EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff) /dev/loop0: Can't open blockdev Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 5991 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:erofs_kill_sb+0x4c/0x190 fs/erofs/super.c:906 Code: 9f 38 06 00 00 48 89 dd 48 c1 ed 03 42 80 7c 2d 00 00 74 08 48 89 df e8 82 83 eb fd 4c 8b 33 4d 8d 66 10 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 65 83 eb fd 49 83 3c 24 00 74 0f RSP: 0018:ffffc900039e7b58 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88816ed88638 RCX: ffff88816c548000 RDX: 0000000000000000 RSI: ffffffff8dad1d20 RDI: ffff88816ed88000 RBP: 1ffff1102ddb10c7 R08: ffffffff8fcec177 R09: 1ffffffff1f9d82e R10: dffffc0000000000 R11: ffffffff843ef960 R12: 0000000000000010 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88816ed88000 FS: 000055558ffb4500(0000) GS:ffff8882a9942000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30763fff CR3: 00000001127bc000 CR4: 00000000000006f0 Call Trace: deactivate_locked_super+0xbc/0x130 fs/super.c:474 get_tree_bdev_flags+0x4b4/0x560 fs/super.c:1698 vfs_get_tree+0x92/0x2a0 fs/super.c:1756 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3636 [inline] do_new_mount+0x329/0xa50 fs/namespace.c:3712 do_mount fs/namespace.c:4035 [inline] __do_sys_mount fs/namespace.c:4224 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4201 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf0/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a7139acb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff10bbdc58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f3a71615fa0 RCX: 00007f3a7139acb9 RDX: 0000200000000700 RSI: 00002000000006c0 RDI: 0000200000000640 RBP: 00007f3a71408bf7 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3a71615fac R14: 00007f3a71615fa0 R15: 00007f3a71615fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:erofs_kill_sb+0x4c/0x190 fs/erofs/super.c:906 Code: 9f 38 06 00 00 48 89 dd 48 c1 ed 03 42 80 7c 2d 00 00 74 08 48 89 df e8 82 83 eb fd 4c 8b 33 4d 8d 66 10 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 65 83 eb fd 49 83 3c 24 00 74 0f RSP: 0018:ffffc900039e7b58 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88816ed88638 RCX: ffff88816c548000 RDX: 0000000000000000 RSI: ffffffff8dad1d20 RDI: ffff88816ed88000 RBP: 1ffff1102ddb10c7 R08: ffffffff8fcec177 R09: 1ffffffff1f9d82e R10: dffffc0000000000 R11: ffffffff843ef960 R12: 0000000000000010 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88816ed88000 FS: 000055558ffb4500(0000) GS:ffff8882a9942000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30763fff CR3: 00000001127bc000 CR4: 00000000000006f0 ---------------- Code disassembly (best guess): 0: 9f lahf 1: 38 06 cmp %al,(%rsi) 3: 00 00 add %al,(%rax) 5: 48 89 dd mov %rbx,%rbp 8: 48 c1 ed 03 shr $0x3,%rbp c: 42 80 7c 2d 00 00 cmpb $0x0,0x0(%rbp,%r13,1) 12: 74 08 je 0x1c 14: 48 89 df mov %rbx,%rdi 17: e8 82 83 eb fd call 0xfdeb839e 1c: 4c 8b 33 mov (%rbx),%r14 1f: 4d 8d 66 10 lea 0x10(%r14),%r12 23: 4c 89 e0 mov %r12,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 e7 mov %r12,%rdi 34: e8 65 83 eb fd call 0xfdeb839e 39: 49 83 3c 24 00 cmpq $0x0,(%r12) 3e: 74 0f je 0x4f