Oops: general protection fault, probably for non-canonical address 0xc00000000180025b: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:find_stack lib/stackdepot.c:553 [inline]
RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618
Code: 00 31 f6 48 89 d5 4c 89 cb e8 48 2c c8 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7
RSP: 0018:ffffc900000079f0 EFLAGS: 00010283
RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 00000000001fc750
RDX: ffff88805e3fc750 RSI: 0000000000000002 RDI: 0000000046f2ba9a
RBP: 00000000653decb0 R08: ffffc90000007aa0 R09: 0000000000000007
R10: ffffc90000007930 R11: ffffffff81ab2f20 R12: ffff88805332f1a8
R13: 0000000000000007 R14: 00000000f101fc75 R15: c00000000180024b
FS: 00007f7ae89c66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc310d10c8 CR3: 0000000033a9c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ref_tracker_free+0x114/0x7e0 lib/ref_tracker.c:240
netdev_tracker_free include/linux/netdevice.h:4295 [inline]
netdev_put include/linux/netdevice.h:4312 [inline]
dst_destroy+0x105/0x360 net/core/dst.c:114
rcu_do_batch kernel/rcu/tree.c:2546 [inline]
rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2802
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 2e e4 2d f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 63 8b 95 f5 65 8b 05 94 b8 0b 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc9000d6f69a0 EFLAGS: 00000206
RAX: 75216c4a684fa900 RBX: 1ffff92001aded38 RCX: ffffffff819b4d0a
RDX: dffffc0000000000 RSI: ffffffff8c0aa680 RDI: 0000000000000001
RBP: ffffc9000d6f6a30 R08: ffffffff942f6857 R09: 1ffffffff285ed0a
R10: dffffc0000000000 R11: fffffbfff285ed0b R12: dffffc0000000000
R13: 1ffff92001aded34 R14: ffffc9000d6f69c0 R15: 0000000000000246
kthread_queue_work+0x110/0x180 kernel/kthread.c:1195
synchronize_rcu_expedited_queue_work kernel/rcu/tree_exp.h:496 [inline]
synchronize_rcu_expedited+0x5ad/0x830 kernel/rcu/tree_exp.h:1006
synchronize_rcu+0x11b/0x360 kernel/rcu/tree.c:3281
rcu_sync_enter+0x1fa/0x350 kernel/rcu/sync.c:133
percpu_down_write+0x60/0x310 kernel/locking/percpu-rwsem.c:232
bch2_accounting_read+0x173/0x6d50 fs/bcachefs/disk_accounting.c:702
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:226
bch2_run_recovery_passes+0x2ad/0xa90 fs/bcachefs/recovery_passes.c:291
bch2_fs_recovery+0x265a/0x3de0 fs/bcachefs/recovery.c:937
bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1030
bch2_fs_get_tree+0xd8d/0x1740 fs/bcachefs/fs.c:2203
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7ae7b8e54a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7ae89c5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f7ae89c5ef0 RCX: 00007f7ae7b8e54a
RDX: 0000000020000000 RSI: 0000000020000080 RDI: 00007f7ae89c5eb0
RBP: 0000000020000000 R08: 00007f7ae89c5ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000080
R13: 00007f7ae89c5eb0 R14: 000000000000593f R15: 0000000020000380
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:find_stack lib/stackdepot.c:553 [inline]
RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618
Code: 00 31 f6 48 89 d5 4c 89 cb e8 48 2c c8 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7
RSP: 0018:ffffc900000079f0 EFLAGS: 00010283
RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 00000000001fc750
RDX: ffff88805e3fc750 RSI: 0000000000000002 RDI: 0000000046f2ba9a
RBP: 00000000653decb0 R08: ffffc90000007aa0 R09: 0000000000000007
R10: ffffc90000007930 R11: ffffffff81ab2f20 R12: ffff88805332f1a8
R13: 0000000000000007 R14: 00000000f101fc75 R15: c00000000180024b
FS: 00007f7ae89c66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc310d10c8 CR3: 0000000033a9c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 00 31 add %dh,(%rcx)
2: f6 48 89 d5 testb $0xd5,-0x77(%rax)
6: 4c 89 cb mov %r9,%rbx
9: e8 48 2c c8 ff call 0xffc82c56
e: 49 89 d9 mov %rbx,%r9
11: 8b 5c 24 04 mov 0x4(%rsp),%ebx
15: 48 89 ea mov %rbp,%rdx
18: 4c 8b 44 24 08 mov 0x8(%rsp),%r8
1d: 45 85 e4 test %r12d,%r12d
20: 75 67 jne 0x89
22: 4d 8b 3f mov (%r15),%r15
25: 49 39 d7 cmp %rdx,%r15
28: 74 5c je 0x86
* 2a: 45 39 77 10 cmp %r14d,0x10(%r15) <-- trapping instruction
2e: 75 f2 jne 0x22
30: 45 39 4f 14 cmp %r9d,0x14(%r15)
34: 75 ec jne 0x22
36: 31 c0 xor %eax,%eax
38: 49 8b 0c c0 mov (%r8,%rax,8),%rcx
3c: 49 rex.WB
3d: 3b .byte 0x3b
3e: 4c rex.WR
3f: c7 .byte 0xc7