kernel BUG at block/bio.c:LINE!

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 32c81c87 ANDROID: kbuild: use -ftrap-function to handle CF..
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=152e0f9b500000
kernel config: https://syzkaller.appspot.com/x/.config?x=6b3d67ba6cfe7d72
dashboard link: https://syzkaller.appspot.com/bug?extid=3a1983dd28a1a095e89b
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a1983...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at block/bio.c:1901!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2342 Comm: syz-executor.0 Not tainted 5.4.81-syzkaller-00868-g32c81c873563 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:bio_split+0x17e/0x190 block/bio.c:1901
Code: ff ff ff 4c 89 e7 e8 51 a0 7c ff e9 55 ff ff ff 89 d9 80 e1 07 fe c1 38 c1 7c 8c 48 89 df e8 39 a0 7c ff eb 82 e8 f2 e5 4d ff <0f> 0b e8 eb e5 4d ff 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffff8881ee9de988 EFLAGS: 00010287
RAX: ffffffff8214fede RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90000380000 RSI: 0000000000000809 RDI: 000000000000080a
RBP: 0000000000000000 R08: ffffffff8214fd86 R09: ffff8881ee9deac0
R10: ffffed103dd3bd5a R11: 0000000000000000 R12: ffff8881e2550b40
R13: 1ffff1103dd3bd54 R14: ffff8881f3eba7f8 R15: 0000000000000c00
FS: 00007ff9f8830700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000050d0d0 CR3: 00000001ecc0d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__blk_queue_split+0xef7/0x14f0 block/blk-merge.c:281
blk_mq_make_request+0x1d0/0x2280 block/blk-mq.c:1985
generic_make_request+0x3e4/0xde0 block/blk-core.c:1073
submit_bio+0x145/0x560 block/blk-core.c:1200
mpage_bio_submit+0x3f7/0x500 fs/mpage.c:102
do_mpage_readpage+0x19b1/0x1b00 fs/mpage.c:360
mpage_readpages+0x395/0x510 fs/mpage.c:440
read_pages+0x117/0x400 mm/readahead.c:126
__do_page_cache_readahead+0x470/0x510 mm/readahead.c:212
generic_file_buffered_read mm/filemap.c:2051 [inline]
generic_file_read_iter+0x5ce/0x20a0 mm/filemap.c:2324
call_read_iter include/linux/fs.h:1956 [inline]
generic_file_splice_read+0x475/0x770 fs/splice.c:307
do_splice_to fs/splice.c:877 [inline]
splice_direct_to_actor+0x3cf/0xb00 fs/splice.c:955
do_splice_direct+0x288/0x3e0 fs/splice.c:1064
do_sendfile+0x8e4/0x1130 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1525 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0x1ce/0x230 fs/read_write.c:1511
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e0f9
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff9f882fc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e0f9
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
RBP: 000000000119bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000001c575 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffc72af271f R14: 00007ff9f88309c0 R15: 000000000119bf8c
Modules linked in:
---[ end trace a251fc235e318c4c ]---
RIP: 0010:bio_split+0x17e/0x190 block/bio.c:1901
Code: ff ff ff 4c 89 e7 e8 51 a0 7c ff e9 55 ff ff ff 89 d9 80 e1 07 fe c1 38 c1 7c 8c 48 89 df e8 39 a0 7c ff eb 82 e8 f2 e5 4d ff <0f> 0b e8 eb e5 4d ff 0f 0b 66 0f 1f 84 00 00 00 00 00 55 41 57 41
RSP: 0018:ffff8881ee9de988 EFLAGS: 00010287
RAX: ffffffff8214fede RBX: 0000000000000000 RCX: 0000000000040000
RDX: ffffc90000380000 RSI: 0000000000000809 RDI: 000000000000080a
RBP: 0000000000000000 R08: ffffffff8214fd86 R09: ffff8881ee9deac0
R10: ffffed103dd3bd5a R11: 0000000000000000 R12: ffff8881e2550b40
R13: 1ffff1103dd3bd54 R14: ffff8881f3eba7f8 R15: 0000000000000c00
FS: 00007ff9f8830700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a7e02945a8 CR3: 00000001ecc0d000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.