==================================================================
BUG: KASAN: null-ptr-deref in io_file_get_normal+0x322/0x370
Write of size 4 at addr 0000000000000118 by task iou-wrk-15047/15055

CPU: 0 PID: 15055 Comm: iou-wrk-15047 Not tainted 5.19.0-rc2-next-20220616 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x8b/0xb3
 kasan_report+0xbe/0x1c0
 kasan_check_range+0xf9/0x1e0
 io_file_get_normal+0x322/0x370
 io_splice+0xd0/0x4b0
 io_issue_sqe+0x165/0xb70
 io_wq_submit_work+0x29d/0x9b0
 io_worker_handle_work+0xb19/0x1990
 io_wqe_worker+0x600/0xd30
 ret_from_fork+0x22/0x30
 </TASK>
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000118
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 4682d067 P4D 4682d067 PUD 96b5067 PMD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 15055 Comm: iou-wrk-15047 Tainted: G    B             5.19.0-rc2-next-20220616 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:io_file_get_normal+0x322/0x370
Code: bb 98 07 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 75 56 48 8b 9b 98 07 00 00 be 04 00 00 00 48 8d bb 18 01 00 00 e8 5e 79 76 ff <f0> ff 83 18 01 00 00 e9 7d fd ff ff e8 0d 76 76 ff e9 64 fd ff ff
RSP: 0018:ffff8880632b7be0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880172a0000 RSI: ffffffff840cf45c RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888017272f00
R13: 0000000000180204 R14: 0000000000000002 R15: 0000000000000000
FS:  00007fdd55125700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 0000000048a50000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 io_splice+0xd0/0x4b0
 io_issue_sqe+0x165/0xb70
 io_wq_submit_work+0x29d/0x9b0
 io_worker_handle_work+0xb19/0x1990
 io_wqe_worker+0x600/0xd30
 ret_from_fork+0x22/0x30
 </TASK>
Modules linked in:
CR2: 0000000000000118
---[ end trace 0000000000000000 ]---
RIP: 0010:io_file_get_normal+0x322/0x370
Code: bb 98 07 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 75 56 48 8b 9b 98 07 00 00 be 04 00 00 00 48 8d bb 18 01 00 00 e8 5e 79 76 ff <f0> ff 83 18 01 00 00 e9 7d fd ff ff e8 0d 76 76 ff e9 64 fd ff ff
RSP: 0018:ffff8880632b7be0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff8880172a0000 RSI: ffffffff840cf45c RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888017272f00
R13: 0000000000180204 R14: 0000000000000002 R15: 0000000000000000
FS:  00007fdd55125700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 0000000048a50000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	bb 98 07 00 00       	mov    $0x798,%ebx
   5:	48 89 fa             	mov    %rdi,%rdx
   8:	48 c1 ea 03          	shr    $0x3,%rdx
   c:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  10:	75 56                	jne    0x68
  12:	48 8b 9b 98 07 00 00 	mov    0x798(%rbx),%rbx
  19:	be 04 00 00 00       	mov    $0x4,%esi
  1e:	48 8d bb 18 01 00 00 	lea    0x118(%rbx),%rdi
  25:	e8 5e 79 76 ff       	callq  0xff767988
* 2a:	f0 ff 83 18 01 00 00 	lock incl 0x118(%rbx) <-- trapping instruction
  31:	e9 7d fd ff ff       	jmpq   0xfffffdb3
  36:	e8 0d 76 76 ff       	callq  0xff767648
  3b:	e9 64 fd ff ff       	jmpq   0xfffffda4