smpboot: CPU 1 is now offline general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 4369 Comm: kworker/0:7 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Workqueue: events work_for_cpu_fn RIP: 0010:xlog_cil_pcp_dead+0x2d/0x4c0 fs/xfs/xfs_log_cil.c:1806 Code: 41 56 41 55 41 54 53 48 83 ec 28 89 f5 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 9e 59 6b fe 48 83 c3 10 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 54 bd bc fe 4c 8b 3b 49 8d 9f 58 RSP: 0018:ffffc900041a7a48 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff88807d903c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffe8ffffd9bccf R09: 1ffffd1ffffb3799 R10: dffffc0000000000 R11: fffff91ffffb379a R12: dffffc0000000000 R13: ffffffff8df89500 R14: ffff888052658140 R15: ffff888052658000 FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff8c137da8 CR3: 000000005b711000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: xfs_cpu_dead+0x94/0xe0 fs/xfs/xfs_super.c:2260 cpuhp_invoke_callback+0x423/0x7e0 kernel/cpu.c:192 __cpuhp_invoke_callback_range kernel/cpu.c:700 [inline] cpuhp_invoke_callback_range kernel/cpu.c:724 [inline] cpuhp_down_callbacks kernel/cpu.c:1157 [inline] _cpu_down+0x4af/0xc90 kernel/cpu.c:1218 __cpu_down_maps_locked+0x45/0x80 kernel/cpu.c:1249 work_for_cpu_fn+0x50/0x80 kernel/workqueue.c:5188 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xdd1/0x12a0 kernel/workqueue.c:2444 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:xlog_cil_pcp_dead+0x2d/0x4c0 fs/xfs/xfs_log_cil.c:1806 Code: 41 56 41 55 41 54 53 48 83 ec 28 89 f5 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 9e 59 6b fe 48 83 c3 10 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 54 bd bc fe 4c 8b 3b 49 8d 9f 58 RSP: 0018:ffffc900041a7a48 EFLAGS: 00010202 RAX: 0000000000000002 RBX: 0000000000000010 RCX: ffff88807d903c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: ffffe8ffffd9bccf R09: 1ffffd1ffffb3799 R10: dffffc0000000000 R11: fffff91ffffb379a R12: dffffc0000000000 R13: ffffffff8df89500 R14: ffff888052658140 R15: ffff888052658000 FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559eb156f670 CR3: 000000007e6a8000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 41 56 push %r14 2: 41 55 push %r13 4: 41 54 push %r12 6: 53 push %rbx 7: 48 83 ec 28 sub $0x28,%rsp b: 89 f5 mov %esi,%ebp d: 48 89 fb mov %rdi,%rbx 10: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 17: fc ff df 1a: e8 9e 59 6b fe call 0xfe6b59bd 1f: 48 83 c3 10 add $0x10,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 54 bd bc fe call 0xfebcbd8d 39: 4c 8b 3b mov (%rbx),%r15 3c: 49 rex.WB 3d: 8d .byte 0x8d 3e: 9f lahf 3f: 58 pop %rax