Oops: general protection fault, probably for non-canonical address 0xc00000000180025b: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 36 Comm: kworker/0:1H Not tainted 6.13.0-syzkaller-09760-g69e858e0b8b2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: bcachefs_btree_read_complete btree_node_read_work
RIP: 0010:find_stack lib/stackdepot.c:553 [inline]
RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618
Code: 00 31 f6 48 89 d5 4c 89 cb e8 48 2c c8 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7
RSP: 0018:ffffc900000079f0 EFLAGS: 00010283
RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 00000000001fc750
RDX: ffff88805e3fc750 RSI: 0000000000000002 RDI: 0000000046f2ba9a
RBP: 00000000653decb0 R08: ffffc90000007aa0 R09: 0000000000000007
R10: ffffc90000007930 R11: ffffffff81ab2f20 R12: ffff888052481068
R13: 0000000000000007 R14: 00000000f101fc75 R15: c00000000180024b
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc310d10c8 CR3: 0000000011d54000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ref_tracker_free+0x114/0x7e0 lib/ref_tracker.c:240
 netdev_tracker_free include/linux/netdevice.h:4295 [inline]
 netdev_put include/linux/netdevice.h:4312 [inline]
 dst_destroy+0x105/0x360 net/core/dst.c:114
 rcu_do_batch kernel/rcu/tree.c:2546 [inline]
 rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2802
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_flush_all+0x996/0xeb0
Code: 48 21 c3 0f 85 16 02 00 00 e8 06 81 20 00 4c 8b 7c 24 10 4d 85 f6 75 07 e8 f7 80 20 00 eb 06 e8 f0 80 20 00 fb 48 8b 5c 24 18 <48> 8b 44 24 30 42 80 3c 28 00 74 08 48 89 df e8 d6 15 87 00 4c 8b
RSP: 0018:ffffc90000576a60 EFLAGS: 00000293
RAX: ffffffff819eebd0 RBX: ffffffff8f183a78 RCX: ffff88801e0f4880
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000576c10 R08: ffffffff819eeba7 R09: 1ffffffff285ed08
R10: dffffc0000000000 R11: fffffbfff285ed09 R12: ffffffff8f183a20
R13: dffffc0000000000 R14: 0000000000000200 R15: ffffc90000576c60
 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
 console_unlock+0x14f/0x3b0 kernel/printk/printk.c:3309
 __bch2_fsck_err+0x1044/0x1420 fs/bcachefs/error.c:426
 __btree_err+0x64a/0x760 fs/bcachefs/btree_io.c:581
 validate_bset_keys+0x45a/0x1b00 fs/bcachefs/btree_io.c:919
 bch2_btree_node_read_done+0x21a5/0x5f70 fs/bcachefs/btree_io.c:1164
 btree_node_read_work+0x6dc/0x1380 fs/bcachefs/btree_io.c:1358
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:find_stack lib/stackdepot.c:553 [inline]
RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618
Code: 00 31 f6 48 89 d5 4c 89 cb e8 48 2c c8 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7
RSP: 0018:ffffc900000079f0 EFLAGS: 00010283
RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 00000000001fc750
RDX: ffff88805e3fc750 RSI: 0000000000000002 RDI: 0000000046f2ba9a
RBP: 00000000653decb0 R08: ffffc90000007aa0 R09: 0000000000000007
R10: ffffc90000007930 R11: ffffffff81ab2f20 R12: ffff888052481068
R13: 0000000000000007 R14: 00000000f101fc75 R15: c00000000180024b
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055cc310d10c8 CR3: 0000000011d54000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 31                	add    %dh,(%rcx)
   2:	f6 48 89 d5          	testb  $0xd5,-0x77(%rax)
   6:	4c 89 cb             	mov    %r9,%rbx
   9:	e8 48 2c c8 ff       	call   0xffc82c56
   e:	49 89 d9             	mov    %rbx,%r9
  11:	8b 5c 24 04          	mov    0x4(%rsp),%ebx
  15:	48 89 ea             	mov    %rbp,%rdx
  18:	4c 8b 44 24 08       	mov    0x8(%rsp),%r8
  1d:	45 85 e4             	test   %r12d,%r12d
  20:	75 67                	jne    0x89
  22:	4d 8b 3f             	mov    (%r15),%r15
  25:	49 39 d7             	cmp    %rdx,%r15
  28:	74 5c                	je     0x86
* 2a:	45 39 77 10          	cmp    %r14d,0x10(%r15) <-- trapping instruction
  2e:	75 f2                	jne    0x22
  30:	45 39 4f 14          	cmp    %r9d,0x14(%r15)
  34:	75 ec                	jne    0x22
  36:	31 c0                	xor    %eax,%eax
  38:	49 8b 0c c0          	mov    (%r8,%rax,8),%rcx
  3c:	49                   	rex.WB
  3d:	3b                   	.byte 0x3b
  3e:	4c                   	rex.WR
  3f:	c7                   	.byte 0xc7