perf: interrupt took too long (32454 > 32241), lowering kernel.perf_event_max_sample_rate to 6000
perf: interrupt took too long (40590 > 40567), lowering kernel.perf_event_max_sample_rate to 4000
general protection fault, probably for non-canonical address 0xdffffc0000000033: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000198-0x000000000000019f]
CPU: 0 PID: 19825 Comm: syz-executor.7 Not tainted 5.19.0-rc4-next-20220629 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:x86_pmu_enable_event+0x6a/0x2e0
Code: 00 e8 9a 5c 43 00 48 c7 c7 00 64 60 84 e8 2e ee 17 03 48 8d bb 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 65 4c 8b 2d 22 2c 01 7f 84 c0 74 08 3c 03 0f 8e 0c 02
RSP: 0018:ffff888045c67580 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000033 RSI: 0000000000000004 RDI: 0000000000000198
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88806ce21c20 R14: fffffbfff0b1cdfd R15: 0000000000000001
FS:  00007f1e08d1f700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e540a24f78 CR3: 00000000174fe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 amd_pmu_enable_all+0x12c/0x1a0
 x86_pmu_enable+0x580/0xd90
 __perf_event_task_sched_in+0x56b/0x6e0
 finish_task_switch.isra.0+0x46c/0x8a0
 __schedule+0x89b/0x2490
 preempt_schedule_common+0x45/0xc0
 __cond_resched+0x13/0x20
 ext4_journal_check_start+0x2b/0x2a0
 __ext4_journal_start_sb+0x84/0x470
 ext4_dirty_inode+0x9d/0x110
 __mark_inode_dirty+0x455/0xf00
 generic_write_end+0x311/0x3d0
 ext4_da_write_end+0x15e/0x930
 generic_perform_write+0x306/0x560
 ext4_buffered_write_iter+0x164/0x330
 ext4_file_write_iter+0x3dc/0x1800
 new_sync_write+0x31b/0x4e0
 vfs_write+0x7b9/0xac0
 ksys_write+0x127/0x250
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f1e0b7a9b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1e08d1f188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1e0b8bcf60 RCX: 00007f1e0b7a9b19
RDX: 0000000000041030 RSI: 0000000020000080 RDI: 0000000000000005
RBP: 00007f1e0b803f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffcdbbe28f R14: 00007f1e08d1f300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:x86_pmu_enable_event+0x6a/0x2e0
Code: 00 e8 9a 5c 43 00 48 c7 c7 00 64 60 84 e8 2e ee 17 03 48 8d bb 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 65 4c 8b 2d 22 2c 01 7f 84 c0 74 08 3c 03 0f 8e 0c 02
RSP: 0018:ffff888045c67580 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000033 RSI: 0000000000000004 RDI: 0000000000000198
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88806ce21c20 R14: fffffbfff0b1cdfd R15: 0000000000000001
FS:  00007f1e08d1f700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e540a24f78 CR3: 00000000174fe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
note: syz-executor.7[19825] exited with preempt_count 4
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 9a 5c 43 00       	callq  0x435c9f
   5:	48 c7 c7 00 64 60 84 	mov    $0xffffffff84606400,%rdi
   c:	e8 2e ee 17 03       	callq  0x317ee3f
  11:	48 8d bb 98 01 00 00 	lea    0x198(%rbx),%rdi
  18:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1f:	fc ff df
  22:	48 89 fa             	mov    %rdi,%rdx
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	65 4c 8b 2d 22 2c 01 	mov    %gs:0x7f012c22(%rip),%r13        # 0x7f012c57
  34:	7f
  35:	84 c0                	test   %al,%al
  37:	74 08                	je     0x41
  39:	3c 03                	cmp    $0x3,%al
  3b:	0f                   	.byte 0xf
  3c:	8e 0c 02             	mov    (%rdx,%rax,1),%cs