general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 PID: 4310 Comm: syz.0.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 RIP: 0010:hfsplus_rename_cat+0x424/0xe90 fs/hfsplus/catalog.c:480 Code: 0f b7 84 24 60 01 00 00 66 89 44 24 28 4c 8b b4 24 00 01 00 00 48 8b 44 24 38 4c 8d 60 40 4c 89 e0 48 c1 e8 03 48 89 44 24 60 <42> 80 3c 38 00 74 08 4c 89 e7 e8 dd 3d 91 ff 4c 89 64 24 68 45 8b RSP: 0018:ffffc9000305f200 EFLAGS: 00010202 RAX: 0000000000000008 RBX: fffff5200060be50 RCX: ffff8880260a5940 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000305f650 R08: ffffc9000305f457 R09: 1ffff9200060be8a R10: dffffc0000000000 R11: fffff5200060be8b R12: 0000000000000040 R13: ffffc9000305f2a0 R14: ffff88807dfec000 R15: dffffc0000000000 FS: 0000555556c1c500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001ffffffffdc0 CR3: 0000000071154000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hfsplus_unlink+0x2f7/0x7b0 fs/hfsplus/dir.c:376 vfs_unlink+0x385/0x600 fs/namei.c:4288 do_unlinkat+0x391/0x710 fs/namei.c:4356 do_coredump+0x1bb1/0x2ac0 fs/coredump.c:805 get_signal+0x40a/0x12c0 kernel/signal.c:2886 arch_do_signal_or_restart+0xe7/0x12c0 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:320 exc_page_fault+0x88/0x100 arch/x86/mm/fault.c:1499 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606 RIP: 0033:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 002b:0000200000000188 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f4e738eefa0 RCX: 00007f4e73675819 RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000440 RBP: 00007f4e7370bc91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007f4e738eefac R14: 00007f4e738eefa0 R15: 00007f4e738eefa0 Modules linked in: ---[ end trace 5d132ea5a7067e98 ]--- RIP: 0010:hfsplus_rename_cat+0x424/0xe90 fs/hfsplus/catalog.c:480 Code: 0f b7 84 24 60 01 00 00 66 89 44 24 28 4c 8b b4 24 00 01 00 00 48 8b 44 24 38 4c 8d 60 40 4c 89 e0 48 c1 e8 03 48 89 44 24 60 <42> 80 3c 38 00 74 08 4c 89 e7 e8 dd 3d 91 ff 4c 89 64 24 68 45 8b RSP: 0018:ffffc9000305f200 EFLAGS: 00010202 RAX: 0000000000000008 RBX: fffff5200060be50 RCX: ffff8880260a5940 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000305f650 R08: ffffc9000305f457 R09: 1ffff9200060be8a R10: dffffc0000000000 R11: fffff5200060be8b R12: 0000000000000040 R13: ffffc9000305f2a0 R14: ffff88807dfec000 R15: dffffc0000000000 FS: 0000555556c1c500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001ffffffffdc0 CR3: 0000000071154000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 0f b7 84 24 60 01 00 movzwl 0x160(%rsp),%eax 7: 00 8: 66 89 44 24 28 mov %ax,0x28(%rsp) d: 4c 8b b4 24 00 01 00 mov 0x100(%rsp),%r14 14: 00 15: 48 8b 44 24 38 mov 0x38(%rsp),%rax 1a: 4c 8d 60 40 lea 0x40(%rax),%r12 1e: 4c 89 e0 mov %r12,%rax 21: 48 c1 e8 03 shr $0x3,%rax 25: 48 89 44 24 60 mov %rax,0x60(%rsp) * 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 4c 89 e7 mov %r12,%rdi 34: e8 dd 3d 91 ff call 0xff913e16 39: 4c 89 64 24 68 mov %r12,0x68(%rsp) 3e: 45 rex.RB 3f: 8b .byte 0x8b