BUG: unable to handle page fault for address: fffff91ffffff920 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffe5067 P4D 23ffe5067 PUD 1b322067 PMD 1b323067 PTE 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6611 Comm: syz-executor Not tainted 6.16.0-rc3-syzkaller-00042-g78f4e737a53e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline] RIP: 0010:rcu_segcblist_advance+0x69/0x3e0 kernel/rcu/rcu_segcblist.c:474 Code: 84 70 03 00 00 4c 8d 7b 08 4c 89 fd 48 c1 ed 03 42 80 7c 25 00 00 74 08 4c 89 ff e8 51 b8 78 00 4d 8b 37 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 38 b8 78 00 49 83 3e 00 0f 84 1e RSP: 0018:ffffc90003c4f918 EFLAGS: 00010802 RAX: 1ffffd1ffffff920 RBX: ffffe8ffffc3d5c0 RCX: 7a331358c2da8800 RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc3d5c0 RBP: 1ffffd1ffff87ab9 R08: 0000000000000000 R09: ffffffff81a6ab9d R10: dffffc0000000000 R11: fffff52000789f20 R12: dffffc0000000000 R13: fffffffffffffe70 R14: ffffe8ffffffc900 R15: ffffe8ffffc3d5c8 FS: 000055556a36c500(0000) GS:ffff888125d83000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff91ffffff920 CR3: 000000007ba74000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: srcu_gp_start_if_needed+0x6e9/0x11d0 kernel/rcu/srcutree.c:1316 __call_srcu kernel/rcu/srcutree.c:1389 [inline] __synchronize_srcu+0x306/0x3a0 kernel/rcu/srcutree.c:1441 bch2_fs_btree_iter_exit+0x3f9/0x490 fs/bcachefs/btree_iter.c:3685 __bch2_fs_free fs/bcachefs/super.c:618 [inline] bch2_fs_release+0x2ab/0x830 fs/bcachefs/super.c:668 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1417 task_work_run+0x1d1/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f78b238e497 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffcd3e3b698 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007f78b240e08c RCX: 00007f78b238e497 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcd3e3b750 RBP: 00007ffcd3e3b750 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcd3e3c7e0 R13: 00007f78b240e08c R14: 00000000000382bb R15: 00007ffcd3e3c820 Modules linked in: CR2: fffff91ffffff920 ---[ end trace 0000000000000000 ]--- RIP: 0010:rcu_segcblist_restempty kernel/rcu/rcu_segcblist.h:105 [inline] RIP: 0010:rcu_segcblist_advance+0x69/0x3e0 kernel/rcu/rcu_segcblist.c:474 Code: 84 70 03 00 00 4c 8d 7b 08 4c 89 fd 48 c1 ed 03 42 80 7c 25 00 00 74 08 4c 89 ff e8 51 b8 78 00 4d 8b 37 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 38 b8 78 00 49 83 3e 00 0f 84 1e RSP: 0018:ffffc90003c4f918 EFLAGS: 00010802 RAX: 1ffffd1ffffff920 RBX: ffffe8ffffc3d5c0 RCX: 7a331358c2da8800 RDX: 0000000000000001 RSI: fffffffffffffe70 RDI: ffffe8ffffc3d5c0 RBP: 1ffffd1ffff87ab9 R08: 0000000000000000 R09: ffffffff81a6ab9d R10: dffffc0000000000 R11: fffff52000789f20 R12: dffffc0000000000 R13: fffffffffffffe70 R14: ffffe8ffffffc900 R15: ffffe8ffffc3d5c8 FS: 000055556a36c500(0000) GS:ffff888125d83000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff91ffffff920 CR3: 000000007ba74000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 84 70 03 test %dh,0x3(%rax) 3: 00 00 add %al,(%rax) 5: 4c 8d 7b 08 lea 0x8(%rbx),%r15 9: 4c 89 fd mov %r15,%rbp c: 48 c1 ed 03 shr $0x3,%rbp 10: 42 80 7c 25 00 00 cmpb $0x0,0x0(%rbp,%r12,1) 16: 74 08 je 0x20 18: 4c 89 ff mov %r15,%rdi 1b: e8 51 b8 78 00 call 0x78b871 20: 4d 8b 37 mov (%r15),%r14 23: 4c 89 f0 mov %r14,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 f7 mov %r14,%rdi 34: e8 38 b8 78 00 call 0x78b871 39: 49 83 3e 00 cmpq $0x0,(%r14) 3d: 0f .byte 0xf 3e: 84 1e test %bl,(%rsi)