general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 4284 Comm: syz.1.2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:ocfs2_find_dir_space_id fs/ocfs2/dir.c:3425 [inline] RIP: 0010:ocfs2_prepare_dir_for_insert+0x2e54/0x52b0 fs/ocfs2/dir.c:4305 Code: ff ff e8 ef 91 57 fe e9 38 01 00 00 e8 e5 91 57 fe 49 bc 00 00 00 00 00 fc ff df 49 8d 7d 08 49 8d 5d 09 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 6a 1f 00 00 4c 8b 74 24 70 4c 2b 74 24 RSP: 0018:ffffc9000335e1c0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000009 RCX: 0000000000080000 RDX: ffffc90005af9000 RSI: 000000000001ea5f RDI: 0000000000000008 RBP: ffffc9000335e8f0 R08: ffffc9000335eb50 R09: 0000000000000002 R10: 0000000000000002 R11: 0000000000000002 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88807edf80f8 R15: ffff88805eb05df8 FS: 00007fe77e05a6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32717ff8 CR3: 0000000023a53000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __ocfs2_prepare_orphan_dir+0x141/0x310 fs/ocfs2/namei.c:2166 ocfs2_prepare_orphan_dir+0xed/0x410 fs/ocfs2/namei.c:2209 ocfs2_add_inode_to_orphan+0x20a/0x7b0 fs/ocfs2/namei.c:2657 ocfs2_dio_wr_get_block+0x7cf/0x1810 fs/ocfs2/aops.c:2213 get_more_blocks fs/direct-io.c:673 [inline] do_direct_IO fs/direct-io.c:959 [inline] do_blockdev_direct_IO fs/direct-io.c:1276 [inline] __blockdev_direct_IO+0x142d/0x3b20 fs/direct-io.c:1368 ocfs2_direct_IO+0x233/0x2a0 fs/ocfs2/aops.c:2488 generic_file_direct_write+0x222/0x470 mm/filemap.c:3687 __generic_file_write_iter+0x2b2/0x4e0 mm/filemap.c:3869 ocfs2_file_write_iter+0x171a/0x1ee0 fs/ocfs2/file.c:2472 do_iter_readv_writev+0x47d/0x5f0 fs/read_write.c:-1 do_iter_write+0x1f8/0x7a0 fs/read_write.c:855 iter_file_splice_write+0x6be/0xcf0 fs/splice.c:689 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0xe1/0x130 fs/splice.c:956 splice_direct_to_actor+0x4e8/0xc00 fs/splice.c:902 do_splice_direct+0x1d4/0x2f0 fs/splice.c:1008 do_sendfile+0x524/0xe30 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1317 [inline] __se_sys_sendfile64+0x141/0x1a0 fs/read_write.c:1303 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fe77fe022d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe77e05a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007fe780089fa0 RCX: 00007fe77fe022d9 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 00007fe77fe99888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020fffe82 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe78008a038 R14: 00007fe780089fa0 R15: 00007ffdbd21f928 Modules linked in: ---[ end trace 9b64cf09d08a4e3a ]--- RIP: 0010:ocfs2_find_dir_space_id fs/ocfs2/dir.c:3425 [inline] RIP: 0010:ocfs2_prepare_dir_for_insert+0x2e54/0x52b0 fs/ocfs2/dir.c:4305 Code: ff ff e8 ef 91 57 fe e9 38 01 00 00 e8 e5 91 57 fe 49 bc 00 00 00 00 00 fc ff df 49 8d 7d 08 49 8d 5d 09 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 6a 1f 00 00 4c 8b 74 24 70 4c 2b 74 24 RSP: 0018:ffffc9000335e1c0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000009 RCX: 0000000000080000 RDX: ffffc90005af9000 RSI: 000000000001ea5f RDI: 0000000000000008 RBP: ffffc9000335e8f0 R08: ffffc9000335eb50 R09: 0000000000000002 R10: 0000000000000002 R11: 0000000000000002 R12: dffffc0000000000 R13: 0000000000000000 R14: ffff88807edf80f8 R15: ffff88805eb05df8 FS: 00007fe77e05a6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557eeb74e8 CR3: 0000000023a53000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: ff ljmp (bad) 1: e8 ef 91 57 fe call 0xfe5791f5 6: e9 38 01 00 00 jmp 0x143 b: e8 e5 91 57 fe call 0xfe5791f5 10: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 17: fc ff df 1a: 49 8d 7d 08 lea 0x8(%r13),%rdi 1e: 49 8d 5d 09 lea 0x9(%r13),%rbx 22: 48 89 f8 mov %rdi,%rax 25: 48 c1 e8 03 shr $0x3,%rax * 29: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction 2e: 84 c0 test %al,%al 30: 0f 85 6a 1f 00 00 jne 0x1fa0 36: 4c 8b 74 24 70 mov 0x70(%rsp),%r14 3b: 4c rex.WR 3c: 2b .byte 0x2b 3d: 74 24 je 0x63