general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.1.0-rc1-syzkaller-00093-g6d36c728bc2e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:inet_ehash_lockp include/net/inet_hashtables.h:205 [inline]
RIP: 0010:inet_unhash+0x125/0x700 net/ipv4/inet_hashtables.c:779
Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ab 04 00 00 48 8d 7d 08 44 8b 63 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e9 04 00 00 48 8d 7d 14 4c 8b 7d 08 48 b8 00 00
RSP: 0018:ffffc900007e8b08 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888000154d80 RCX: 0000000000000100
RDX: 0000000000000001 RSI: ffffffff87dc6fd7 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000000a
R10: 0000000000000004 R11: 000000000008c07e R12: 0000000070e9aea8
R13: ffff888000154df0 R14: ffff888000154da8 R15: ffff888000154d92
FS:  0000000000000000(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6aa53ad0b0 CR3: 000000004c428000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_set_state+0x198/0x7e0 net/ipv4/tcp.c:2744
 tcp_done+0xab/0x340 net/ipv4/tcp.c:4641
 tcp_out_of_resources+0x352/0x3e0 net/ipv4/tcp_timer.c:132
 tcp_probe_timer net/ipv4/tcp_timer.c:385 [inline]
 tcp_write_timer_handler net/ipv4/tcp_timer.c:624 [inline]
 tcp_write_timer_handler+0x80f/0x9f0 net/ipv4/tcp_timer.c:594
 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:637
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x1f7/0xad8 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731
Code: f8 e9 8c fd ff ff 4c 89 f7 e8 01 48 36 f8 e9 3a fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc 66 90 0f 00 2d d7 e4 55 00 fb f4 <c3> 0f 1f 40 00 41 54 be 08 00 00 00 53 65 48 8b 1c 25 80 6f 02 00
RSP: 0018:ffffc9000068fdf8 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffff888012506240 RCX: ffffffff898dde05
RDX: ffffed100596698a RSI: 0000000000000000 RDI: ffffffff8990fd1f
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff88802cb34c4b
R10: ffffed1005966989 R11: 0000000000000001 R12: 0000000000000003
R13: 0000000000000003 R14: ffffffff8de15bd0 R15: 0000000000000000
 default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
 cpuidle_idle_call kernel/sched/idle.c:191 [inline]
 do_idle+0x410/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 start_secondary+0x252/0x300 arch/x86/kernel/smpboot.c:262
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:inet_ehash_lockp include/net/inet_hashtables.h:205 [inline]
RIP: 0010:inet_unhash+0x125/0x700 net/ipv4/inet_hashtables.c:779
Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ab 04 00 00 48 8d 7d 08 44 8b 63 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 e9 04 00 00 48 8d 7d 14 4c 8b 7d 08 48 b8 00 00
RSP: 0018:ffffc900007e8b08 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888000154d80 RCX: 0000000000000100
RDX: 0000000000000001 RSI: ffffffff87dc6fd7 RDI: 0000000000000008
RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000000a
R10: 0000000000000004 R11: 000000000008c07e R12: 0000000070e9aea8
R13: ffff888000154df0 R14: ffff888000154da8 R15: ffff888000154d92
FS:  0000000000000000(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6aa53ad0b0 CR3: 000000004c428000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	03 0f                	add    (%rdi),%ecx
   2:	b6 04                	mov    $0x4,%dh
   4:	02 84 c0 74 08 3c 03 	add    0x33c0874(%rax,%rax,8),%al
   b:	0f 8e ab 04 00 00    	jle    0x4bc
  11:	48 8d 7d 08          	lea    0x8(%rbp),%rdi
  15:	44 8b 63 08          	mov    0x8(%rbx),%r12d
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 e9 04 00 00    	jne    0x51d
  34:	48 8d 7d 14          	lea    0x14(%rbp),%rdi
  38:	4c 8b 7d 08          	mov    0x8(%rbp),%r15
  3c:	48                   	rex.W
  3d:	b8                   	.byte 0xb8