audit: type=1800 audit(1668219398.478:16): pid=10275 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.0" name="bus" dev="loop0" ino=10 res=0
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 10275 Comm: syz-executor.0 Not tainted 4.14.299-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
task: ffff8880455ca500 task.stack: ffff8880454c8000
RIP: 0010:f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline]
RIP: 0010:update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682
RSP: 0018:ffff8880454cf5a8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880a9c26a80 RCX: ffffc90005bda000
RDX: 0000000000000000 RSI: ffffffff82cc620d RDI: ffff88809a340350
RBP: ffff88809a340330 R08: ffff8880aa134b80 R09: ffffed1008aef026
R10: ffff888045778130 R11: ffff8880455ca500 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000001
FS:  00007fe92580a700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbee3f69028 CR3: 00000000a9947000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 refresh_sit_entry+0x2c/0x730 fs/f2fs/segment.c:1728
 allocate_data_block+0x47d/0xf60 fs/f2fs/segment.c:2372
 do_write_page+0x222/0x7f0 fs/f2fs/segment.c:2402
 write_node_page+0x6f/0x230 fs/f2fs/segment.c:2442
 __write_node_page+0x483/0xc20 fs/f2fs/node.c:1414
 fsync_node_pages+0x90e/0x1420 fs/f2fs/node.c:1532
 f2fs_do_sync_file+0xd51/0x1920 fs/f2fs/file.c:266
 vfs_fsync_range+0x103/0x260 fs/sync.c:196
 generic_write_sync include/linux/fs.h:2684 [inline]
 f2fs_file_write_iter+0x4a6/0x600 fs/f2fs/file.c:2753
 call_write_iter include/linux/fs.h:1780 [inline]
 new_sync_write fs/read_write.c:469 [inline]
 __vfs_write+0x44c/0x630 fs/read_write.c:482
 vfs_write+0x17f/0x4d0 fs/read_write.c:544
 SYSC_write fs/read_write.c:590 [inline]
 SyS_write+0xf2/0x210 fs/read_write.c:582
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x5e/0xd3
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6c 0e 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 75 20 4d 01 e6 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 57 0e 00 
RIP: f2fs_test_and_set_bit fs/f2fs/f2fs.h:1956 [inline] RSP: ffff8880454cf5a8
RIP: update_sit_entry+0x684/0x1560 fs/f2fs/segment.c:1682 RSP: ffff8880454cf5a8
---[ end trace e3b08447466a76dc ]---
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 48 89             	fisttps -0x77(%rax)
   3:	fa                   	cli
   4:	48 c1 ea 03          	shr    $0x3,%rdx
   8:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   c:	0f 85 6c 0e 00 00    	jne    0xe7e
  12:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  19:	fc ff df
  1c:	4c 8b 75 20          	mov    0x20(%rbp),%r14
  20:	4d 01 e6             	add    %r12,%r14
  23:	4c 89 f2             	mov    %r14,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	4c 89 f2             	mov    %r14,%rdx
  31:	83 e2 07             	and    $0x7,%edx
  34:	38 d0                	cmp    %dl,%al
  36:	7f 08                	jg     0x40
  38:	84 c0                	test   %al,%al
  3a:	0f                   	.byte 0xf
  3b:	85 57 0e             	test   %edx,0xe(%rdi)