Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0-rc4-next-20240823-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:191 [inline] RIP: 0010:____rb_erase_color lib/rbtree.c:255 [inline] RIP: 0010:rb_erase+0x530/0xe70 lib/rbtree.c:445 Code: 00 00 74 08 4c 89 ef e8 de c5 44 f6 4d 89 7d 00 49 8d 6f 01 48 8b 5c 24 08 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 80 3c 28 00 74 08 48 89 df e8 b1 c5 44 f6 48 89 2b 4c 89 fd 48 RSP: 0018:ffffc900001a7900 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: dffffc0000000000 RSI: ffff8880b903f860 RDI: ffff888021c1dcc8 RBP: ffff88802b8b5cc1 R08: ffffffff901c1bc7 R09: 1ffffffff2038378 R10: dffffc0000000000 R11: ffffffff816786c0 R12: ffff88802b8b5cc0 R13: dffffc0000000000 R14: 1ffff11005716b98 R15: ffff88802b8b5cc0 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c1cff8 CR3: 0000000077430000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sched_core_dequeue kernel/sched/core.c:283 [inline] dequeue_task+0x34d/0x550 kernel/sched/core.c:2031 deactivate_task kernel/sched/core.c:2074 [inline] try_steal_cookie kernel/sched/core.c:6306 [inline] steal_cookie_task kernel/sched/core.c:6333 [inline] sched_core_balance+0xc6f/0x1180 kernel/sched/core.c:6353 do_balance_callbacks kernel/sched/core.c:4963 [inline] __balance_callbacks+0x188/0x280 kernel/sched/core.c:5017 finish_lock_switch kernel/sched/core.c:5064 [inline] finish_task_switch+0x1d3/0x870 kernel/sched/core.c:5183 context_switch kernel/sched/core.c:5314 [inline] __schedule+0x1852/0x4b30 kernel/sched/core.c:6677 schedule_idle+0x53/0x90 kernel/sched/core.c:6795 do_idle+0x56a/0x5d0 kernel/sched/idle.c:354 cpu_startup_entry+0x42/0x60 kernel/sched/idle.c:424 start_secondary+0x102/0x110 arch/x86/kernel/smpboot.c:313 common_startup_64+0x13e/0x147 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:191 [inline] RIP: 0010:____rb_erase_color lib/rbtree.c:255 [inline] RIP: 0010:rb_erase+0x530/0xe70 lib/rbtree.c:445 Code: 00 00 74 08 4c 89 ef e8 de c5 44 f6 4d 89 7d 00 49 8d 6f 01 48 8b 5c 24 08 48 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 80 3c 28 00 74 08 48 89 df e8 b1 c5 44 f6 48 89 2b 4c 89 fd 48 RSP: 0018:ffffc900001a7900 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: dffffc0000000000 RSI: ffff8880b903f860 RDI: ffff888021c1dcc8 RBP: ffff88802b8b5cc1 R08: ffffffff901c1bc7 R09: 1ffffffff2038378 R10: dffffc0000000000 R11: ffffffff816786c0 R12: ffff88802b8b5cc0 R13: dffffc0000000000 R14: 1ffff11005716b98 R15: ffff88802b8b5cc0 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32c1cff8 CR3: 0000000077430000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 74 08 je 0xc 4: 4c 89 ef mov %r13,%rdi 7: e8 de c5 44 f6 call 0xf644c5ea c: 4d 89 7d 00 mov %r15,0x0(%r13) 10: 49 8d 6f 01 lea 0x1(%r15),%rbp 14: 48 8b 5c 24 08 mov 0x8(%rsp),%rbx 19: 48 89 d8 mov %rbx,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13 27: fc ff df * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 b1 c5 44 f6 call 0xf644c5ea 39: 48 89 2b mov %rbp,(%rbx) 3c: 4c 89 fd mov %r15,%rbp 3f: 48 rex.W