Hello, When using modified Syzkaller to fuzz the Linux kernel-5.15.58, the following crash was triggered. HEAD commit: 568035b01cfb Linux-5.15.58 git tree: upstream console output: https://drive.google.com/file/d/1lW1tGegMXfLgS1gfyWmZShhX7LOx3vFJ/view?usp=sharing kernel config: https://drive.google.com/file/d/1wgIUDwP5ho29AM-K7HhysSTfWFpfXYkG/view?usp=sharing syz repro: https://drive.google.com/file/d/13l2TaalviEK6WBoXjF4tAiYfSUmlzstU/view?usp=sharing C reproducer: https://drive.google.com/file/d/1iHOn1jRiQs4iKxxRTDZcATyJcZlVFQqR/view?usp=sharing There is a similar problem: https://www.spinics.net/lists/io-uring/msg13047.html Environment: Ubuntu 20.04 on Linux 5.4.0 QEMU 4.2.1: qemu-system-x86_64 \ -m 2G \ -smp 2 \ -kernel /home/workdir/bzImage \ -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \ -drive file=/home/workdir/stretch.img,format=raw \ -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \ -net nic,model=e1000 \ -enable-kvm \ -nographic \ -pidfile vm.pid \ 2>&1 | tee vm.log If you fix this issue, please add the following tag to the commit: Reported-by: Jiacheng Xu<stitch@xxxxxxxxxx> ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: null-ptr-deref in atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline] BUG: KASAN: null-ptr-deref in io_req_track_inflight fs/io_uring.c:1408 [inline] BUG: KASAN: null-ptr-deref in io_file_get_normal+0x318/0x340 fs/io_uring.c:6934 Write of size 4 at addr 0000000000000118 by task iou-wrk-13680/13681 CPU: 3 PID: 13681 Comm: iou-wrk-13680 Not tainted 5.15.58 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 __kasan_report mm/kasan/report.c:446 [inline] kasan_report.cold+0x66/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline] io_req_track_inflight fs/io_uring.c:1408 [inline] io_file_get_normal+0x318/0x340 fs/io_uring.c:6934 io_file_get fs/io_uring.c:6944 [inline] io_tee fs/io_uring.c:4051 [inline] io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK> ================================================================== Kernel panic - not syncing: panic_on_warn set ... CPU: 2 PID: 13681 Comm: iou-wrk-13680 Tainted: G B 5.15.58 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 panic+0x2b0/0x6dd kernel/panic.c:232 end_report mm/kasan/report.c:128 [inline] end_report.cold+0x63/0x6f mm/kasan/report.c:113 __kasan_report mm/kasan/report.c:449 [inline] kasan_report.cold+0x71/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x14e/0x1b0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_inc include/linux/atomic/atomic-instrumented.h:181 [inline] io_req_track_inflight fs/io_uring.c:1408 [inline] io_file_get_normal+0x318/0x340 fs/io_uring.c:6934 io_file_get fs/io_uring.c:6944 [inline] io_tee fs/io_uring.c:4051 [inline] io_issue_sqe+0x4ad9/0x7540 fs/io_uring.c:6797 io_wq_submit_work+0x1bc/0x390 fs/io_uring.c:6863 io_worker_handle_work+0x97c/0x1710 fs/io-wq.c:576 io_wqe_worker+0x5b1/0xd30 fs/io-wq.c:630 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 </TASK>
