general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 PID: 6247 Comm: segctord Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:nilfs_dat_commit_end+0x58/0x6b0 fs/nilfs2/dat.c:205
Code: 18 4c 89 f8 48 c1 e8 03 48 89 44 24 08 42 80 3c 28 00 74 08 4c 89 ff e8 06 6b 98 fe 4d 8b 37 49 83 c6 10 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 e9 6a 98 fe 4d 8b 36 bf 01 00 00
RSP: 0018:ffffc900032a7318 EFLAGS: 00010202
RAX: 0000000000000002 RBX: ffff888025184b18 RCX: ffff8880247a8000
RDX: 0000000000000000 RSI: ffff888025184b18 RDI: ffff8880734ea7c8
RBP: 0000000000000000 R08: ffff88805e27c82f R09: 1ffff1100bc4f905
R10: dffffc0000000000 R11: ffffed100bc4f906 R12: ffff8880734ea7c8
R13: dffffc0000000000 R14: 0000000000000010 R15: ffff888025184b30
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe36b11438 CR3: 000000007dcf6000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 nilfs_dat_commit_update+0x28/0x40 fs/nilfs2/dat.c:261
 nilfs_btree_commit_update_v+0x93/0x410 fs/nilfs2/btree.c:1958
 nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2031 [inline]
 nilfs_btree_propagate_v fs/nilfs2/btree.c:2064 [inline]
 nilfs_btree_propagate+0x95e/0xcf0 fs/nilfs2/btree.c:2108
 nilfs_bmap_propagate+0x74/0x120 fs/nilfs2/bmap.c:345
 nilfs_collect_file_data+0x4f/0xd0 fs/nilfs2/segment.c:587
 nilfs_segctor_apply_buffers+0x15d/0x320 fs/nilfs2/segment.c:1050
 nilfs_segctor_scan_file+0x2a3/0x950 fs/nilfs2/segment.c:1089
 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1208 [inline]
 nilfs_segctor_collect fs/nilfs2/segment.c:1535 [inline]
 nilfs_segctor_do_construct+0x1b48/0x68a0 fs/nilfs2/segment.c:2091
 nilfs_segctor_construct+0x17b/0x690 fs/nilfs2/segment.c:2454
 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2562 [inline]
 nilfs_segctor_thread+0x536/0x10d0 fs/nilfs2/segment.c:2646
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:nilfs_dat_commit_end+0x58/0x6b0 fs/nilfs2/dat.c:205
Code: 18 4c 89 f8 48 c1 e8 03 48 89 44 24 08 42 80 3c 28 00 74 08 4c 89 ff e8 06 6b 98 fe 4d 8b 37 49 83 c6 10 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 f7 e8 e9 6a 98 fe 4d 8b 36 bf 01 00 00
RSP: 0018:ffffc900032a7318 EFLAGS: 00010202

RAX: 0000000000000002 RBX: ffff888025184b18 RCX: ffff8880247a8000
RDX: 0000000000000000 RSI: ffff888025184b18 RDI: ffff8880734ea7c8
RBP: 0000000000000000 R08: ffff88805e27c82f R09: 1ffff1100bc4f905
----------------
Code disassembly (best guess):
   0:	18 4c 89 f8          	sbb    %cl,-0x8(%rcx,%rcx,4)
   4:	48 c1 e8 03          	shr    $0x3,%rax
   8:	48 89 44 24 08       	mov    %rax,0x8(%rsp)
   d:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  12:	74 08                	je     0x1c
  14:	4c 89 ff             	mov    %r15,%rdi
  17:	e8 06 6b 98 fe       	call   0xfe986b22
  1c:	4d 8b 37             	mov    (%r15),%r14
  1f:	49 83 c6 10          	add    $0x10,%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 e9 6a 98 fe       	call   0xfe986b22
  39:	4d 8b 36             	mov    (%r14),%r14
  3c:	bf                   	.byte 0xbf
  3d:	01 00                	add    %eax,(%rax)