BTRFS: device fsid 9ef2b0c0-0642-4475-a2ba-d53d18884f0b devid 1 transid 7 /dev/loop0 scanned by syz-executor700 (4049) BTRFS info (device loop0): disk space caching is enabled BTRFS info (device loop0): has skinny extents BTRFS info (device loop0): enabling ssd optimizations general protection fault, probably for non-canonical address 0xdffffc000000002f: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000178-0x000000000000017f] CPU: 1 PID: 4049 Comm: syz-executor700 Not tainted 5.17.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:blk_throtl_bio block/blk-throttle.h:175 [inline] RIP: 0010:submit_bio_checks+0x61f/0x17a0 block/blk-core.c:765 Code: 74 08 3c 03 0f 8e ba 0e 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 6f 10 83 e5 01 49 8d bc 2e 7c 01 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 7a 0e 00 00 RSP: 0018:ffffc900026ef2e0 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 1ffff920004dde63 RCX: ffff88801ba61214 RDX: 000000000000002f RSI: 0000000000000008 RDI: 000000000000017d RBP: 0000000000000001 R08: 0000000000000000 R09: ffff88814700b96f R10: ffffed1028e0172d R11: 0000000000000000 R12: ffff88801ba61210 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88801ba61200 FS: 00005555566e9300(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdb355e2c28 CR3: 00000000797cf000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __submit_bio+0xa9/0x2f0 block/blk-core.c:802 __submit_bio_noacct_mq block/blk-core.c:881 [inline] submit_bio_noacct block/blk-core.c:907 [inline] submit_bio_noacct+0x5c8/0x830 block/blk-core.c:896 submit_bio block/blk-core.c:968 [inline] submit_bio+0x158/0x360 block/blk-core.c:926 write_dev_flush fs/btrfs/disk-io.c:4162 [inline] barrier_all_devices fs/btrfs/disk-io.c:4212 [inline] write_all_supers+0x29b4/0x3460 fs/btrfs/disk-io.c:4307 btrfs_commit_transaction+0x1520/0x26f0 fs/btrfs/transaction.c:2323 close_ctree+0x2bc/0xa8f fs/btrfs/disk-io.c:4590 btrfs_fill_super fs/btrfs/super.c:1380 [inline] btrfs_mount_root.cold+0x83/0x118 fs/btrfs/super.c:1724 legacy_get_tree+0xfa/0x1f0 fs/fs_context.c:610 vfs_get_tree+0x7f/0x2c0 fs/super.c:1497 fc_mount fs/namespace.c:1000 [inline] vfs_kern_mount.part.0+0x70/0x100 fs/namespace.c:1030 btrfs_mount+0x1aa/0x860 fs/btrfs/super.c:1784 legacy_get_tree+0xfa/0x1f0 fs/fs_context.c:610 vfs_get_tree+0x7f/0x2c0 fs/super.c:1497 do_new_mount fs/namespace.c:2994 [inline] path_mount+0x7e8/0x1a40 fs/namespace.c:3324 do_mount fs/namespace.c:3337 [inline] __do_sys_mount fs/namespace.c:3545 [inline] __se_sys_mount fs/namespace.c:3522 [inline] __x64_sys_mount+0x1f5/0x260 fs/namespace.c:3522 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f9c6f128d6a Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeed457828 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007ffeed457880 RCX: 00007f9c6f128d6a RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffeed457840 RBP: 00007ffeed457840 R08: 00007ffeed457880 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000282 R12: 0000000020000f50 R13: 0000000000000003 R14: 0000000000000004 R15: 000000000000008e Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:blk_throtl_bio block/blk-throttle.h:175 [inline] RIP: 0010:submit_bio_checks+0x61f/0x17a0 block/blk-core.c:765 Code: 74 08 3c 03 0f 8e ba 0e 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 6f 10 83 e5 01 49 8d bc 2e 7c 01 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 7a 0e 00 00 RSP: 0018:ffffc900026ef2e0 EFLAGS: 00010203 RAX: dffffc0000000000 RBX: 1ffff920004dde63 RCX: ffff88801ba61214 RDX: 000000000000002f RSI: 0000000000000008 RDI: 000000000000017d RBP: 0000000000000001 R08: 0000000000000000 R09: ffff88814700b96f R10: ffffed1028e0172d R11: 0000000000000000 R12: ffff88801ba61210 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88801ba61200 FS: 00005555566e9300(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f31e169a600 CR3: 00000000797cf000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 74 08 je 0xa 2: 3c 03 cmp $0x3,%al 4: 0f 8e ba 0e 00 00 jle 0xec4 a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 11: fc ff df 14: 41 8b 6f 10 mov 0x10(%r15),%ebp 18: 83 e5 01 and $0x1,%ebp 1b: 49 8d bc 2e 7c 01 00 lea 0x17c(%r14,%rbp,1),%rdi 22: 00 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction 2e: 48 89 fa mov %rdi,%rdx 31: 83 e2 07 and $0x7,%edx 34: 38 d0 cmp %dl,%al 36: 7f 08 jg 0x40 38: 84 c0 test %al,%al 3a: 0f 85 7a 0e 00 00 jne 0xeba