[v5.15] BUG: unable to handle kernel NULL pointer dereference in f2fs_flush_nat_entries (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9465fef4ae35 Linux 5.15.153
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17f0c676180000
kernel config: https://syzkaller.appspot.com/x/.config?x=74ff83133fa97f6c
dashboard link: https://syzkaller.appspot.com/bug?extid=2b478d899e8c90dd628e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3c82fda40b43/disk-9465fef4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ec13893dc103/vmlinux-9465fef4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7b44910e5283/Image-9465fef4.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2b478d...@syzkaller.appspotmail.com

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000086000005
EC = 0x21: IABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=0000000122b15000
[0000000000000000] pgd=0800000129ada003, p4d=0800000129ada003, pud=0000000000000000
Internal error: Oops: 0000000086000005 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3975 Comm: syz-executor.1 Not tainted 5.15.153-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : 0x0
lr : set_page_dirty+0x23c/0x544 mm/page-writeback.c:2609
sp : ffff80001ab77390
x29: ffff80001ab77390 x28: 1fffff800079ce89 x27: fffffc0003ce7448
x26: 0000000000000000 x25: 1fffff8000757181 x24: dfff800000000000
x23: 0000000000000000 x22: 05ffc00000000007 x21: ffff0000e97845f8
x20: ffff800011b75d58 x19: fffffc0003ab8c00 x18: ffff80001ab76ac8
x17: 0000000000000000 x16: ffff80001197d444 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : ffff0000c9a9b680
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff0000eae31000 x4 : ffff0000f39d2000 x3 : ffff0000eae30f80
x2 : fffffffffffffff0 x1 : 0000000000000000 x0 : fffffc0003ab8c00
Call trace:
0x0
get_next_nat_page fs/f2fs/node.c:158 [inline]
__flush_nat_entry_set fs/f2fs/node.c:3011 [inline]
f2fs_flush_nat_entries+0xa84/0x1e7c fs/f2fs/node.c:3115
f2fs_write_checkpoint+0x1050/0x1e3c fs/f2fs/checkpoint.c:1688
kill_f2fs_super+0x1d4/0x338 fs/f2fs/super.c:4533
deactivate_locked_super+0xb8/0x13c fs/super.c:335
deactivate_super+0x108/0x128 fs/super.c:366
cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143
__cleanup_mnt+0x20/0x30 fs/namespace.c:1150
task_work_run+0x130/0x1e4 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:609
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: bad PC value
---[ end trace 9177acaf26ec6e5a ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup