JBD2: I/O error when updating journal superblock for loop3-29.
(jbd2/loop3-29,2644,0):ocfs2_abort_trigger:596 ERROR: ocfs2_abort_trigger called by JBD2.  bh = 0xffff88810eaa1f18, bh->b_blocknr = 16969
OCFS2: ERROR (device (efault)): void ocfs2_abort_trigger(struct jbd2_buffer_trigger_type *, struct buffer_head *): JBD2 has aborted our journal, ocfs2 cannot continue
BUG: kernel NULL pointer dereference, address: 0000000000000660
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 2644 Comm: jbd2/loop3-29 Not tainted 6.1.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ocfs2_handle_error+0xb/0x110 fs/ocfs2/super.c:2532
Code: 00 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 60 75 07 48 8d 65 f8 5b 5d c3 e8 12 8d 01 00 66 90 55 41 57 41 56 41 54 53 49 89 fe <4c> 8b bf 60 06 00 00 49 8d 9f 00 01 00 00 48 89 df e8 7f c3 02 00
RSP: 0018:ffffc900027f3c30 EFLAGS: 00010246
RAX: 00000000000000a6 RBX: 0000000000000000 RCX: 2e06874daf6b1000
RDX: ffff88813bc27040 RSI: ffffffff83044434 RDI: 0000000000000000
RBP: ffffc900027f3ce0 R08: ffffffff834bfc80 R09: 0000000000001fff
R10: ffffffff8348fc20 R11: 0000000000005ffd R12: ffff888146e4a768
R13: ffff888146e4a000 R14: 0000000000000000 R15: ffff88810c319140
FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000660 CR3: 00000001023cb000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __ocfs2_error+0x82/0xa0 fs/ocfs2/super.c:2575
 ocfs2_abort_trigger+0x61/0x80 fs/ocfs2/journal.c:598
 jbd2_journal_commit_transaction+0xa38/0x1a20 fs/jbd2/commit.c:623
 kjournald2+0xb2/0x250 fs/jbd2/journal.c:210
 kthread+0xcc/0xe0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Modules linked in:
CR2: 0000000000000660
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_handle_error+0xb/0x110 fs/ocfs2/super.c:2532
Code: 00 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 60 75 07 48 8d 65 f8 5b 5d c3 e8 12 8d 01 00 66 90 55 41 57 41 56 41 54 53 49 89 fe <4c> 8b bf 60 06 00 00 49 8d 9f 00 01 00 00 48 89 df e8 7f c3 02 00
RSP: 0018:ffffc900027f3c30 EFLAGS: 00010246
RAX: 00000000000000a6 RBX: 0000000000000000 RCX: 2e06874daf6b1000
RDX: ffff88813bc27040 RSI: ffffffff83044434 RDI: 0000000000000000
RBP: ffffc900027f3ce0 R08: ffffffff834bfc80 R09: 0000000000001fff
R10: ffffffff8348fc20 R11: 0000000000005ffd R12: ffff888146e4a768
R13: ffff888146e4a000 R14: 0000000000000000 R15: ffff88810c319140
FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000660 CR3: 00000001023cb000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	00 65 48             	add    %ah,0x48(%rbp)
   3:	8b 0c 25 28 00 00 00 	mov    0x28,%ecx
   a:	48 3b 4c 24 60       	cmp    0x60(%rsp),%rcx
   f:	75 07                	jne    0x18
  11:	48 8d 65 f8          	lea    -0x8(%rbp),%rsp
  15:	5b                   	pop    %rbx
  16:	5d                   	pop    %rbp
  17:	c3                   	ret
  18:	e8 12 8d 01 00       	call   0x18d2f
  1d:	66 90                	xchg   %ax,%ax
  1f:	55                   	push   %rbp
  20:	41 57                	push   %r15
  22:	41 56                	push   %r14
  24:	41 54                	push   %r12
  26:	53                   	push   %rbx
  27:	49 89 fe             	mov    %rdi,%r14
* 2a:	4c 8b bf 60 06 00 00 	mov    0x660(%rdi),%r15 <-- trapping instruction
  31:	49 8d 9f 00 01 00 00 	lea    0x100(%r15),%rbx
  38:	48 89 df             	mov    %rbx,%rdi
  3b:	e8 7f c3 02 00       	call   0x2c3bf