[v6.1] BUG: unable to handle kernel paging request in xlog_cil_pcp_dead

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: dc5c83b7f5f8 Linux 6.1.178
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=159a46b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=c581bb42ab36d9a493dc
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/96393e4697a3/disk-dc5c83b7.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0d4afce44fab/vmlinux-dc5c83b7.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4787e310d875/Image-dc5c83b7.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c581bb...@syzkaller.appspotmail.com

psci: CPU1 killed (polled 0 ms)
Unable to handle kernel paging request at virtual address dfff800000000002
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000002] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4377 Comm: kworker/0:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Workqueue: events work_for_cpu_fn
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : xlog_cil_pcp_dead+0x3c/0x468 fs/xfs/xfs_log_cil.c:1806
lr : xlog_cil_pcp_dead+0x34/0x468 fs/xfs/xfs_log_cil.c:1805
sp : ffff8000212e7970
x29: ffff8000212e7970 x28: ffff8000153f7810 x27: 0000000000000000
x26: 1ffff00002a7ef04 x25: ffff8000159a7d00 x24: dfff800000000000
x23: dfff800000000000 x22: ffff0000dc93c000 x21: ffff0000dc93c140
x20: 0000000000000010 x19: 0000000000000001 x18: 1fffe00033e7277e
x17: ffff80001537d000 x16: ffff800011b90540 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffff7ffdff6e5a x12: 0000000000000000
x11: ff00800009b5e520 x10: 0000000000000000 x9 : ffff800009b5e520
x8 : 0000000000000002 x7 : ffff80000820d178 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000081fcab8
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
xlog_cil_pcp_dead+0x3c/0x468 fs/xfs/xfs_log_cil.c:1806
xfs_cpu_dead+0xa4/0xf8 fs/xfs/xfs_super.c:2260
cpuhp_invoke_callback+0x390/0x6dc kernel/cpu.c:192
__cpuhp_invoke_callback_range kernel/cpu.c:700 [inline]
cpuhp_invoke_callback_range kernel/cpu.c:724 [inline]
cpuhp_down_callbacks kernel/cpu.c:1157 [inline]
_cpu_down+0x44c/0xb10 kernel/cpu.c:1218
__cpu_down_maps_locked+0x48/0x9c kernel/cpu.c:1249
work_for_cpu_fn+0x60/0x94 kernel/workqueue.c:5184
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: f2fbfff7 97a552d1 91004294 d343fe88 (38776908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f2fbfff7 movk x23, #0xdfff, lsl #48
4: 97a552d1 bl 0xfffffffffe954b48
8: 91004294 add x20, x20, #0x10
c: d343fe88 lsr x8, x20, #3
* 10: 38776908 ldrb w8, [x8, x23] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup