Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted 6.13.0-rc6-syzkaller-00059-g643e2e259c2b #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:bfs_move_block fs/bfs/file.c:43 [inline] RIP: 0010:bfs_move_blocks fs/bfs/file.c:57 [inline] RIP: 0010:bfs_get_block+0xa75/0xb70 fs/bfs/file.c:126 Code: 00 41 8b 0f b8 77 7f ff ff 21 c1 81 c9 08 80 00 00 4c 89 ef 4c 89 f6 e8 79 c7 ac ff 49 89 c5 48 8d 68 28 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 1c fd 88 ff 4c 8b 75 00 48 8d 7b RSP: 0018:ffffc9000d42eb90 EFLAGS: 00010206 RAX: 0000000000000005 RBX: ffff8880528c5ae0 RCX: ffff888000962440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000028 R08: ffffffff8229b6d4 R09: 1ffffd40002a1836 R10: dffffc0000000000 R11: fffff940002a1837 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000044 R15: ffff888031ce4e68 FS: 00007f11cbd5f6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f11bfdff000 CR3: 0000000052226000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __block_write_begin_int+0x692/0x19a0 fs/buffer.c:2116 block_write_begin+0x8f/0x120 fs/buffer.c:2226 bfs_write_begin+0x35/0xd0 fs/bfs/file.c:179 generic_perform_write+0x346/0x990 mm/filemap.c:4046 generic_file_write_iter+0xae/0x310 mm/filemap.c:4173 __kernel_write_iter+0x42a/0x940 fs/read_write.c:612 __kernel_write+0x120/0x180 fs/read_write.c:632 __dump_emit+0x237/0x360 fs/coredump.c:807 elf_core_dump+0x3624/0x4790 fs/binfmt_elf.c:2108 do_coredump+0x229b/0x3100 fs/coredump.c:758 get_signal+0x140b/0x1750 kernel/signal.c:3002 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] irqentry_exit_to_user_mode+0x7e/0x250 kernel/entry/common.c:231 exc_general_protection+0x410/0x5d0 arch/x86/kernel/traps.c:693 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617 RIP: 0033:0x7f11caf85d31 Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f RSP: 002b:00000000200002c0 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f11cb176160 RCX: 00007f11caf85d29 RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000001000000 RBP: 00007f11cb001b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f11cb176160 R15: 00007ffd774692f8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bfs_move_block fs/bfs/file.c:43 [inline] RIP: 0010:bfs_move_blocks fs/bfs/file.c:57 [inline] RIP: 0010:bfs_get_block+0xa75/0xb70 fs/bfs/file.c:126 Code: 00 41 8b 0f b8 77 7f ff ff 21 c1 81 c9 08 80 00 00 4c 89 ef 4c 89 f6 e8 79 c7 ac ff 49 89 c5 48 8d 68 28 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 1c fd 88 ff 4c 8b 75 00 48 8d 7b RSP: 0018:ffffc9000d42eb90 EFLAGS: 00010206 RAX: 0000000000000005 RBX: ffff8880528c5ae0 RCX: ffff888000962440 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000028 R08: ffffffff8229b6d4 R09: 1ffffd40002a1836 R10: dffffc0000000000 R11: fffff940002a1837 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000044 R15: ffff888031ce4e68 FS: 00007f11cbd5f6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f11bfdff000 CR3: 0000000052226000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 41 8b 0f mov (%r15),%ecx 3: b8 77 7f ff ff mov $0xffff7f77,%eax 8: 21 c1 and %eax,%ecx a: 81 c9 08 80 00 00 or $0x8008,%ecx 10: 4c 89 ef mov %r13,%rdi 13: 4c 89 f6 mov %r14,%rsi 16: e8 79 c7 ac ff call 0xffacc794 1b: 49 89 c5 mov %rax,%r13 1e: 48 8d 68 28 lea 0x28(%rax),%rbp 22: 48 89 e8 mov %rbp,%rax 25: 48 c1 e8 03 shr $0x3,%rax * 29: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 48 89 ef mov %rbp,%rdi 33: e8 1c fd 88 ff call 0xff88fd54 38: 4c 8b 75 00 mov 0x0(%rbp),%r14 3c: 48 rex.W 3d: 8d .byte 0x8d 3e: 7b .byte 0x7b