==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2876 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
Read of size 4 at addr 0000000000000060 by task syz.0.2500/16060

CPU: 1 UID: 0 PID: 16060 Comm: syz.0.2500 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xd9/0x110 mm/kasan/report.c:602
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 buffer_busy fs/buffer.c:2876 [inline]
 drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
 try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
 filemap_release_folio+0x219/0x280 mm/filemap.c:4220
 shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1433
 evict_folios+0x6e3/0x19c0 mm/vmscan.c:4593
 try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4789
 lru_gen_shrink_lruvec mm/vmscan.c:4938 [inline]
 shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5693
 shrink_node_memcgs mm/vmscan.c:5929 [inline]
 shrink_node+0x98b/0x3e60 mm/vmscan.c:5970
 shrink_zones mm/vmscan.c:6215 [inline]
 do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6277
 try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6609
 try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
 obj_cgroup_charge_pages mm/memcontrol.c:2646 [inline]
 __memcg_kmem_charge_page+0xdb/0x2b0 mm/memcontrol.c:2673
 __alloc_pages_noprof+0x252/0x25b0 mm/page_alloc.c:4770
 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x724/0x1530 mm/vmalloc.c:3846
 __bpf_map_area_alloc+0xea/0x190 kernel/bpf/syscall.c:396
 bloom_map_alloc+0x306/0x4d0 kernel/bpf/bloom_filter.c:146
 map_create+0x5c8/0x1f20 kernel/bpf/syscall.c:1442
 __sys_bpf+0x4391/0x49c0 kernel/bpf/syscall.c:5772
 __do_sys_bpf kernel/bpf/syscall.c:5897 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5895 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5895
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbdcf985d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbdcd7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fbdcfb75fa0 RCX: 00007fbdcf985d29
RDX: 0000000000000048 RSI: 0000000020000440 RDI: 0000000000000000
RBP: 00007fbdcfa01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fbdcfb75fa0 R15: 00007fff60ac41e8
 </TASK>
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 16060 Comm: syz.0.2500 Tainted: G    B              6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 c8 9b 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 17 76 db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc90003c065d8 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff88803161a6c8 RCX: ffffc90010d7f000
RDX: 0000000000080000 RSI: ffffffff81fbc4fe RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea0000c5bcc0 R14: 0000000000000000 R15: ffffea0000c5bce8
FS:  00007fbdcd7f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e2fc7c000 CR3: 000000006ff62000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
 filemap_release_folio+0x219/0x280 mm/filemap.c:4220
 shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1433
 evict_folios+0x6e3/0x19c0 mm/vmscan.c:4593
 try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4789
 lru_gen_shrink_lruvec mm/vmscan.c:4938 [inline]
 shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5693
 shrink_node_memcgs mm/vmscan.c:5929 [inline]
 shrink_node+0x98b/0x3e60 mm/vmscan.c:5970
 shrink_zones mm/vmscan.c:6215 [inline]
 do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6277
 try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6609
 try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
 obj_cgroup_charge_pages mm/memcontrol.c:2646 [inline]
 __memcg_kmem_charge_page+0xdb/0x2b0 mm/memcontrol.c:2673
 __alloc_pages_noprof+0x252/0x25b0 mm/page_alloc.c:4770
 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x724/0x1530 mm/vmalloc.c:3846
 __bpf_map_area_alloc+0xea/0x190 kernel/bpf/syscall.c:396
 bloom_map_alloc+0x306/0x4d0 kernel/bpf/bloom_filter.c:146
 map_create+0x5c8/0x1f20 kernel/bpf/syscall.c:1442
 __sys_bpf+0x4391/0x49c0 kernel/bpf/syscall.c:5772
 __do_sys_bpf kernel/bpf/syscall.c:5897 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5895 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5895
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbdcf985d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbdcd7f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fbdcfb75fa0 RCX: 00007fbdcf985d29
RDX: 0000000000000048 RSI: 0000000020000440 RDI: 0000000000000000
RBP: 00007fbdcfa01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fbdcfb75fa0 R15: 00007fff60ac41e8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 c8 9b 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 17 76 db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc90003c065d8 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff88803161a6c8 RCX: ffffc90010d7f000
RDX: 0000000000080000 RSI: ffffffff81fbc4fe RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea0000c5bcc0 R14: 0000000000000000 R15: ffffea0000c5bce8
FS:  00007fbdcd7f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e2fc7c000 CR3: 000000006ff62000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	4d 8b 76 08          	mov    0x8(%r14),%r14
   4:	4c 39 f3             	cmp    %r14,%rbx
   7:	0f 84 84 00 00 00    	je     0x91
   d:	e8 c8 9b 79 ff       	call   0xff799bda
  12:	4d 8d 66 60          	lea    0x60(%r14),%r12
  16:	be 04 00 00 00       	mov    $0x4,%esi
  1b:	4c 89 e7             	mov    %r12,%rdi
  1e:	e8 17 76 db ff       	call   0xffdb763a
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	0f b6 0c 28          	movzbl (%rax,%rbp,1),%ecx <-- trapping instruction
  2e:	4c 89 e0             	mov    %r12,%rax
  31:	83 e0 07             	and    $0x7,%eax
  34:	83 c0 03             	add    $0x3,%eax
  37:	38 c8                	cmp    %cl,%al
  39:	7c 08                	jl     0x43
  3b:	84 c9                	test   %cl,%cl
  3d:	0f                   	.byte 0xf
  3e:	85                   	.byte 0x85
  3f:	2d                   	.byte 0x2d