------------[ cut here ]------------
WARNING: CPU: 0 PID: 1138 at net/can/isotp.c:852 isotp_tx_timer_handler+0x717/0xd10 net/can/isotp.c:852
Modules linked in:
CPU: 0 PID: 1138 Comm: kworker/0:3 Not tainted 5.17.0-rc6-next-20220303-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events iterate_cleanup_work
RIP: 0010:isotp_tx_timer_handler+0x717/0xd10 net/can/isotp.c:852
Code: f9 44 0f b6 25 13 1f 68 05 31 ff 44 89 e6 e8 d0 43 40 f9 45 84 e4 0f 85 9d fa ff ff e9 16 96 21 01 85 ed 75 52 e8 d9 3f 40 f9 <0f> 0b 45 31 e4 e8 cf 3f 40 f9 48 8b 74 24 40 48 b8 00 00 00 00 00
RSP: 0018:ffffc90000007d50 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888073698568 RCX: 0000000000000100
RDX: ffff88801e0b8000 RSI: ffffffff8838e6b7 RDI: 0000000000000003
RBP: 0000000000000000 R08: ffffffff8ae43ec0 R09: ffffffff8838e04f
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880b9c2a880 R14: ffff8880b9c2a600 R15: ffffffff8838dfa0
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e323000 CR3: 000000007e553000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:check_kcov_mode kernel/kcov.c:166 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:200
Code: 00 00 e9 96 96 74 02 66 0f 1f 44 00 00 48 8b be b0 01 00 00 e8 b4 ff ff ff 31 c0 c3 90 65 8b 05 29 49 89 7e 89 c1 48 8b 34 24 <81> e1 00 01 00 00 65 48 8b 14 25 00 70 02 00 a9 00 01 ff 00 74 0e
RSP: 0018:ffffc900054f7bc0 EFLAGS: 00000202
RAX: 0000000080000000 RBX: ffff8880199030d8 RCX: 0000000080000000
RDX: 0000000000000000 RSI: ffffffff87820f67 RDI: 0000000000000003
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffffffff90015a07
R10: ffffffff87820fb9 R11: 0000000000000001 R12: 0000000000000001
R13: 000000000002061b R14: ffffc900054f7c50 R15: 0000000000000000
 get_next_corpse net/netfilter/nf_conntrack_core.c:2281 [inline]
 nf_ct_iterate_cleanup+0x77/0x410 net/netfilter/nf_conntrack_core.c:2330
 nf_ct_iterate_cleanup_net net/netfilter/nf_conntrack_core.c:2414 [inline]
 nf_ct_iterate_cleanup_net+0x234/0x400 net/netfilter/nf_conntrack_core.c:2398
 iterate_cleanup_work+0x65/0x180 net/netfilter/nf_nat_masquerade.c:84
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	e9 96 96 74 02       	jmpq   0x274969d
   7:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
   d:	48 8b be b0 01 00 00 	mov    0x1b0(%rsi),%rdi
  14:	e8 b4 ff ff ff       	callq  0xffffffcd
  19:	31 c0                	xor    %eax,%eax
  1b:	c3                   	retq
  1c:	90                   	nop
  1d:	65 8b 05 29 49 89 7e 	mov    %gs:0x7e894929(%rip),%eax        # 0x7e89494d
  24:	89 c1                	mov    %eax,%ecx
  26:	48 8b 34 24          	mov    (%rsp),%rsi
* 2a:	81 e1 00 01 00 00    	and    $0x100,%ecx <-- trapping instruction
  30:	65 48 8b 14 25 00 70 	mov    %gs:0x27000,%rdx
  37:	02 00
  39:	a9 00 01 ff 00       	test   $0xff0100,%eax
  3e:	74 0e                	je     0x4e