Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.13.0-rc2-syzkaller-00130-g150b567e0d57 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: netns cleanup_net
RIP: 0010:dccp_feat_list_purge+0xc4/0x170 net/dccp/feat.c:545
Code: 0f 85 91 00 00 00 0f b6 7d 11 48 89 ee e8 34 ec ff ff 48 89 ef e8 ac 76 9c f7 e8 97 b6 44 f7 4c 8d 63 18 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 75 5c 48 8b 43 18 48 89 dd 48 83 e8 18 4d 39 e5 75
RSP: 0018:ffffc90000107a18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffffffffe8 RCX: 1ffffffff2d3e741
RDX: ffff88801ced3c00 RSI: ffffffff8a548759 RDI: ffffffff8bb15760
RBP: ffff888026826800 R08: 0000000000000001 R09: fffffbfff2d369ac
R10: ffffffff969b4d67 R11: 0000000000000b8f R12: 0000000000000000
R13: ffff888062b99f18 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2df1dff8 CR3: 000000007a8e4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
inet_csk_destroy_sock+0x1a3/0x440 net/ipv4/inet_connection_sock.c:1306
dccp_close+0xa48/0xd70 net/dccp/proto.c:1078
inet_release+0x13c/0x280 net/ipv4/af_inet.c:435
inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487
__sock_release net/socket.c:640 [inline]
sock_release+0x8e/0x1d0 net/socket.c:668
inet_ctl_sock_destroy include/net/inet_common.h:74 [inline]
dccp_v6_exit_net+0x6d/0x90 net/dccp/ipv6.c:1124
ops_exit_list+0xb0/0x180 net/core/net_namespace.c:172
cleanup_net+0x5b7/0xbd0 net/core/net_namespace.c:648
process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
process_scheduled_works kernel/workqueue.c:3310 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dccp_feat_list_purge+0xc4/0x170 net/dccp/feat.c:545
Code: 0f 85 91 00 00 00 0f b6 7d 11 48 89 ee e8 34 ec ff ff 48 89 ef e8 ac 76 9c f7 e8 97 b6 44 f7 4c 8d 63 18 4c 89 e0 48 c1 e8 03 <42> 80 3c 30 00 75 5c 48 8b 43 18 48 89 dd 48 83 e8 18 4d 39 e5 75
RSP: 0018:ffffc90000107a18 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffffffffffffe8 RCX: 1ffffffff2d3e741
RDX: ffff88801ced3c00 RSI: ffffffff8a548759 RDI: ffffffff8bb15760
RBP: ffff888026826800 R08: 0000000000000001 R09: fffffbfff2d369ac
R10: ffffffff969b4d67 R11: 0000000000000b8f R12: 0000000000000000
R13: ffff888062b99f18 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2df1dff8 CR3: 000000000db7e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 0f 85 91 00 00 00 jne 0x97
6: 0f b6 7d 11 movzbl 0x11(%rbp),%edi
a: 48 89 ee mov %rbp,%rsi
d: e8 34 ec ff ff call 0xffffec46
12: 48 89 ef mov %rbp,%rdi
15: e8 ac 76 9c f7 call 0xf79c76c6
1a: e8 97 b6 44 f7 call 0xf744b6b6
1f: 4c 8d 63 18 lea 0x18(%rbx),%r12
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction
2f: 75 5c jne 0x8d
31: 48 8b 43 18 mov 0x18(%rbx),%rax
35: 48 89 dd mov %rbx,%rbp
38: 48 83 e8 18 sub $0x18,%rax
3c: 4d 39 e5 cmp %r12,%r13
3f: 75 .byte 0x75