... Log Wrap ... Log Wrap ... Log Wrap ...
 ... Log Wrap ... Log Wrap ... Log Wrap ...
 ... Log Wrap ... Log Wrap ... Log Wrap ...
 ... Log Wrap ... Log Wrap ... Log Wrap ...
 ... Log Wrap ... Log Wrap ... Log Wrap ...
BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 1535 Comm: jfsCommit Not tainted 4.19.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
RIP: 0010:write_special_inodes+0x2c/0x60 fs/jfs/jfs_logmgr.c:221
Code: 07 48 39 c7 74 51 55 48 89 e5 41 55 49 89 fd 41 54 49 89 f4 53 48 8d 58 c8 48 8b 43 10 48 8b 78 30 e8 a8 e4 48 01 48 8b 43 28 <48> 8b 78 30 e8 9b e4 48 01 48 8b 83 b0 00 00 00 48 8b 78 30 e8 8b
RSP: 0018:ffffc90003673dc0 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffff8801331fab00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003673d28
RBP: ffffc90003673dd8 R08: 0000000000000000 R09: 00000000aea67acf
R10: 0000000000000000 R11: 0000000000000010 R12: ffffffff81207df0
R13: ffff88012ee49800 R14: ffff88012ee49800 R15: dead000000000100
FS:  0000000000000000(0000) GS:ffff88013ba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000030 CR3: 00000001337ea000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 lmLogSync+0x37/0x1f0 fs/jfs/jfs_logmgr.c:956
 jfs_syncpt+0x42/0x60 fs/jfs/jfs_logmgr.c:1062
 txEnd+0x120/0x150 fs/jfs/jfs_txnmgr.c:557
 txLazyCommit fs/jfs/jfs_txnmgr.c:2730 [inline]
 jfs_lazycommit+0x28e/0x350 fs/jfs/jfs_txnmgr.c:2778
 kthread+0x11c/0x140 kernel/kthread.c:246
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:413
Modules linked in:
CR2: 0000000000000030
---[ end trace 82f67f9fe0503496 ]---
RIP: 0010:write_special_inodes+0x2c/0x60 fs/jfs/jfs_logmgr.c:221
Code: 07 48 39 c7 74 51 55 48 89 e5 41 55 49 89 fd 41 54 49 89 f4 53 48 8d 58 c8 48 8b 43 10 48 8b 78 30 e8 a8 e4 48 01 48 8b 43 28 <48> 8b 78 30 e8 9b e4 48 01 48 8b 83 b0 00 00 00 48 8b 78 30 e8 8b
RSP: 0018:ffffc90003673dc0 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffff8801331fab00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003673d28
RBP: ffffc90003673dd8 R08: 0000000000000000 R09: 00000000aea67acf
R10: 0000000000000000 R11: 0000000000000010 R12: ffffffff81207df0
R13: ffff88012ee49800 R14: ffff88012ee49800 R15: dead000000000100
FS:  0000000000000000(0000) GS:ffff88013ba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000030 CR3: 00000001337ea000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 39 c7             	cmp    %rax,%rdi
   3:	74 51                	je     0x56
   5:	55                   	push   %rbp
   6:	48 89 e5             	mov    %rsp,%rbp
   9:	41 55                	push   %r13
   b:	49 89 fd             	mov    %rdi,%r13
   e:	41 54                	push   %r12
  10:	49 89 f4             	mov    %rsi,%r12
  13:	53                   	push   %rbx
  14:	48 8d 58 c8          	lea    -0x38(%rax),%rbx
  18:	48 8b 43 10          	mov    0x10(%rbx),%rax
  1c:	48 8b 78 30          	mov    0x30(%rax),%rdi
  20:	e8 a8 e4 48 01       	call   0x148e4cd
  25:	48 8b 43 28          	mov    0x28(%rbx),%rax
* 29:	48 8b 78 30          	mov    0x30(%rax),%rdi <-- trapping instruction
  2d:	e8 9b e4 48 01       	call   0x148e4cd
  32:	48 8b 83 b0 00 00 00 	mov    0xb0(%rbx),%rax
  39:	48 8b 78 30          	mov    0x30(%rax),%rdi
  3d:	e8                   	.byte 0xe8
  3e:	8b                   	.byte 0x8b