loop3: detected capacity change from 0 to 736
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 3970 Comm: syz-executor.0 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff8880484a6e68 EFLAGS: 00010057
RAX: dffffc0000000000 RBX: ffff888009648640 RCX: ffffffff817e33ce
RDX: 0000000000000000 RSI: ffffffff817e34a6 RDI: 0000000000000007
RBP: ffffe8ffffc16618 R08: ffffffff85ca3e40 R09: ffffed1009094e14
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffffffffffff R14: ffff8880096486a0 R15: ffff8880096486d8
FS:  00007fcb5194d700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d421000 CR3: 0000000046dcb000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 event_sched_in+0x446/0xb60
 merge_sched_in+0xb4d/0x1810
 visit_groups_merge.constprop.0.isra.0+0x8d1/0x1150
 ctx_sched_in+0x579/0x9b0
 perf_event_sched_in+0x5d/0x90
 __perf_event_task_sched_in+0x2ec/0x5e0
 finish_task_switch.isra.0+0x410/0x840
 __schedule+0xe86/0x3590
 schedule+0xdb/0x390
 io_schedule+0xbf/0x130
 blk_mq_get_tag+0x568/0xaa0
 __blk_mq_alloc_requests+0x6ed/0x15a0
 blk_mq_submit_bio+0x168d/0x2220
 __submit_bio+0x17f/0x5b0
 submit_bio_noacct_nocheck+0x68e/0xcb0
 submit_bio_noacct+0x359/0x1350
 write_dirty_buffer+0xca/0x170
 __flush_batch+0x107/0x2d0
 jbd2_log_do_checkpoint+0x810/0xb20
 jbd2_journal_flush+0x1a8/0xc20
 __ext4_ioctl+0x2d2e/0x38b0
 __x64_sys_ioctl+0x18f/0x210
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcb543d7b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcb5194d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcb544eaf60 RCX: 00007fcb543d7b19
RDX: 0000000020000640 RSI: 0000000040086607 RDI: 0000000000000004
RBP: 00007fcb54431f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff83b400ef R14: 00007fcb5194d300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff8880484a6e68 EFLAGS: 00010057
RAX: dffffc0000000000 RBX: ffff888009648640 RCX: ffffffff817e33ce
RDX: 0000000000000000 RSI: ffffffff817e34a6 RDI: 0000000000000007
RBP: ffffe8ffffc16618 R08: ffffffff85ca3e40 R09: ffffed1009094e14
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffffffffffff R14: ffff8880096486a0 R15: ffff8880096486d8
FS:  00007fcb5194d700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d421000 CR3: 0000000046dcb000 CR4: 0000000000350ef0
note: syz-executor.0[3970] exited with irqs disabled
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 3a                	test   %edi,(%rdx)
   4:	01 00                	add    %eax,(%rax)
   6:	00 4c 89 75          	add    %cl,0x75(%rcx,%rcx,4)
   a:	00 4d 85             	add    %cl,-0x7b(%rbp)
   d:	ed                   	in     (%dx),%eax
   e:	74 2a                	je     0x3a
  10:	e8 da b2 f5 ff       	callq  0xfff5b2ef
  15:	49 8d 7d 08          	lea    0x8(%r13),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 df 00 00 00    	jne    0x113
  34:	4d 89 75 08          	mov    %r14,0x8(%r13)
  38:	eb 03                	jmp    0x3d
  3a:	45 31 e4             	xor    %r12d,%r12d
  3d:	e8                   	.byte 0xe8
  3e:	ad                   	lods   %ds:(%rsi),%eax
  3f:	b2                   	.byte 0xb2