general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 PID: 23582 Comm: syz-executor.4 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:file_inode include/linux/fs.h:1344 [inline]
RIP: 0010:io_prep_async_work+0x2d0/0x700 fs/io_uring.c:1422
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f2 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 08 48 8d 7d 20 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 d9 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc900185afb80 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88802116c480 RCX: ffffc9001270a000
RDX: 0000000000000004 RSI: ffffffff81dea288 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff899a7be0 R09: ffffffff81dea211
R10: 0000000000000002 R11: 000000000000001e R12: 000000000000001e
R13: ffff88802116c4c8 R14: ffff88802116c540 R15: ffff88802116c538
FS: 00007fe479d73700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33b26000 CR3: 0000000020c4e000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
io_prep_async_link+0x68/0x140 fs/io_uring.c:1441
io_drain_req+0x2f7/0xbf0 fs/io_uring.c:6435
io_queue_sqe fs/io_uring.c:6911 [inline]
io_submit_sqe fs/io_uring.c:7084 [inline]
io_submit_sqes+0x79d5/0x9730 fs/io_uring.c:7197
__do_sys_io_uring_enter+0xf48/0x1f00 fs/io_uring.c:9839
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe479d73188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000000006019 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffde9ab86ef R14: 00007fe479d73300 R15: 0000000000022000
Modules linked in:
---[ end trace 572aa85d7fc40e33 ]---
RIP: 0010:file_inode include/linux/fs.h:1344 [inline]
RIP: 0010:io_prep_async_work+0x2d0/0x700 fs/io_uring.c:1422
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 f2 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 08 48 8d 7d 20 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 d9 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc900185afb80 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88802116c480 RCX: ffffc9001270a000
RDX: 0000000000000004 RSI: ffffffff81dea288 RDI: 0000000000000020
RBP: 0000000000000000 R08: ffffffff899a7be0 R09: ffffffff81dea211
R10: 0000000000000002 R11: 000000000000001e R12: 000000000000001e
R13: ffff88802116c4c8 R14: ffff88802116c540 R15: ffff88802116c538
FS: 00007fe479d73700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f32ad698028 CR3: 0000000020c4e000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 89 fa mov %rdi,%rdx
3: 48 c1 ea 03 shr $0x3,%rdx
7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
b: 0f 85 f2 03 00 00 jne 0x403
11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
18: fc ff df
1b: 48 8b 6b 08 mov 0x8(%rbx),%rbp
1f: 48 8d 7d 20 lea 0x20(%rbp),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 d9 03 00 00 jne 0x40d
34: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
3b: fc ff df
3e: 48 rex.W
3f: 8b .byte 0x8b