general protection fault, probably for non-canonical address 0xdffffc0000000033: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000198-0x000000000000019f]
CPU: 0 PID: 5707 Comm: syz-executor.2 Not tainted 5.18.0-rc5-next-20220502 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:x86_pmu_enable_event+0x6a/0x2f0
Code: 00 e8 1a 47 43 00 48 c7 c7 20 63 60 84 e8 9e d9 14 03 48 8d bb 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 65 4c 8b 2d 52 2c 01 7f 84 c0 74 08 3c 03 0f 8e 1e 02
RSP: 0018:ffff88806ce09bf0 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000033 RSI: 0000000000010002 RDI: 0000000000000198
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff8101029e R11: 0000000000000000 R12: 0000000000000001
R13: ffff88806ce21c20 R14: fffffbfff0b1dd4d R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a190e1d0e0 CR3: 000000000d420000 CR4: 0000000000350ef0
DR0: 0100000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 amd_pmu_enable_all+0x12c/0x1a0
 x86_pmu_enable+0x580/0xd90
 perf_event_task_tick+0xa7c/0x1030
 scheduler_tick+0x17e/0x350
 update_process_times+0x18b/0x1f0
 tick_sched_handle+0x9b/0x180
 tick_sched_timer+0xee/0x120
 __hrtimer_run_queues+0x1ca/0xbd0
 hrtimer_interrupt+0x315/0x770
 __sysvec_apic_timer_interrupt+0x144/0x4f0
 sysvec_apic_timer_interrupt+0x89/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20
RIP: 0010:lock_acquire+0x1db/0x530
Code: 02 b8 ff ff ff ff 65 0f c1 05 d9 7a d9 7e 83 f8 01 0f 85 c4 02 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffff88804562f428 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff11008ac5e87 RCX: 0000000050e51c27
RDX: 1ffff11001163493 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff86a5e747
R10: fffffbfff0d4bce8 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: ffffffff85203b80 R15: 0000000000000000
 __is_insn_slot_addr+0x3d/0x250
 kernel_text_address+0x40/0xb0
 __kernel_text_address+0x9/0x30
 unwind_get_return_address+0x51/0x90
 arch_stack_walk+0x99/0xf0
 stack_trace_save+0x8c/0xc0
 kasan_save_stack+0x1e/0x40
 kasan_set_track+0x21/0x30
 kasan_set_free_info+0x20/0x30
 __kasan_slab_free+0x108/0x170
 kfree+0xcf/0x410
 __io_cqring_overflow_flush+0x24f/0x730
 io_ring_ctx_wait_and_kill+0xb1/0x30f
 io_uring_release+0x42/0x46
 __fput+0x272/0x9d0
 task_work_run+0xe2/0x1a0
 do_exit+0xaf7/0x27e0
 do_group_exit+0xd2/0x2f0
 get_signal+0x2303/0x2350
 arch_do_signal_or_restart+0x88/0x1a40
 exit_to_user_mode_prepare+0x131/0x1a0
 syscall_exit_to_user_mode+0x19/0x40
 do_syscall_64+0x48/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fbb5b7a5b19
Code: Unable to access opcode bytes at RIP 0x7fbb5b7a5aef.
RSP: 002b:00007fbb58d1b218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fbb5b8b8f68 RCX: 00007fbb5b7a5b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fbb5b8b8f68
RBP: 00007fbb5b8b8f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbb5b8b8f6c
R13: 00007ffdd2fdd3bf R14: 00007fbb58d1b300 R15: 0000000000022000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:x86_pmu_enable_event+0x6a/0x2f0
Code: 00 e8 1a 47 43 00 48 c7 c7 20 63 60 84 e8 9e d9 14 03 48 8d bb 98 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 65 4c 8b 2d 52 2c 01 7f 84 c0 74 08 3c 03 0f 8e 1e 02
RSP: 0018:ffff88806ce09bf0 EFLAGS: 00010016
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000033 RSI: 0000000000010002 RDI: 0000000000000198
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff8101029e R11: 0000000000000000 R12: 0000000000000001
R13: ffff88806ce21c20 R14: fffffbfff0b1dd4d R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a190e1d0e0 CR3: 000000000d420000 CR4: 0000000000350ef0
DR0: 0100000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 1a 47 43 00       	callq  0x43471f
   5:	48 c7 c7 20 63 60 84 	mov    $0xffffffff84606320,%rdi
   c:	e8 9e d9 14 03       	callq  0x314d9af
  11:	48 8d bb 98 01 00 00 	lea    0x198(%rbx),%rdi
  18:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1f:	fc ff df
  22:	48 89 fa             	mov    %rdi,%rdx
  25:	48 c1 ea 03          	shr    $0x3,%rdx
* 29:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2d:	65 4c 8b 2d 52 2c 01 	mov    %gs:0x7f012c52(%rip),%r13        # 0x7f012c87
  34:	7f
  35:	84 c0                	test   %al,%al
  37:	74 08                	je     0x41
  39:	3c 03                	cmp    $0x3,%al
  3b:	0f                   	.byte 0xf
  3c:	8e 1e                	mov    (%rsi),%ds
  3e:	02                   	.byte 0x2