Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 UID: 0 PID: 22748 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:_compound_head include/linux/page-flags.h:242 [inline]
RIP: 0010:get_page include/linux/mm.h:1461 [inline]
RIP: 0010:__skb_frag_ref+0x4d/0x1d0 include/linux/skbuff_ref.h:20
Code: 48 89 df e8 a5 be 7c f8 4c 8b 33 31 c0 4c 89 f6 48 83 e6 01 4c 0f 45 f0 31 ff e8 7e e6 18 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 75 be 7c f8 48 8b 1b 48 89 de 48 83
RSP: 0018:ffffc90000a18840 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88807e668000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff898691f2 R09: 1ffff1100c9dfa6c
R10: dffffc0000000000 R11: ffffed100c9dfa6d R12: dffffc0000000000
R13: ffff888064efd370 R14: 0000000000000000 R15: 0000000000000000
FS: 0000555556f20500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000009ae16000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
skb_frag_ref include/linux/skbuff_ref.h:32 [inline]
pskb_expand_head+0x74b/0x1380 net/core/skbuff.c:2300
__skb_unclone_keeptruesize+0x87/0x2c0 net/core/skbuff.c:2375
skb_unclone_keeptruesize include/linux/skbuff.h:1998 [inline]
__tcp_retransmit_skb+0x58d/0x1500 net/ipv4/tcp_output.c:3376
tcp_send_loss_probe+0x426/0x8f0 net/ipv4/tcp_output.c:2982
tcp_write_timer+0x166/0x2e0 net/ipv4/tcp_timer.c:735
call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
expire_timers kernel/time/timer.c:1844 [inline]
__run_timers kernel/time/timer.c:2418 [inline]
__run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430
run_timer_base kernel/time/timer.c:2439 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 4a 48 b7 f5 48 89 df e8 82 8f b8 f5 e8 6d a0 e3 f5 fb bf 01 00 00 00 a2 f4 a9 f5 65 8b 05 13 47 40 74 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc9000d0476b8 EFLAGS: 00000286
RAX: cfd153d75cbaf000 RBX: ffff888059fabe70 RCX: ffffffff817b26fa
RDX: dffffc0000000000 RSI: ffffffff8c0a98e0 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffffff94271897 R09: 1ffffffff284e312
R10: dffffc0000000000 R11: fffffbfff284e313 R12: 0000000000000019
R13: 1ffff1100b3f57cd R14: ffffea00010b8b40 R15: ffff888059fabe68
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0xe9/0x1f0 mm/filemap.c:265
truncate_inode_folio+0x5d/0x70 mm/truncate.c:162
shmem_undo_range+0x44b/0x1820 mm/shmem.c:1040
shmem_truncate_range mm/shmem.c:1156 [inline]
shmem_evict_inode+0x29b/0xa80 mm/shmem.c:1284
evict+0x4e8/0x9a0 fs/inode.c:796
do_unlinkat+0x512/0x830 fs/namei.c:4594
__do_sys_unlink fs/namei.c:4635 [inline]
__se_sys_unlink fs/namei.c:4633 [inline]
__x64_sys_unlink+0x47/0x50 fs/namei.c:4633
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f98eab852d7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff3706c708 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f98eab852d7
RDX: 00007fff3706c730 RSI: 00007fff3706c7c0 RDI: 00007fff3706c7c0
RBP: 00007fff3706c7c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007fff3706d840
R13: 00007f98eac018f4 R14: 00007fff3706d880 R15: 0000000000000122
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:_compound_head include/linux/page-flags.h:242 [inline]
RIP: 0010:get_page include/linux/mm.h:1461 [inline]
RIP: 0010:__skb_frag_ref+0x4d/0x1d0 include/linux/skbuff_ref.h:20
Code: 48 89 df e8 a5 be 7c f8 4c 8b 33 31 c0 4c 89 f6 48 83 e6 01 4c 0f 45 f0 31 ff e8 7e e6 18 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 75 be 7c f8 48 8b 1b 48 89 de 48 83
RSP: 0018:ffffc90000a18840 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff88807e668000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff898691f2 R09: 1ffff1100c9dfa6c
R10: dffffc0000000000 R11: ffffed100c9dfa6d R12: dffffc0000000000
R13: ffff888064efd370 R14: 0000000000000000 R15: 0000000000000000
FS: 0000555556f20500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 000000009ae16000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 df mov %rbx,%rdi
3: e8 a5 be 7c f8 call 0xf87cbead
8: 4c 8b 33 mov (%rbx),%r14
b: 31 c0 xor %eax,%eax
d: 4c 89 f6 mov %r14,%rsi
10: 48 83 e6 01 and $0x1,%rsi
14: 4c 0f 45 f0 cmovne %rax,%r14
18: 31 ff xor %edi,%edi
1a: e8 7e e6 18 f8 call 0xf818e69d
1f: 49 8d 5e 08 lea 0x8(%r14),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 75 be 7c f8 call 0xf87cbead
38: 48 8b 1b mov (%rbx),%rbx
3b: 48 89 de mov %rbx,%rsi
3e: 48 rex.W
3f: 83 .byte 0x83