general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 PID: 8372 Comm: syz-executor.0 Not tainted 6.2.0-rc5-syzkaller-00047-g7c46948a6e9c-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/16/2023 RIP: 0010:f2fs_get_dnode_of_data+0xd6/0x1e00 Code: 44 24 60 80 3c 18 00 74 08 4c 89 e7 e8 23 67 12 fe 4d 8b 34 24 4d 8d 7e 28 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 fc 66 12 fe bb 78 06 00 00 49 03 1f RSP: 0018:ffffc9000b566cc0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 00000000000000fa RDI: ffffc9000b566f20 RBP: ffffc9000b566e70 R08: ffffffff83cb7375 R09: fffffbfff1c6d326 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc9000b566f20 R13: 1ffff920016acdac R14: 0000000000000000 R15: 0000000000000028 FS: 00007f3cf53db700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020103000 CR3: 00000000266cb000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: f2fs_do_write_data_page+0x5d7/0x27c0 f2fs_write_single_data_page+0x14c1/0x2140 f2fs_write_data_pages+0x1948/0x2ed0 do_writepages+0x3a6/0x660 filemap_fdatawrite_wbc+0x125/0x180 file_write_and_wait_range+0x21f/0x320 f2fs_do_sync_file+0x7b6/0x1de0 f2fs_file_write_iter+0x7fc/0x2c20 vfs_write+0x7dd/0xc50 ksys_write+0x17c/0x2a0 do_syscall_64+0x41/0xc0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f3cf468c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3cf53db168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3cf47abf80 RCX: 00007f3cf468c0c9 RDX: 00000000000ffe00 RSI: 0000000020004200 RDI: 0000000000000004 RBP: 00007f3cf46e7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9592697f R14: 00007f3cf53db300 R15: 0000000000022000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:f2fs_get_dnode_of_data+0xd6/0x1e00 Code: 44 24 60 80 3c 18 00 74 08 4c 89 e7 e8 23 67 12 fe 4d 8b 34 24 4d 8d 7e 28 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 fc 66 12 fe bb 78 06 00 00 49 03 1f RSP: 0018:ffffc9000b566cc0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: dffffc0000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 00000000000000fa RDI: ffffc9000b566f20 RBP: ffffc9000b566e70 R08: ffffffff83cb7375 R09: fffffbfff1c6d326 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc9000b566f20 R13: 1ffff920016acdac R14: 0000000000000000 R15: 0000000000000028 FS: 00007f3cf53db700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3cf53ba718 CR3: 00000000266cb000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 44 24 60 rex.R and $0x60,%al 3: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) 7: 74 08 je 0x11 9: 4c 89 e7 mov %r12,%rdi c: e8 23 67 12 fe callq 0xfe126734 11: 4d 8b 34 24 mov (%r12),%r14 15: 4d 8d 7e 28 lea 0x28(%r14),%r15 19: 4c 89 f8 mov %r15,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ff mov %r15,%rdi 33: e8 fc 66 12 fe callq 0xfe126734 38: bb 78 06 00 00 mov $0x678,%ebx 3d: 49 03 1f add (%r15),%rbx