general protection fault, probably for non-canonical address 0xdffffc0040000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000200000000-0x0000000200000007]
CPU: 0 PID: 5169 Comm: kworker/u4:8 Not tainted 6.3.0-next-20230505-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006
RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 slab_free_hook mm/slub.c:1756 [inline]
 slab_free_freelist_hook+0xeb/0x1c0 mm/slub.c:1807
 slab_free mm/slub.c:3786 [inline]
 kmem_cache_free+0xe9/0x480 mm/slub.c:3808
 rcu_do_batch kernel/rcu/tree.c:2115 [inline]
 rcu_core+0x806/0x1a70 kernel/rcu/tree.c:2377
 __do_softirq+0x1d4/0x905 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x114/0x190 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__local_bh_enable_ip+0xac/0x130 kernel/softirq.c:403
Code: 1d d1 f2 b5 7e 65 8b 05 ca f2 b5 7e a9 00 ff ff 00 74 45 bf 01 00 00 00 e8 11 6f 0a 00 e8 5c 21 3d 00 fb 65 8b 05 ac f2 b5 7e <85> c0 74 58 5b 5d c3 65 8b 05 72 bd b4 7e 85 c0 75 a2 0f 0b eb 9e
RSP: 0018:ffffc90005597c08 EFLAGS: 00000202
RAX: 0000000080000000 RBX: 00000000fffffe00 RCX: 1ffffffff22b0d66
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff89d9ff2c R08: 0000000000000001 R09: ffffffff91534ddf
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888042ee97a8
R13: ffff888042ee8c80 R14: dffffc0000000000 R15: ffffffff89da0280
 spin_unlock_bh include/linux/spinlock.h:395 [inline]
 batadv_nc_purge_paths+0x1cc/0x3c0 net/batman-adv/network-coding.c:471
 batadv_nc_worker+0x8fa/0xfe0 net/batman-adv/network-coding.c:720
 process_one_work+0x99a/0x15e0 kernel/workqueue.c:2405
 worker_thread+0x67d/0x10c0 kernel/workqueue.c:2552
 kthread+0x344/0x440 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1012 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1d7/0x420 lib/debugobjects.c:1054
Code: 39 00 0f 85 0f 02 00 00 48 89 45 08 4d 89 30 4c 89 c7 4d 89 68 08 e8 d8 cb ff ff 48 85 ed 74 2c 49 89 e8 4c 89 c0 48 c1 e8 03 <42> 80 3c 38 00 0f 84 2e ff ff ff 4c 89 c7 4c 89 44 24 38 e8 21 dd
RSP: 0018:ffffc90000007d30 EFLAGS: 00010006

RAX: 0000000040000000 RBX: ffff888021cea280 RCX: ffff888046a5a348
RDX: 1ffff11008d4b46a RSI: 1ffff110173071f1 RDI: ffff88805e9a9280
RBP: 0000000200000001 R08: 0000000200000001 R09: 0000000100040048
R10: fffff52000000f94 R11: 0000000000094001 R12: 000000000000000c
R13: dead000000000122 R14: dead000000000100 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100040048 CR3: 000000000c571000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	39 00                	cmp    %eax,(%rax)
   2:	0f 85 0f 02 00 00    	jne    0x217
   8:	48 89 45 08          	mov    %rax,0x8(%rbp)
   c:	4d 89 30             	mov    %r14,(%r8)
   f:	4c 89 c7             	mov    %r8,%rdi
  12:	4d 89 68 08          	mov    %r13,0x8(%r8)
  16:	e8 d8 cb ff ff       	callq  0xffffcbf3
  1b:	48 85 ed             	test   %rbp,%rbp
  1e:	74 2c                	je     0x4c
  20:	49 89 e8             	mov    %rbp,%r8
  23:	4c 89 c0             	mov    %r8,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	0f 84 2e ff ff ff    	je     0xffffff63
  35:	4c 89 c7             	mov    %r8,%rdi
  38:	4c 89 44 24 38       	mov    %r8,0x38(%rsp)
  3d:	e8                   	.byte 0xe8
  3e:	21 dd                	and    %ebx,%ebp