general protection fault, probably for non-canonical address 0xfc681a563c681e56: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0xe340f2b1e340f2b0-0xe340f2b1e340f2b7]
CPU: 1 PID: 4187 Comm: syz-executor.2 Not tainted 6.3.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:may_create_in_sticky fs/namei.c:1238 [inline]
RIP: 0010:do_open fs/namei.c:3538 [inline]
RIP: 0010:path_openat+0xd23/0x2750 fs/namei.c:3715
Code: b4 90 0c 31 ff 48 8b 5b 68 89 ee e8 67 10 9c ff 85 ed 75 3d e8 0e 14 9c ff 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 0f 85 1a 0e 00 00 0f b7 2b bf 00 10 00 00 66 81
RSP: 0018:ffffc90027b27630 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: e340f2b1e340f2b1 RCX: 0000000000000000
RDX: 1c681e563c681e56 RSI: ffffffff81e6d752 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888015ea39fc R14: 00000000000280c2 R15: ffffc90027b27770
FS:  0000000000000000(0000) GS:ffff88802c700000(0063) knlGS:00000000f7feeb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f72b2e13 CR3: 0000000070168000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_filp_open+0x1ba/0x410 fs/namei.c:3742
 file_open_name+0x2ac/0x420 fs/open.c:1293
 filp_open+0x4b/0x80 fs/open.c:1313
 do_coredump+0x17e5/0x3cc0 fs/coredump.c:703
 get_signal+0x1bff/0x25b0 kernel/signal.c:2845
 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
 exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
 exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:310
 exc_page_fault+0xc0/0x170 arch/x86/mm/fault.c:1557
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0023:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000000020000210 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:may_create_in_sticky fs/namei.c:1238 [inline]
RIP: 0010:do_open fs/namei.c:3538 [inline]
RIP: 0010:path_openat+0xd23/0x2750 fs/namei.c:3715
Code: b4 90 0c 31 ff 48 8b 5b 68 89 ee e8 67 10 9c ff 85 ed 75 3d e8 0e 14 9c ff 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 0f 85 1a 0e 00 00 0f b7 2b bf 00 10 00 00 66 81
RSP: 0018:ffffc90027b27630 EFLAGS: 00010a06
RAX: dffffc0000000000 RBX: e340f2b1e340f2b1 RCX: 0000000000000000
RDX: 1c681e563c681e56 RSI: ffffffff81e6d752 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888015ea39fc R14: 00000000000280c2 R15: ffffc90027b27770
FS:  0000000000000000(0000) GS:ffff88802c600000(0063) knlGS:00000000f7feeb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000eddfe000 CR3: 0000000070168000 CR4: 0000000000150ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	b4 90                	mov    $0x90,%ah
   2:	0c 31                	or     $0x31,%al
   4:	ff 48 8b             	decl   -0x75(%rax)
   7:	5b                   	pop    %rbx
   8:	68 89 ee e8 67       	pushq  $0x67e8ee89
   d:	10 9c ff 85 ed 75 3d 	adc    %bl,0x3d75ed85(%rdi,%rdi,8)
  14:	e8 0e 14 9c ff       	callq  0xff9c1427
  19:	48 89 da             	mov    %rbx,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 1a 0e 00 00    	jne    0xe50
  36:	0f b7 2b             	movzwl (%rbx),%ebp
  39:	bf 00 10 00 00       	mov    $0x1000,%edi
  3e:	66                   	data16
  3f:	81                   	.byte 0x81