Unable to handle kernel paging request at virtual address ffff70000b97c800
KASAN: maybe wild-memory-access in range [0xffff80005cbe4000-0xffff80005cbe4007]
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000045dfb000
[ffff70000b97c800] pgd=00000000bfbeb003, p4d=00000000bfbeb003, pud=00000000bfbea003, pmd=0000000000000000
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 22076 Comm: kworker/1:2 Not tainted 6.1.0-rc1-syzkaller-00454-ga70385240892 #0
Hardware name: linux,dummy-virt (DT)
Workqueue: events free_ipc
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : percpu_counter_add_batch+0x78/0x2f0 lib/percpu_counter.c:87
lr : percpu_counter_add_batch+0x44/0x2f0 lib/percpu_counter.c:87
sp : ffff8000111679c0
x29: ffff8000111679c0 x28: ffff000031c8fc00 x27: 1fffe00006391fa4
x26: ffff80005cbe4000 x25: ffff00000e9a27b0 x24: 1fffe00001d344f6
x23: 000000007fffffff x22: ffff80000cc4e900 x21: 0000000000000000
x20: 0000000000000000 x19: ffff00000e9a2758 x18: ffff00006a9eabc0
x17: ffff80005cbe4000 x16: ffff800010ab8000 x15: ffff8000089007fc
x14: 1ffff0000222cf24 x13: 0000000000000000 x12: ffff600006391f81
x11: 1fffe00006391f80 x10: ffff600006391f80 x9 : dfff800000000000
x8 : ffff000031c8fc00 x7 : 00000000f1f1f1f1 x6 : dfff800000000000
x5 : ffff70000222cf32 x4 : 1ffff000020ef1ac x3 : 1ffff0000b97c800
x2 : dfff800000000000 x1 : 0000000000000003 x0 : ffff80005cbe4000
Call trace:
 percpu_counter_add_batch+0x78/0x2f0 lib/percpu_counter.c:87
 percpu_counter_add_local include/linux/percpu_counter.h:75 [inline]
 percpu_counter_sub_local include/linux/percpu_counter.h:225 [inline]
 freeque+0x20c/0x364 ipc/msg.c:292
 free_ipcs+0xa0/0x160 ipc/namespace.c:125
 msg_exit_ns+0x38/0x60 ipc/msg.c:1334
 free_ipc_ns ipc/namespace.c:138 [inline]
 free_ipc+0xd0/0x1c0 ipc/namespace.c:157
 process_one_work+0x780/0x184c kernel/workqueue.c:2289
 worker_thread+0x3cc/0xc40 kernel/workqueue.c:2436
 kthread+0x23c/0x2a0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: f2fbffe2 92400801 d343fc03 11000c21 (38e26862) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f2fbffe2 	movk	x2, #0xdfff, lsl #48
   4:	92400801 	and	x1, x0, #0x7
   8:	d343fc03 	lsr	x3, x0, #3
   c:	11000c21 	add	w1, w1, #0x3
* 10:	38e26862 	ldrsb	w2, [x3, x2] <-- trapping instruction