Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 5470 Comm: syz.4.41 Not tainted 6.11.0-rc4-next-20240822-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:format_decode+0x4f1/0x1bb0
Code: 85 ed 0f 00 00 48 c7 c3 00 ff ff ff 48 8b 44 24 10 48 23 18 e9 65 03 00 00 e8 0b 84 db f5 eb 05 e8 04 84 db f5 48 8b 44 24 30 <42> 80 3c 30 00 74 0d 48 8d bc 24 80 00 00 00 e8 db 0b 44 f6 4c 89
RSP: 0018:ffffc900046a6240 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffffff8c0995ef RCX: ffff88802b1e0000
RDX: 0000000000000000 RSI: ffffffff90031940 RDI: 0000000000000025
RBP: ffffc900046a6330 R08: 0000000000000001 R09: ffffffff8bb8796a
R10: 0000000000000002 R11: ffff88802b1e0000 R12: ffffffff8c0995c0
R13: ffffffff8c0995ef R14: dffffc0000000000 R15: 0000000000000025
FS:  0000555575b16500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000009 CR3: 000000001bade000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 vsnprintf+0x14f/0x1da0 lib/vsprintf.c:2776
 vscnprintf+0x42/0x90 lib/vsprintf.c:2930
 panic+0x245/0x880 kernel/panic.c:342
 __stack_chk_fail+0x15/0x20 kernel/panic.c:836
 search_extable+0xf6/0x100
 search_kernel_exception_table kernel/extable.c:49 [inline]
 search_exception_tables+0x3a/0x60 kernel/extable.c:58
 fixup_exception+0xaf/0x1cc0 arch/x86/mm/extable.c:320
 gp_try_fixup_and_notify arch/x86/kernel/traps.c:667 [inline]
 __exc_general_protection arch/x86/kernel/traps.c:727 [inline]
 exc_general_protection+0x1e8/0x5d0 arch/x86/kernel/traps.c:693
 asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:617
RIP: 0010:vsnprintf+0xf2/0x1da0 lib/vsprintf.c:2774
Code: 00 00 4b 8d 04 26 4c 39 f0 4c 89 f3 48 f7 d3 48 c7 c1 ff ff ff ff 48 0f 43 c8 48 89 4c 24 18 49 0f 43 dc 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 66 1c 00 00 45 0f b6 27 31 ff 44 89 e6
RSP: 0018:ffffc900046a6a00 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffc900046a6c98
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000007fffffff
RBP: ffffc900046a6af0 R08: ffffffff8bb85a7d R09: 0000000000000000
R10: ffffc900046a6cb0 R11: fffff520008d4d99 R12: 0000000000000008
R13: dffffc0000000000 R14: ffffc900046a6c90 R15: 0000000000000000
 vprintk_store+0x480/0x1160 kernel/printk/printk.c:2255
 vprintk_emit+0x39b/0xa10 kernel/printk/printk.c:2378
 insn_get_addr_ref+0xd1/0xe10 arch/x86/lib/insn-eval.c:1450
 page_fault_oops+0x540/0xcc0 arch/x86/mm/fault.c:705
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x5ed/0x8c0 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:0x9
Code: Unable to access opcode bytes at 0xffffffffffffffdf.
RSP: 0018:ffffc900046a7220 EFLAGS: 00010082
RAX: 0000000000000093 RBX: 0000000000000000 RCX: ffffffff94f95903
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900046a73b8 R08: ffffffff84b24b75 R09: 1ffffffff2038869
R10: dffffc0000000000 R11: fffffbfff203886a R12: 1ffff920008d4e50
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000010
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:format_decode+0x4f1/0x1bb0
Code: 85 ed 0f 00 00 48 c7 c3 00 ff ff ff 48 8b 44 24 10 48 23 18 e9 65 03 00 00 e8 0b 84 db f5 eb 05 e8 04 84 db f5 48 8b 44 24 30 <42> 80 3c 30 00 74 0d 48 8d bc 24 80 00 00 00 e8 db 0b 44 f6 4c 89
RSP: 0018:ffffc900046a6240 EFLAGS: 00010093
RAX: 0000000000000000 RBX: ffffffff8c0995ef RCX: ffff88802b1e0000
RDX: 0000000000000000 RSI: ffffffff90031940 RDI: 0000000000000025
RBP: ffffc900046a6330 R08: 0000000000000001 R09: ffffffff8bb8796a
R10: 0000000000000002 R11: ffff88802b1e0000 R12: ffffffff8c0995c0
R13: ffffffff8c0995ef R14: dffffc0000000000 R15: 0000000000000025
FS:  0000555575b16500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffdf CR3: 000000001bade000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	85 ed                	test   %ebp,%ebp
   2:	0f 00 00             	sldt   (%rax)
   5:	48 c7 c3 00 ff ff ff 	mov    $0xffffffffffffff00,%rbx
   c:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  11:	48 23 18             	and    (%rax),%rbx
  14:	e9 65 03 00 00       	jmp    0x37e
  19:	e8 0b 84 db f5       	call   0xf5db8429
  1e:	eb 05                	jmp    0x25
  20:	e8 04 84 db f5       	call   0xf5db8429
  25:	48 8b 44 24 30       	mov    0x30(%rsp),%rax
* 2a:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2f:	74 0d                	je     0x3e
  31:	48 8d bc 24 80 00 00 	lea    0x80(%rsp),%rdi
  38:	00
  39:	e8 db 0b 44 f6       	call   0xf6440c19
  3e:	4c                   	rex.WR
  3f:	89                   	.byte 0x89