Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 56 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: xfs-log/loop4 xlog_ioend_work
RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline]
RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline]
RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743
Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 0c 33 b9 fd 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000131eec0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880216b9e80
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88807d43cb70
RBP: 0000000000000000 R08: ffff88802543bb07 R09: 1ffff11004a87760
R10: dffffc0000000000 R11: ffffed1004a87761 R12: 0000000000000800
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807d43cb40
FS:  0000000000000000(0000) GS:ffff888125ecd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f34457156c0 CR3: 0000000061cf2000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 bio_attempt_back_merge+0x4ba/0x920 block/blk-merge.c:940
 blk_attempt_plug_merge+0x145/0x1d0 block/blk-merge.c:1073
 blk_mq_attempt_bio_merge block/blk-mq.c:3022 [inline]
 blk_mq_submit_bio+0x1abd/0x26d0 block/blk-mq.c:3186
 __submit_bio+0x207/0x5a0 block/blk-core.c:637
 __submit_bio_noacct_mq block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x2fb/0xa50 block/blk-core.c:755
 bio_chain_and_submit+0xeb/0x130 block/bio.c:363
 __blkdev_issue_discard+0x80/0x100 block/blk-lib.c:70
 xfs_discard_extents+0x580/0xb00 fs/xfs/xfs_discard.c:129
 xlog_cil_committed+0xfb9/0x1040 fs/xfs/xfs_log_cil.c:911
 xlog_cil_process_committed+0x15c/0x1b0 fs/xfs/xfs_log_cil.c:927
 xlog_state_do_iclog_callbacks fs/xfs/xfs_log.c:2505 [inline]
 xlog_state_do_callback+0x55c/0xd40 fs/xfs/xfs_log.c:2530
 xlog_ioend_work+0xc6/0x100 fs/xfs/xfs_log.c:1248
 process_one_work+0x94a/0x15d0 kernel/workqueue.c:3267
 process_scheduled_works kernel/workqueue.c:3350 [inline]
 worker_thread+0x9b0/0xee0 kernel/workqueue.c:3431
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bio_get_first_bvec block/blk-merge.c:22 [inline]
RIP: 0010:bio_get_last_bvec block/blk-merge.c:30 [inline]
RIP: 0010:bio_seg_gap+0x1c6/0x7d0 block/blk-merge.c:743
Code: fd 48 ba 00 00 00 00 00 fc ff df 49 8b 06 48 89 5c 24 20 49 89 de 49 c1 e6 04 48 89 44 24 08 4a 8d 2c 30 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 48 89 ef e8 0c 33 b9 fd 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc9000131eec0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880216b9e80
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88807d43cb70
RBP: 0000000000000000 R08: ffff88802543bb07 R09: 1ffff11004a87760
R10: dffffc0000000000 R11: ffffed1004a87761 R12: 0000000000000800
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88807d43cb40
FS:  0000000000000000(0000) GS:ffff888125ecd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f40b21b12f8 CR3: 0000000077094000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	fd                   	std
   1:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   8:	fc ff df
   b:	49 8b 06             	mov    (%r14),%rax
   e:	48 89 5c 24 20       	mov    %rbx,0x20(%rsp)
  13:	49 89 de             	mov    %rbx,%r14
  16:	49 c1 e6 04          	shl    $0x4,%r14
  1a:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
  1f:	4a 8d 2c 30          	lea    (%rax,%r14,1),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	48 89 ef             	mov    %rbp,%rdi
  33:	e8 0c 33 b9 fd       	call   0xfdb93344
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah