Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 9559 Comm: iou-sqp-9555 Not tainted 6.15.0-rc6-next-20250516-syzkaller-11779-g8566fc3b9653 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:native_tss_update_io_bitmap+0x16f/0x4c0 arch/x86/kernel/process.c:471
Code: 4c 89 f0 48 c1 e8 03 48 89 44 24 30 42 80 3c 20 00 74 08 4c 89 f7 e8 d0 2a a1 00 49 8b 1e 4c 89 f8 48 c1 e8 03 48 89 44 24 28 <42> 80 3c 20 00 74 08 4c 89 ff e8 b2 2a a1 00 66 ba 78 00 49 3b 1f
RSP: 0018:ffffc9000d11f360 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000347 RCX: ffffffff815e7480
RDX: 0000000000002080 RSI: 0000000000000008 RDI: ffff88807a959e00
RBP: ffffc9000d11f440 R08: ffff88807a959e07 R09: 1ffff1100f52b3c0
R10: dffffc0000000000 R11: ffffed100f52b3c1 R12: dffffc0000000000
R13: 1ffff92001a23e74 R14: ffff8880b8a09068 R15: 0000000000000000
FS:  00007f22eb66d6c0(0000) GS:ffff888128190000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fefecd762d8 CR3: 00000000264a0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 task_update_io_bitmap+0x96/0xc0 arch/x86/kernel/ioport.c:47
 io_bitmap_exit+0x4a/0xa0 arch/x86/kernel/ioport.c:57
 exit_thread+0x50/0x70 arch/x86/kernel/process.c:123
 copy_process+0x207e/0x30b0 kernel/fork.c:2439
 create_io_thread+0xea/0x140 kernel/fork.c:2547
 create_io_worker+0x178/0x4d0 io_uring/io-wq.c:872
 io_wq_create_worker io_uring/io-wq.c:329 [inline]
 io_wq_enqueue+0x4ec/0x6e0 io_uring/io-wq.c:999
 io_submit_state_end io_uring/io_uring.c:2198 [inline]
 io_submit_sqes+0x15d7/0x18f0 io_uring/io_uring.c:2314
 __io_sq_thread io_uring/sqpoll.c:189 [inline]
 io_sq_thread+0xa7c/0x1950 io_uring/sqpoll.c:312
 ret_from_fork+0x2ba/0x570 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:native_tss_update_io_bitmap+0x16f/0x4c0 arch/x86/kernel/process.c:471
Code: 4c 89 f0 48 c1 e8 03 48 89 44 24 30 42 80 3c 20 00 74 08 4c 89 f7 e8 d0 2a a1 00 49 8b 1e 4c 89 f8 48 c1 e8 03 48 89 44 24 28 <42> 80 3c 20 00 74 08 4c 89 ff e8 b2 2a a1 00 66 ba 78 00 49 3b 1f
RSP: 0018:ffffc9000d11f360 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000347 RCX: ffffffff815e7480
RDX: 0000000000002080 RSI: 0000000000000008 RDI: ffff88807a959e00
RBP: ffffc9000d11f440 R08: ffff88807a959e07 R09: 1ffff1100f52b3c0
R10: dffffc0000000000 R11: ffffed100f52b3c1 R12: dffffc0000000000
R13: 1ffff92001a23e74 R14: ffff8880b8a09068 R15: 0000000000000000
FS:  00007f22eb66d6c0(0000) GS:ffff888128190000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fefecd762d8 CR3: 00000000264a0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	4c 89 f0             	mov    %r14,%rax
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	48 89 44 24 30       	mov    %rax,0x30(%rsp)
   c:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  11:	74 08                	je     0x1b
  13:	4c 89 f7             	mov    %r14,%rdi
  16:	e8 d0 2a a1 00       	call   0xa12aeb
  1b:	49 8b 1e             	mov    (%r14),%rbx
  1e:	4c 89 f8             	mov    %r15,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	48 89 44 24 28       	mov    %rax,0x28(%rsp)
* 2a:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ff             	mov    %r15,%rdi
  34:	e8 b2 2a a1 00       	call   0xa12aeb
  39:	66 ba 78 00          	mov    $0x78,%dx
  3d:	49 3b 1f             	cmp    (%r15),%rbx