Oops: general protection fault, probably for non-canonical address 0xdffffc0000000540: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000000002a00-0x0000000000002a07]
CPU: 1 PID: 13 Comm: kworker/u32:1 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:__skb_unlink include/linux/skbuff.h:2389 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2405 [inline]
RIP: 0010:__skb_queue_purge_reason include/linux/skbuff.h:3259 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:3265 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:118 [inline]
RIP: 0010:gro_cells_destroy+0x1aa/0x4d0 net/core/gro_cells.c:106
Code: ea 03 80 3c 2a 00 0f 85 6f 02 00 00 48 8d 79 08 49 8b 57 08 49 c7 07 00 00 00 00 48 89 fe 49 c7 47 08 00 00 00 00 48 c1 ee 03 <80> 3c 2e 00 0f 85 29 02 00 00 48 89 d6 48 89 51 08 48 c1 ee 03 80
RSP: 0018:ffffc900003f7a90 EFLAGS: 00010203
RAX: 0000000000000000 RBX: ffffe8ffad14ea88 RCX: 00000000000029ff
RDX: 0000000000004000 RSI: 0000000000000540 RDI: 0000000000002a07
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000008
R10: 0000000000000008 R11: 0000000000000004 R12: fffff91ff5a29d53
R13: 0000000000000001 R14: ffffe8ffad14ea98 R15: ffffe8ffad14eaef
FS:  0000000000000000(0000) GS:ffff88802c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000fffbc100 CR3: 000000005d300000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unregister_netdevice_many_notify+0xbd7/0x19f0 net/core/dev.c:11239
 cleanup_net+0x58c/0xbf0 net/core/net_namespace.c:635
 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__skb_unlink include/linux/skbuff.h:2389 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2405 [inline]
RIP: 0010:__skb_queue_purge_reason include/linux/skbuff.h:3259 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:3265 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:118 [inline]
RIP: 0010:gro_cells_destroy+0x1aa/0x4d0 net/core/gro_cells.c:106
Code: ea 03 80 3c 2a 00 0f 85 6f 02 00 00 48 8d 79 08 49 8b 57 08 49 c7 07 00 00 00 00 48 89 fe 49 c7 47 08 00 00 00 00 48 c1 ee 03 <80> 3c 2e 00 0f 85 29 02 00 00 48 89 d6 48 89 51 08 48 c1 ee 03 80
RSP: 0018:ffffc900003f7a90 EFLAGS: 00010203
RAX: 0000000000000000 RBX: ffffe8ffad14ea88 RCX: 00000000000029ff
RDX: 0000000000004000 RSI: 0000000000000540 RDI: 0000000000002a07
RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000008
R10: 0000000000000008 R11: 0000000000000004 R12: fffff91ff5a29d53
R13: 0000000000000001 R14: ffffe8ffad14ea98 R15: ffffe8ffad14eaef
FS:  0000000000000000(0000) GS:ffff88802c200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020858000 CR3: 000000005cbf0000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	03 80 3c 2a 00 0f    	add    0xf002a3c(%rax),%eax
   6:	85 6f 02             	test   %ebp,0x2(%rdi)
   9:	00 00                	add    %al,(%rax)
   b:	48 8d 79 08          	lea    0x8(%rcx),%rdi
   f:	49 8b 57 08          	mov    0x8(%r15),%rdx
  13:	49 c7 07 00 00 00 00 	movq   $0x0,(%r15)
  1a:	48 89 fe             	mov    %rdi,%rsi
  1d:	49 c7 47 08 00 00 00 	movq   $0x0,0x8(%r15)
  24:	00
  25:	48 c1 ee 03          	shr    $0x3,%rsi
* 29:	80 3c 2e 00          	cmpb   $0x0,(%rsi,%rbp,1) <-- trapping instruction
  2d:	0f 85 29 02 00 00    	jne    0x25c
  33:	48 89 d6             	mov    %rdx,%rsi
  36:	48 89 51 08          	mov    %rdx,0x8(%rcx)
  3a:	48 c1 ee 03          	shr    $0x3,%rsi
  3e:	80                   	.byte 0x80