==================================================================
BUG: KASAN: use-after-free in radix_tree_next_slot include/linux/radix-tree.h:422 [inline]
BUG: KASAN: use-after-free in idr_for_each+0x206/0x220 lib/idr.c:202
Read of size 8 at addr ffff888078d71478 by task iou-mgr-12000/12015

CPU: 0 PID: 12015 Comm: iou-mgr-12000 Not tainted 5.12.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xfa/0x151 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 radix_tree_next_slot include/linux/radix-tree.h:422 [inline]
 idr_for_each+0x206/0x220 lib/idr.c:202
 io_ring_ctx_wait_and_kill+0x100/0x330 fs/io_uring.c:8567
 io_uring_release+0x3e/0x50 fs/io_uring.c:8591
 __fput+0x288/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xbfc/0x2a60 kernel/exit.c:825
 io_wq_manager+0x278/0x340 fs/io-wq.c:754
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Allocated by task 12000:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 __kasan_slab_alloc+0x73/0x90 mm/kasan/common.c:460
 kasan_slab_alloc include/linux/kasan.h:223 [inline]
 slab_post_alloc_hook mm/slab.h:516 [inline]
 slab_alloc mm/slab.c:3325 [inline]
 kmem_cache_alloc+0x1c3/0x4f0 mm/slab.c:3502
 radix_tree_node_alloc.constprop.0+0x7c/0x350 lib/radix-tree.c:274
 idr_get_free+0x554/0xa60 lib/radix-tree.c:1504
 idr_alloc_u32+0x170/0x2d0 lib/idr.c:46
 idr_alloc_cyclic+0x102/0x230 lib/idr.c:125
 io_register_personality fs/io_uring.c:9626 [inline]
 __io_uring_register fs/io_uring.c:9839 [inline]
 __do_sys_io_uring_register+0xd06/0x3ff0 fs/io_uring.c:9891
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 12008:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free mm/kasan/common.c:360 [inline]
 ____kasan_slab_free mm/kasan/common.c:325 [inline]
 __kasan_slab_free+0xc7/0x100 mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 __cache_free mm/slab.c:3440 [inline]
 kmem_cache_free+0x6f/0x1d0 mm/slab.c:3733
 rcu_do_batch kernel/rcu/tree.c:2559 [inline]
 rcu_core+0x722/0x1280 kernel/rcu/tree.c:2794
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3039 [inline]
 call_rcu+0xb1/0x700 kernel/rcu/tree.c:3114
 radix_tree_node_free lib/radix-tree.c:308 [inline]
 delete_node+0x591/0x8c0 lib/radix-tree.c:571
 __radix_tree_delete+0x190/0x370 lib/radix-tree.c:1377
 radix_tree_delete_item+0xe7/0x230 lib/radix-tree.c:1428
 io_unregister_personality fs/io_uring.c:8498 [inline]
 io_remove_personalities+0x1a/0xa0 fs/io_uring.c:8511
 idr_for_each+0x113/0x220 lib/idr.c:208
 io_ring_ctx_wait_and_kill+0x100/0x330 fs/io_uring.c:8567
 io_uring_release+0x3e/0x50 fs/io_uring.c:8591
 __fput+0x288/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:140
 exit_task_work include/linux/task_work.h:30 [inline]
 do_exit+0xbfc/0x2a60 kernel/exit.c:825
 io_wq_manager+0x278/0x340 fs/io-wq.c:754
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xa4/0xd0 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3039 [inline]
 call_rcu+0xb1/0x700 kernel/rcu/tree.c:3114
 radix_tree_node_free lib/radix-tree.c:308 [inline]
 delete_node+0xef/0x8c0 lib/radix-tree.c:571
 __radix_tree_delete+0x190/0x370 lib/radix-tree.c:1377
 radix_tree_delete_item+0xe7/0x230 lib/radix-tree.c:1428
 free_pid+0x9b/0x260 kernel/pid.c:152
 __change_pid+0x1c1/0x2d0 kernel/pid.c:353
 __unhash_process kernel/exit.c:78 [inline]
 __exit_signal kernel/exit.c:148 [inline]
 release_task+0xd29/0x14d0 kernel/exit.c:199
 wait_task_zombie kernel/exit.c:1107 [inline]
 wait_consider_task+0x2fd2/0x3b70 kernel/exit.c:1334
 do_wait_thread kernel/exit.c:1397 [inline]
 do_wait+0x376/0xa00 kernel/exit.c:1468
 kernel_wait4+0x14c/0x260 kernel/exit.c:1630
 __do_sys_wait4+0x13f/0x150 kernel/exit.c:1658
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff888078d71440
 which belongs to the cache radix_tree_node of size 576
The buggy address is located 56 bytes inside of
 576-byte region [ffff888078d71440, ffff888078d71680)
The buggy address belongs to the page:
page:00000000c577f67d refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888078d71ffb pfn:0x78d71
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea0001f858c8 ffffea0001e31348 ffff88801086f000
raw: ffff888078d71ffb ffff888078d71180 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888078d71300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888078d71380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff888078d71400: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
                                                                ^
 ffff888078d71480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888078d71500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================