Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 4006 Comm: syz-executor.2 Tainted: G        W           6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff8880170cec20 EFLAGS: 00010057
RAX: dffffc0000000000 RBX: ffff88800964d780 RCX: ffffffff817e33ce
RDX: 0000000000000000 RSI: ffffffff817e34a6 RDI: 0000000000000007
RBP: ffffe8ffffc16318 R08: ffffffff85ca3e40 R09: ffffed1002e19dcb
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffffffffffff R14: ffff88800964d7e0 R15: ffff88800964d818
FS:  00007fb13b88d700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc5922d18 CR3: 0000000017841000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 event_sched_in+0x446/0xb60
 merge_sched_in+0xb4d/0x1810
 visit_groups_merge.constprop.0.isra.0+0x8d1/0x1150
 ctx_sched_in+0x579/0x9b0
 perf_event_sched_in+0x5d/0x90
 __perf_event_task_sched_in+0x2ec/0x5e0
 finish_task_switch.isra.0+0x410/0x840
 __schedule+0xe86/0x3590
 schedule+0xdb/0x390
 io_schedule+0xbf/0x130
 folio_wait_bit_common+0x388/0x900
 folio_wait_writeback+0x4b/0x90
 __filemap_fdatawait_range+0x10f/0x1e0
 filemap_write_and_wait_range.part.0+0xd2/0x110
 kiocb_invalidate_pages+0xe4/0x180
 __iomap_dio_rw+0xf89/0x1cf0
 iomap_dio_rw+0x40/0xa0
 ext4_file_write_iter+0xe0b/0x1990
 iter_file_splice_write+0xa3b/0x11f0
 direct_splice_actor+0x192/0x7b0
 splice_direct_to_actor+0x347/0x9d0
 do_splice_direct+0x179/0x250
 do_sendfile+0xa8e/0xdc0
 __x64_sys_sendfile64+0x1d3/0x210
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb13e317b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb13b88d188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fb13e42af60 RCX: 00007fb13e317b19
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004
RBP: 00007fb13e371f6d R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000fdef R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffccad02d4f R14: 00007fb13b88d300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_trace_add+0x21b/0x340
Code: 00 0f 85 3a 01 00 00 4c 89 75 00 4d 85 ed 74 2a e8 da b2 f5 ff 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 df 00 00 00 4d 89 75 08 eb 03 45 31 e4 e8 ad b2
RSP: 0018:ffff8880170cec20 EFLAGS: 00010057
RAX: dffffc0000000000 RBX: ffff88800964d780 RCX: ffffffff817e33ce
RDX: 0000000000000000 RSI: ffffffff817e34a6 RDI: 0000000000000007
RBP: ffffe8ffffc16318 R08: ffffffff85ca3e40 R09: ffffed1002e19dcb
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffffffffffffffff R14: ffff88800964d7e0 R15: ffff88800964d818
FS:  00007fb13b88d700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc5922d18 CR3: 0000000017841000 CR4: 0000000000350ef0
note: syz-executor.2[4006] exited with irqs disabled
----------------
Code disassembly (best guess):
   0:	00 0f                	add    %cl,(%rdi)
   2:	85 3a                	test   %edi,(%rdx)
   4:	01 00                	add    %eax,(%rax)
   6:	00 4c 89 75          	add    %cl,0x75(%rcx,%rcx,4)
   a:	00 4d 85             	add    %cl,-0x7b(%rbp)
   d:	ed                   	in     (%dx),%eax
   e:	74 2a                	je     0x3a
  10:	e8 da b2 f5 ff       	callq  0xfff5b2ef
  15:	49 8d 7d 08          	lea    0x8(%r13),%rdi
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 df 00 00 00    	jne    0x113
  34:	4d 89 75 08          	mov    %r14,0x8(%r13)
  38:	eb 03                	jmp    0x3d
  3a:	45 31 e4             	xor    %r12d,%r12d
  3d:	e8                   	.byte 0xe8
  3e:	ad                   	lods   %ds:(%rsi),%eax
  3f:	b2                   	.byte 0xb2