syzbot

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
CPU: 0 UID: 0 PID: 1089 Comm: kworker/u8:5 Not tainted 6.16.0-rc4-next-20250630-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: netns cleanup_net
RIP: 0010:__cpa_addr arch/x86/mm/pat/set_memory.c:320 [inline]
RIP: 0010:__cpa_flush_tlb+0x123/0x270 arch/x86/mm/pat/set_memory.c:408
Code: 8b 44 24 30 80 3c 18 00 74 08 4c 89 e7 e8 d5 c1 ae 00 4d 8b 24 24 85 ed 0f 85 ad 00 00 00 e8 c4 ad 4a 00 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 4c 89 f5 74 08 4c 89 e7 e8 ac c1 ae 00 49 c1 e5 0c 4d
RSP: 0018:ffffc90000007ef0 EFLAGS: 00010003
RAX: 0000000000000008 RBX: dffffc0000000000 RCX: ffff888026960000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8fa17437 R09: 1ffffffff1f42e86
R10: dffffc0000000000 R11: ffffffff81751cb0 R12: 0000000000000046
R13: 0000000000000000 R14: ffffc9000423f480 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125c1d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f639489130e CR3: 000000004f758000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 csd_do_func kernel/smp.c:134 [inline]
 __flush_smp_call_function_queue+0x370/0xaa0 kernel/smp.c:540
 __sysvec_call_function_single+0xa8/0x3d0 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:preempt_schedule_irq+0xb0/0x150 kernel/sched/core.c:7019
Code: 24 20 f6 44 24 21 02 74 0c 90 0f 0b 48 f7 03 08 00 00 00 74 64 bf 01 00 00 00 e8 4b 6c 1f f6 e8 26 94 56 f6 fb bf 01 00 00 00 <e8> 1b ab ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
RSP: 0018:ffffc9000402f4c0 EFLAGS: 00000282
RAX: 6f5b54d61d387c00 RBX: 0000000000000000 RCX: 6f5b54d61d387c00
RDX: 0000000000000006 RSI: ffffffff8d992cd0 RDI: 0000000000000001
RBP: ffffc9000402f570 R08: ffffffff8fa17437 R09: 1ffffffff1f42e86
R10: dffffc0000000000 R11: fffffbfff1f42e87 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000805e98
 irqentry_exit+0x6f/0x90 kernel/entry/common.c:307
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:lockdep_unregister_key+0x2c5/0x310 kernel/locking/lockdep.c:6619
Code: 65 48 8b 05 1d 73 02 11 48 3b 44 24 10 0f 84 26 fe ff ff e8 ed e1 d1 09 e8 18 e3 d1 09 41 f7 c7 00 02 00 00 74 bd fb 40 84 ed <75> bc eb cd 90 0f 0b 90 e9 19 ff ff ff 90 0f 0b 90 e9 2a ff ff ff
RSP: 0018:ffffc9000402f638 EFLAGS: 00000246
RAX: 6f5b54d61d387c00 RBX: ffff8880301d9a98 RCX: 6f5b54d61d387c00
RDX: ffffffff9363e358 RSI: ffffffff8d9a65dc RDI: ffffffff8be31d00
RBP: ffff8880301d9a00 R08: 0000000000000000 R09: ffffffff81aaac58
R10: dffffc0000000000 R11: fffffbfff1f42e87 R12: 0000000000000000
R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000206
 __qdisc_destroy+0x166/0x420 net/sched/sch_generic.c:1081
 qdisc_put net/sched/sch_generic.c:1107 [inline]
 dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1495
 unregister_netdevice_many_notify+0xea7/0x2320 net/core/dev.c:12106
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:249
 cleanup_net+0x4c5/0x800 net/core/net_namespace.c:686
 process_one_work kernel/workqueue.c:3239 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403
 kthread+0x70e/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__cpa_addr arch/x86/mm/pat/set_memory.c:320 [inline]
RIP: 0010:__cpa_flush_tlb+0x123/0x270 arch/x86/mm/pat/set_memory.c:408
Code: 8b 44 24 30 80 3c 18 00 74 08 4c 89 e7 e8 d5 c1 ae 00 4d 8b 24 24 85 ed 0f 85 ad 00 00 00 e8 c4 ad 4a 00 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 4c 89 f5 74 08 4c 89 e7 e8 ac c1 ae 00 49 c1 e5 0c 4d
RSP: 0018:ffffc90000007ef0 EFLAGS: 00010003
RAX: 0000000000000008 RBX: dffffc0000000000 RCX: ffff888026960000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8fa17437 R09: 1ffffffff1f42e86
R10: dffffc0000000000 R11: ffffffff81751cb0 R12: 0000000000000046
R13: 0000000000000000 R14: ffffc9000423f480 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125c1d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f639489130e CR3: 000000004f758000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	8b 44 24 30          	mov    0x30(%rsp),%eax
   4:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1)
   8:	74 08                	je     0x12
   a:	4c 89 e7             	mov    %r12,%rdi
   d:	e8 d5 c1 ae 00       	call   0xaec1e7
  12:	4d 8b 24 24          	mov    (%r12),%r12
  16:	85 ed                	test   %ebp,%ebp
  18:	0f 85 ad 00 00 00    	jne    0xcb
  1e:	e8 c4 ad 4a 00       	call   0x4aade7
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	4c 89 f5             	mov    %r14,%rbp
  31:	74 08                	je     0x3b
  33:	4c 89 e7             	mov    %r12,%rdi
  36:	e8 ac c1 ae 00       	call   0xaec1e7
  3b:	49 c1 e5 0c          	shl    $0xc,%r13
  3f:	4d                   	rex.WRB