general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 1 PID: 5479 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-06824-g8bc9e6515183 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:__timerqueue_less lib/timerqueue.c:22 [inline]
RIP: 0010:rb_add_cached include/linux/rbtree.h:174 [inline]
RIP: 0010:timerqueue_add+0xf7/0x330 lib/timerqueue.c:40
Code: 48 c1 ea 03 42 80 3c 22 00 0f 85 c4 01 00 00 49 8b 17 48 85 d2 74 40 48 89 d3 e8 54 b2 1a f7 48 8d 7b 18 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 ab 01 00 00 4c 8b 7b 18 4c 89 ef 4c 89 fe e8
RSP: 0018:ffffc900001f0dd8 EFLAGS: 00010013
RAX: 000000000000000b RBX: 0000000000000046 RCX: ffffffff8a6dcab1
RDX: ffff888017f73b80 RSI: ffffffff8a6dca8c RDI: 000000000000005e
RBP: ffff8880b992c270 R08: 0000000000000006 R09: 00000011f089b280
R10: ffffc90004e3fce8 R11: ffff8880b993d600 R12: dffffc0000000000
R13: 00000011f089b280 R14: 0000000000000000 R15: ffffc90004c6fb78
FS: 00007fae6ccf86c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd1c81bfc0 CR3: 0000000027086000 CR4: 0000000000350ef0
Call Trace:
enqueue_hrtimer+0x16f/0x310 kernel/time/hrtimer.c:1094
__run_hrtimer kernel/time/hrtimer.c:1705 [inline]
__hrtimer_run_queues+0xa0a/0xc10 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1065 [inline]
__sysvec_apic_timer_interrupt+0x105/0x3f0 arch/x86/kernel/apic/apic.c:1082
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:memmove+0x44/0x1b0 arch/x86/lib/memmove_64.S:68
Code: 00 48 83 fa 20 0f 82 01 01 00 00 66 0f 1f 44 00 00 48 81 fa a8 02 00 00 72 05 40 38 fe 74 47 48 83 ea 20 48 83 ea 20 4c 8b 1e <4c> 8b 56 08 4c 8b 4e 10 4c 8b 46 18 48 8d 76 20 4c 89 1f 4c 89 57
RSP: 0018:ffffc90004e8ef18 EFLAGS: 00000282
RAX: ffff888071711fb4 RBX: 0000000000000002 RCX: ffff888071711030
RDX: fffffffff699e020 RSI: ffff88807ad73f24 RDI: ffff88807ad73f34
RBP: 0000000000000020 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: ffff888071711fa4 R15: 0000000000000010
leaf_paste_entries+0x43c/0x920 fs/reiserfs/lbalance.c:1377
balance_leaf_finish_node_paste_dirent fs/reiserfs/do_balan.c:1295 [inline]
balance_leaf_finish_node_paste fs/reiserfs/do_balan.c:1321 [inline]
balance_leaf_finish_node fs/reiserfs/do_balan.c:1364 [inline]
balance_leaf+0x9476/0xcd90 fs/reiserfs/do_balan.c:1452
do_balance+0x337/0x840 fs/reiserfs/do_balan.c:1888
reiserfs_paste_into_item+0x62a/0x7c0 fs/reiserfs/stree.c:2158
reiserfs_add_entry+0x936/0xd70 fs/reiserfs/namei.c:565
reiserfs_mkdir+0x68a/0x9a0 fs/reiserfs/namei.c:860
xattr_mkdir fs/reiserfs/xattr.c:77 [inline]
create_privroot fs/reiserfs/xattr.c:891 [inline]
reiserfs_xattr_init+0x57f/0xbb0 fs/reiserfs/xattr.c:1007
reiserfs_fill_super+0x2139/0x3150 fs/reiserfs/super.c:2175
mount_bdev+0x1f3/0x2e0 fs/super.c:1647
legacy_get_tree+0x109/0x220 fs/fs_context.c:662
vfs_get_tree+0x8c/0x370 fs/super.c:1768
do_new_mount fs/namespace.c:3337 [inline]
path_mount+0x1492/0x1ed0 fs/namespace.c:3664
do_mount fs/namespace.c:3677 [inline]
__do_sys_mount fs/namespace.c:3886 [inline]
__se_sys_mount fs/namespace.c:3863 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:3863
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fae6c07e1ea
Code: 48 83 ee 01 d1 ff ff 48 83 7c 24 30 00 74 2e 64 41 c7 04 24 d1 ff ff 48 83 7c 24 30 00 74 2e 64 41 c7 04 24 ef bb 22 00 00 00 <64> 41 c7 04 24 22 00 00 00 e8 ef bb 22 00 00 00 64 41 c7 04 24 22
RSP: 002b:00007fae6ccf7ee8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fae6ccf7f80 RCX: 00007fae6c07e1ea
RDX: 0000000020000080 RSI: 0000000020000040 RDI: 00007fae6ccf7f40
RBP: 0000000020000080 R08: 00007fae6ccf7f80 R09: 000000000000800c
R10: 000000000000800c R11: 0000000000000246 R12: 0000000020000040
R13: 00007fae6ccf7f40 R14: 0000000000001118 R15: 0000000020001380
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__timerqueue_less lib/timerqueue.c:22 [inline]
RIP: 0010:rb_add_cached include/linux/rbtree.h:174 [inline]
RIP: 0010:timerqueue_add+0xf7/0x330 lib/timerqueue.c:40
Code: 48 c1 ea 03 42 80 3c 22 00 0f 85 c4 01 00 00 49 8b 17 48 85 d2 74 40 48 89 d3 e8 54 b2 1a f7 48 8d 7b 18 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 ab 01 00 00 4c 8b 7b 18 4c 89 ef 4c 89 fe e8
RSP: 0018:ffffc900001f0dd8 EFLAGS: 00010013
RAX: 000000000000000b RBX: 0000000000000046 RCX: ffffffff8a6dcab1
RDX: ffff888017f73b80 RSI: ffffffff8a6dca8c RDI: 000000000000005e
RBP: ffff8880b992c270 R08: 0000000000000006 R09: 00000011f089b280
R10: ffffc90004e3fce8 R11: ffff8880b993d600 R12: dffffc0000000000
R13: 00000011f089b280 R14: 0000000000000000 R15: ffffc90004c6fb78
FS: 00007fae6ccf86c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd1c81bfc0 CR3: 0000000027086000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 48 c1 ea 03 shr $0x3,%rdx
4: 42 80 3c 22 00 cmpb $0x0,(%rdx,%r12,1)
9: 0f 85 c4 01 00 00 jne 0x1d3
f: 49 8b 17 mov (%r15),%rdx
12: 48 85 d2 test %rdx,%rdx
15: 74 40 je 0x57
17: 48 89 d3 mov %rdx,%rbx
1a: e8 54 b2 1a f7 call 0xf71ab273
1f: 48 8d 7b 18 lea 0x18(%rbx),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 0f 85 ab 01 00 00 jne 0x1e0
35: 4c 8b 7b 18 mov 0x18(%rbx),%r15
39: 4c 89 ef mov %r13,%rdi
3c: 4c 89 fe mov %r15,%rsi
3f: e8 .byte 0xe8