Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 6132 Comm: iou-sqp-6131 Not tainted 6.14.0-rc4-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:native_tss_update_io_bitmap+0x1b3/0x730 arch/x86/kernel/process.c:471
Code: 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 0f 85 2f 05 00 00 4c 89 ea 4c 8b 7d 68 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 f9 04 00 00 4d 8b 65 00 4c 89 ff 4c 89 e6 e8 44
RSP: 0018:ffffc90003aa7550 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 1ffff92000754eac RCX: ffffffff815ed497
RDX: 0000000000000000 RSI: ffffffff815ed4a6 RDI: ffff888051c83d40
RBP: ffff88806a70a000 R08: 0000000000000007 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88806a70a068 R15: 0000000000000000
FS:  00007f271657f6c0(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556ffaa808 CR3: 000000003194e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 task_update_io_bitmap.part.0+0x2a/0x60 arch/x86/kernel/ioport.c:47
 task_update_io_bitmap arch/x86/kernel/ioport.c:40 [inline]
 io_bitmap_exit+0x8d/0x150 arch/x86/kernel/ioport.c:57
 exit_thread+0x80/0x90 arch/x86/kernel/process.c:123
 copy_process+0x5cef/0x8c50 kernel/fork.c:2655
 create_io_thread+0xbf/0x100 kernel/fork.c:2763
 create_io_worker+0x1c2/0x5d0 io_uring/io-wq.c:864
 io_wq_create_worker io_uring/io-wq.c:326 [inline]
 io_wq_enqueue+0x664/0xb30 io_uring/io-wq.c:979
 io_queue_iowq+0x28b/0x5c0 io_uring/io_uring.c:540
 io_queue_sqe_fallback+0xcd/0x9f0 io_uring/io_uring.c:1972
 io_submit_sqe io_uring/io_uring.c:2199 [inline]
 io_submit_sqes+0x136f/0x2670 io_uring/io_uring.c:2321
 __io_sq_thread io_uring/sqpoll.c:189 [inline]
 io_sq_thread+0x9a3/0x1c30 io_uring/sqpoll.c:312
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:native_tss_update_io_bitmap+0x1b3/0x730 arch/x86/kernel/process.c:471
Code: 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 0f 85 2f 05 00 00 4c 89 ea 4c 8b 7d 68 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 f9 04 00 00 4d 8b 65 00 4c 89 ff 4c 89 e6 e8 44
RSP: 0018:ffffc90003aa7550 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 1ffff92000754eac RCX: ffffffff815ed497
RDX: 0000000000000000 RSI: ffffffff815ed4a6 RDI: ffff888051c83d40
RBP: ffff88806a70a000 R08: 0000000000000007 R09: 0000000000000003
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88806a70a068 R15: 0000000000000000
FS:  00007f271657f6c0(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055556ffaa808 CR3: 000000003194e000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	df 4c 89 f2          	fisttps -0xe(%rcx,%rcx,4)
   4:	48 c1 ea 03          	shr    $0x3,%rdx
   8:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   c:	0f 85 2f 05 00 00    	jne    0x541
  12:	4c 89 ea             	mov    %r13,%rdx
  15:	4c 8b 7d 68          	mov    0x68(%rbp),%r15
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 c1 ea 03          	shr    $0x3,%rdx
* 27:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2b:	0f 85 f9 04 00 00    	jne    0x52a
  31:	4d 8b 65 00          	mov    0x0(%r13),%r12
  35:	4c 89 ff             	mov    %r15,%rdi
  38:	4c 89 e6             	mov    %r12,%rsi
  3b:	e8                   	.byte 0xe8
  3c:	44                   	rex.R