kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 2 PID: 11305 Comm: syz-executor1 Not tainted 4.13.0-rc4-next-20170811 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88006cd04200 task.stack: ffff880061cf0000
RIP: 0010:create_empty_buffers+0xeb/0x7b0 fs/buffer.c:1581
RSP: 0018:ffff880061cf6ea8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90000f43000
RDX: 0000000000000449 RSI: ffffffff81b79544 RDI: ffffea00018bbe80
RBP: ffff880061cf70b0 R08: 0000000000000000 R09: ffffea00018bbea0
R10: 1ffff1000c39ed46 R11: ffff88003e498450 R12: ffffea00018bbe80
R13: 0000000000000000 R14: ffff880061cf7088 R15: dffffc0000000000
FS:  00007fca7ce59700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd66dc87000 CR3: 000000003d39e000 CR4: 00000000000006e0
DR0: 0000000020000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 create_page_buffers+0x1ed/0x290 fs/buffer.c:1695
 __block_write_begin_int+0x22c/0x1410 fs/buffer.c:2005
 __block_write_begin fs/buffer.c:2076 [inline]
 block_write_begin+0xd2/0x2e0 fs/buffer.c:2135
 blkdev_write_begin+0x3c/0x50 fs/block_dev.c:596
 generic_perform_write+0x28c/0x650 mm/filemap.c:2979
 __generic_file_write_iter+0x366/0x5b0 mm/filemap.c:3104
 blkdev_write_iter+0x1cf/0x390 fs/block_dev.c:1897
 call_write_iter include/linux/fs.h:1742 [inline]
 do_iter_readv_writev+0x525/0x7f0 fs/read_write.c:650
 do_iter_write+0x154/0x540 fs/read_write.c:929
 vfs_iter_write+0x77/0xb0 fs/read_write.c:942
 iter_file_splice_write+0x7e9/0xf50 fs/splice.c:765
 do_splice_from fs/splice.c:867 [inline]
 direct_splice_actor+0x125/0x180 fs/splice.c:1034
 splice_direct_to_actor+0x2c1/0x820 fs/splice.c:989
 do_splice_direct+0x29b/0x3c0 fs/splice.c:1077
 do_sendfile+0x5c9/0xe80 fs/read_write.c:1412
 SYSC_sendfile64 fs/read_write.c:1467 [inline]
 SyS_sendfile64+0xbd/0x160 fs/read_write.c:1459
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x446739
RSP: 002b:00007fca7ce58c08 EFLAGS: 00000282 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000016 RCX: 0000000000446739
RDX: 00000000200ddff8 RSI: 000000000000001b RDI: 0000000000000016
RBP: 0000000000a5f870 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000100000001 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fca7ce599c0 R15: 00007fca7ce59700
Code: 4c 89 ee ba 01 00 00 00 4c 89 e7 e8 c0 e3 ff ff 48 89 85 18 fe ff ff 49 89 c5 eb 03 49 89 c5 e8 ac d7 b5 ff 4c 89 e8 48 c1 e8 03 <42> 80 3c 38 00 0f 85 44 06 00 00 49 8d 7d 08 49 09 5d 00 48 89 
RIP: create_empty_buffers+0xeb/0x7b0 fs/buffer.c:1581 RSP: ffff880061cf6ea8
---[ end trace fe8edf33033ef185 ]---