BUG: unable to handle page fault for address: ffffe8ffff55fb30
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1ac3f067 P4D 1ac3f067 PUD 1e7df067 PMD 52ae2067 PTE 0
Oops: Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 80 Comm: kswapd1 Not tainted 6.12.0-rc6-syzkaller-00110-gff7afaeca1a1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_btree_cache_scan+0x9ab/0xd00 fs/bcachefs/btree_cache.c:541
Code: 38 0f 85 04 02 00 00 21 32 48 81 c5 38 b6 04 00 48 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 ef e8 e9 a9 ea fd 48 8b 45 00 <65> 48 ff 40 38 48 8b 84 24 80 00 00 00 42 80 3c 38 00 48 8b 5c 24
RSP: 0018:ffffc90000e773c0 EFLAGS: 00010246
RAX: 0000607fdf95faf8 RBX: ffff888053301be8 RCX: ffffffff8bcfb40d
RDX: ffff88801f00246c RSI: 00000000fffbffff RDI: ffffc90000e77340
RBP: ffff88805334b638 R08: ffffc90000e77347 R09: 1ffff920001cee68
R10: dffffc0000000000 R11: fffff520001cee69 R12: ffff888053301c78
R13: ffff888053301cb8 R14: 0000000000000003 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffff55fb30 CR3: 000000004058c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_shrink_slab+0x701/0x1160 mm/shrinker.c:437
 shrink_slab+0x1093/0x14d0 mm/shrinker.c:664
 shrink_one+0x43b/0x850 mm/vmscan.c:4824
 shrink_many mm/vmscan.c:4885 [inline]
 lru_gen_shrink_node mm/vmscan.c:4963 [inline]
 shrink_node+0x3791/0x3e20 mm/vmscan.c:5943
 kswapd_shrink_node mm/vmscan.c:6771 [inline]
 balance_pgdat mm/vmscan.c:6963 [inline]
 kswapd+0x1ca3/0x3700 mm/vmscan.c:7232
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
CR2: ffffe8ffff55fb30
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_btree_cache_scan+0x9ab/0xd00 fs/bcachefs/btree_cache.c:541
Code: 38 0f 85 04 02 00 00 21 32 48 81 c5 38 b6 04 00 48 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 ef e8 e9 a9 ea fd 48 8b 45 00 <65> 48 ff 40 38 48 8b 84 24 80 00 00 00 42 80 3c 38 00 48 8b 5c 24
RSP: 0018:ffffc90000e773c0 EFLAGS: 00010246
RAX: 0000607fdf95faf8 RBX: ffff888053301be8 RCX: ffffffff8bcfb40d
RDX: ffff88801f00246c RSI: 00000000fffbffff RDI: ffffc90000e77340
RBP: ffff88805334b638 R08: ffffc90000e77347 R09: 1ffff920001cee68
R10: dffffc0000000000 R11: fffff520001cee69 R12: ffff888053301c78
R13: ffff888053301cb8 R14: 0000000000000003 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ffff55fb30 CR3: 000000004058c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	38 0f                	cmp    %cl,(%rdi)
   2:	85 04 02             	test   %eax,(%rdx,%rax,1)
   5:	00 00                	add    %al,(%rax)
   7:	21 32                	and    %esi,(%rdx)
   9:	48 81 c5 38 b6 04 00 	add    $0x4b638,%rbp
  10:	48 89 e8             	mov    %rbp,%rax
  13:	48 c1 e8 03          	shr    $0x3,%rax
  17:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  1c:	74 08                	je     0x26
  1e:	48 89 ef             	mov    %rbp,%rdi
  21:	e8 e9 a9 ea fd       	call   0xfdeaaa0f
  26:	48 8b 45 00          	mov    0x0(%rbp),%rax
* 2a:	65 48 ff 40 38       	incq   %gs:0x38(%rax) <-- trapping instruction
  2f:	48 8b 84 24 80 00 00 	mov    0x80(%rsp),%rax
  36:	00
  37:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	5c                   	pop    %rsp
  3f:	24                   	.byte 0x24