==================================================================
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x322/0x370
Write of size 4 at addr 0000000000000118 by task iou-wrk-3826/3828
CPU: 0 PID: 3828 Comm: iou-wrk-3826 Not tainted 5.19.0-rc1-next-20220610 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x8b/0xb3
kasan_report+0xbe/0x1c0
kasan_check_range+0xf9/0x1e0
io_file_get_normal+0x322/0x370
io_issue_sqe+0x1932/0x9d50
io_wq_submit_work+0x282/0x730
io_worker_handle_work+0xb19/0x1990
io_wqe_worker+0x600/0xd30
ret_from_fork+0x22/0x30
</TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000118
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD d743067 P4D d743067 PUD 42b91067 PMD 0
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 3828 Comm: iou-wrk-3826 Tainted: G B 5.19.0-rc1-next-20220610 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:io_file_get_normal+0x322/0x370
Code: bb 98 07 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 75 56 48 8b 9b 98 07 00 00 be 04 00 00 00 48 8d bb 18 01 00 00 e8 2e 68 e4 ff <f0> ff 83 18 01 00 00 e9 7d fd ff ff e8 dd 64 e4 ff e9 64 fd ff ff
RSP: 0018:ffff8880434cfa98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88800f99b580 RSI: ffffffff840ca3fb RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888042c1f180
R13: 0000000000180204 R14: 0000000000000004 R15: ffff88803d49b8c0
FS: 00007fa1b7309700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 0000000042a34000 CR4: 0000000000350ef0
Call Trace:
<TASK>
io_issue_sqe+0x1932/0x9d50
io_wq_submit_work+0x282/0x730
io_worker_handle_work+0xb19/0x1990
io_wqe_worker+0x600/0xd30
ret_from_fork+0x22/0x30
</TASK>
Modules linked in:
CR2: 0000000000000118
---[ end trace 0000000000000000 ]---
RIP: 0010:io_file_get_normal+0x322/0x370
Code: bb 98 07 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 75 56 48 8b 9b 98 07 00 00 be 04 00 00 00 48 8d bb 18 01 00 00 e8 2e 68 e4 ff <f0> ff 83 18 01 00 00 e9 7d fd ff ff e8 dd 64 e4 ff e9 64 fd ff ff
RSP: 0018:ffff8880434cfa98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88800f99b580 RSI: ffffffff840ca3fb RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888042c1f180
R13: 0000000000180204 R14: 0000000000000004 R15: ffff88803d49b8c0
FS: 00007fa1b7309700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 0000000042a34000 CR4: 0000000000350ef0
ieee80211 phy12: Selected rate control algorithm 'minstrel_ht'
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
loop0: detected capacity change from 0 to 8
=======================================================
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
nfs4: Unknown parameter 'syztnl0'
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
ieee80211 phy13: Selected rate control algorithm 'minstrel_ht'
loop0: detected capacity change from 0 to 8
nfs4: Unknown parameter 'syztnl0'
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
ieee80211 phy14: Selected rate control algorithm 'minstrel_ht'
ieee80211 phy15: Selected rate control algorithm 'minstrel_ht'
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
ieee80211 phy16: Selected rate control algorithm 'minstrel_ht'
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
ieee80211 phy17: Selected rate control algorithm 'minstrel_ht'
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
loop6: detected capacity change from 0 to 256
loop6: detected capacity change from 0 to 256
----------------
Code disassembly (best guess):
0: bb 98 07 00 00 mov $0x798,%ebx
5: 48 89 fa mov %rdi,%rdx
8: 48 c1 ea 03 shr $0x3,%rdx
c: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
10: 75 56 jne 0x68
12: 48 8b 9b 98 07 00 00 mov 0x798(%rbx),%rbx
19: be 04 00 00 00 mov $0x4,%esi
1e: 48 8d bb 18 01 00 00 lea 0x118(%rbx),%rdi
25: e8 2e 68 e4 ff callq 0xffe46858
* 2a: f0 ff 83 18 01 00 00 lock incl 0x118(%rbx) <-- trapping instruction
31: e9 7d fd ff ff jmpq 0xfffffdb3
36: e8 dd 64 e4 ff callq 0xffe46518
3b: e9 64 fd ff ff jmpq 0xfffffda4