BUG: kernel NULL pointer dereference, address: 000000000000002c
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 106b25067 P4D 106b25067 PUD 106ba4067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 25 Comm: kworker/1:1 Not tainted 6.1.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: events io_rsrc_put_work
RIP: 0010:io_get_cqe_overflow io_uring/io_uring.h:108 [inline]
RIP: 0010:io_get_cqe+0x45/0x130 io_uring/io_uring.h:125
Code: bb d8 04 00 00 eb 10 83 3d eb 83 3a 01 00 74 33 48 8d bb a8 00 00 00 be ff ff ff ff e8 94 32 60 00 eb 20 48 8b 83 d8 05 00 00 <f6> 40 2c 04 8b 05 c5 83 3a 01 75 04 85 c0 eb 09 85 c0 74 05 e8 22
RSP: 0018:ffffc900000dfd88 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff8881052af000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000005 RDI: ffff8881052af000
RBP: ffff8881052af000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 000073746e657665 R12: 0000000000000005
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000002c CR3: 0000000106ba3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 io_fill_cqe_aux+0x1f/0xf0 io_uring/io_uring.c:832
 __io_post_aux_cqe+0x3c/0xe0 io_uring/io_uring.c:880
 __io_rsrc_put_work io_uring/rsrc.c:176 [inline]
 io_rsrc_put_work+0x83/0x160 io_uring/rsrc.c:202
 process_one_work+0x258/0x4d0 kernel/workqueue.c:2289
 worker_thread+0x218/0x370 kernel/workqueue.c:2436
 kthread+0xd5/0xf0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Modules linked in:
CR2: 000000000000002c
---[ end trace 0000000000000000 ]---
RIP: 0010:io_get_cqe_overflow io_uring/io_uring.h:108 [inline]
RIP: 0010:io_get_cqe+0x45/0x130 io_uring/io_uring.h:125
Code: bb d8 04 00 00 eb 10 83 3d eb 83 3a 01 00 74 33 48 8d bb a8 00 00 00 be ff ff ff ff e8 94 32 60 00 eb 20 48 8b 83 d8 05 00 00 <f6> 40 2c 04 8b 05 c5 83 3a 01 75 04 85 c0 eb 09 85 c0 74 05 e8 22
RSP: 0018:ffffc900000dfd88 EFLAGS: 00010202

RAX: 0000000000000000 RBX: ffff8881052af000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000005 RDI: ffff8881052af000
RBP: ffff8881052af000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 000073746e657665 R12: 0000000000000005
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888237d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000002c CR3: 0000000106ba3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	bb d8 04 00 00       	mov    $0x4d8,%ebx
   5:	eb 10                	jmp    0x17
   7:	83 3d eb 83 3a 01 00 	cmpl   $0x0,0x13a83eb(%rip)        # 0x13a83f9
   e:	74 33                	je     0x43
  10:	48 8d bb a8 00 00 00 	lea    0xa8(%rbx),%rdi
  17:	be ff ff ff ff       	mov    $0xffffffff,%esi
  1c:	e8 94 32 60 00       	call   0x6032b5
  21:	eb 20                	jmp    0x43
  23:	48 8b 83 d8 05 00 00 	mov    0x5d8(%rbx),%rax
* 2a:	f6 40 2c 04          	testb  $0x4,0x2c(%rax) <-- trapping instruction
  2e:	8b 05 c5 83 3a 01    	mov    0x13a83c5(%rip),%eax        # 0x13a83f9
  34:	75 04                	jne    0x3a
  36:	85 c0                	test   %eax,%eax
  38:	eb 09                	jmp    0x43
  3a:	85 c0                	test   %eax,%eax
  3c:	74 05                	je     0x43
  3e:	e8                   	.byte 0xe8
  3f:	22                   	.byte 0x22