list_add double add: new=ffff888107d43d80, prev=ffff88810e3bcd20, next=ffff888107d43d80.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 10264 Comm: syz-executor.5 Not tainted 5.11.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_add_valid+0x41/0x50 lib/list_debug.c:29
Code: 85 2f 62 77 01 48 39 c7 74 0b 48 39 d7 74 06 b8 01 00 00 00 c3 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 88 55 7b 84 e8 29 bb 70 01 <0f> 0b 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b9 00 01 00 00 00
RSP: 0018:ffffc90002afbca0 EFLAGS: 00010046
RAX: 0000000000000058 RBX: ffff88810e1ac600 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8493e65e RDI: 00000000ffffffff
RBP: ffffc90002afbce0 R08: 0000000000000020 R09: ffffffff86a6fea0
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810e3bc800
R13: ffff888107d43d80 R14: ffff888107d43d80 R15: ffff88810e3bcce0
FS:  00007f40f3e19700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004e6ef0 CR3: 000000011ebac000 CR4: 0000000000350ef0
Call Trace:
 __list_add include/linux/list.h:67 [inline]
 list_add include/linux/list.h:86 [inline]
 io_file_get+0x1f8/0x410 fs/io_uring.c:6466
 __io_splice_prep+0x43/0x120 fs/io_uring.c:3866
 io_splice_prep fs/io_uring.c:3920 [inline]
 io_req_prep+0x3c6/0xc70 fs/io_uring.c:6081
 io_queue_sqe+0x193/0x370 fs/io_uring.c:6628
 io_submit_sqe fs/io_uring.c:6705 [inline]
 io_submit_sqes+0x7fd/0xc60 fs/io_uring.c:6953
 __do_sys_io_uring_enter fs/io_uring.c:9353 [inline]
 __se_sys_io_uring_enter fs/io_uring.c:9296 [inline]
 __x64_sys_io_uring_enter+0x38a/0x570 fs/io_uring.c:9296
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f40f3e18c68 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e219
RDX: 0000000000000000 RSI: 000000000000450c RDI: 0000000000000004
RBP: 000000000119c080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 000000000119c034
R13: 00007ffff095c34f R14: 00007f40f3e199c0 R15: 000000000119c034
Modules linked in:
---[ end trace 006f11b8bd81379b ]---
RIP: 0010:__list_add_valid+0x41/0x50 lib/list_debug.c:29
Code: 85 2f 62 77 01 48 39 c7 74 0b 48 39 d7 74 06 b8 01 00 00 00 c3 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 88 55 7b 84 e8 29 bb 70 01 <0f> 0b 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 48 b9 00 01 00 00 00
RSP: 0018:ffffc90002afbca0 EFLAGS: 00010046
RAX: 0000000000000058 RBX: ffff88810e1ac600 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff8493e65e RDI: 00000000ffffffff
RBP: ffffc90002afbce0 R08: 0000000000000020 R09: ffffffff86a6fea0
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810e3bc800
R13: ffff888107d43d80 R14: ffff888107d43d80 R15: ffff88810e3bcce0
FS:  00007f40f3e19700(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004e6ef0 CR3: 000000011ebac000 CR4: 0000000000350ef0