lo_after_commit+0x15e/0x1b0 fs/gfs2/lops.c:731 lops_after_commit fs/gfs2/lops.h:51 [inline] gfs2_log_flush+0xf60/0x24c0 fs/gfs2/log.c:1110 gfs2_kill_sb+0x5c/0x430 fs/gfs2/ops_fstype.c:1783 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1317 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2e9/0xfa0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f94ba5909f7 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffd2e546308 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000064 RCX: 00007f94ba5909f7 RDX: 0000000000000200 RSI: 0000000000000009 RDI: 00007ffd2e5474b0 RBP: 00007f94ba611d7d R08: 0000555555ae7663 R09: 0000000000000000 R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffd2e5474b0 R13: 00007f94ba611d7d R14: 0000555555acc4a8 R15: 00007ffd2e548580 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline] RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline] RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743 Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 7c 04 b9 fd 48 ba 00 00 00 00 00 fc RSP: 0018:ffffc90003a672a0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88802aa50000 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff888032538b70 RBP: 0000000000000000 R08: ffff8881423f6c17 R09: 1ffff1102847ed82 R10: dffffc0000000000 R11: ffffed102847ed83 R12: 0000000000000800 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888032538b40 FS: 0000555555acc500(0000) GS:ffff888125ecc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f47b2117d60 CR3: 000000007d002000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: fd std 1: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 8: fc ff df b: 49 8b 06 mov (%r14),%rax e: 48 89 5c 24 20 mov %rbx,0x20(%rsp) 13: 49 89 de mov %rbx,%r14 16: 49 c1 e6 04 shl $0x4,%r14 1a: 48 89 44 24 08 mov %rax,0x8(%rsp) 1f: 4a 8d 2c 30 lea (%rax,%r14,1),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) <-- trapping instruction 2e: 74 12 je 0x42 30: 48 89 ef mov %rbp,%rdi 33: e8 7c 04 b9 fd call 0xfdb904b4 38: 48 rex.W 39: ba 00 00 00 00 mov $0x0,%edx 3e: 00 fc add %bh,%ah