bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): Released all slaves
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[dfff800000000000] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 21345 Comm: kworker/u4:5 Not tainted 5.19.0-rc1-syzkaller-00011-g9886142c7a22 #0
Hardware name: linux,dummy-virt (DT)
Workqueue: netns cleanup_net
pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x78/0x16c lib/list_debug.c:51
lr : __list_del_entry include/linux/list.h:134 [inline]
lr : list_del include/linux/list.h:148 [inline]
lr : cttimeout_net_exit+0x168/0x3bc net/netfilter/nfnetlink_cttimeout.c:618
sp : ffff800011ba79f0
x29: ffff800011ba79f0 x28: 1fffe00002e53b64 x27: ffff00001729db28
x26: ffff00001729db20 x25: dfff800000000000 x24: dead000000000100
x23: dead000000000122 x22: ffff000031632910 x21: 0000000000000000
x20: 0000000000000000 x19: ffff00001729db20 x18: ffff00006a8bfbbc
x17: 0000000000000000 x16: 0000000000000000 x15: 1fffe0000d517f78
x14: 1ffff00002374ef4 x13: 0000000000000000 x12: ffff60000286c781
x11: 1fffe0000286c780 x10: ffff60000286c780 x9 : dfff800000000000
x8 : ffff000014363c03 x7 : 0000000000000001 x6 : 00009ffffd793880
x5 : ffff000014363c00 x4 : ffff60000286c781 x3 : ffff80000bdad710
x2 : 1fffe00002e53b65 x1 : 0000000000000000 x0 : dfff800000000000
Call trace:
 __list_del_entry_valid+0x78/0x16c lib/list_debug.c:51
 __list_del_entry include/linux/list.h:134 [inline]
 list_del include/linux/list.h:148 [inline]
 cttimeout_net_exit+0x168/0x3bc net/netfilter/nfnetlink_cttimeout.c:618
 ops_exit_list+0x80/0x140 net/core/net_namespace.c:162
 cleanup_net+0x3a4/0x810 net/core/net_namespace.c:594
 process_one_work+0x74c/0x16e0 kernel/workqueue.c:2289
 worker_thread+0x3cc/0xc40 kernel/workqueue.c:2436
 kthread+0x234/0x2a0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:867
Code: 54000600 d343fe81 d2d00000 f2fbffe0 (38e06820) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	54000600 	b.eq	0xc0  // b.none
   4:	d343fe81 	lsr	x1, x20, #3
   8:	d2d00000 	mov	x0, #0x800000000000        	// #140737488355328
   c:	f2fbffe0 	movk	x0, #0xdfff, lsl #48
* 10:	38e06820 	ldrsb	w0, [x1, x0] <-- trapping instruction