Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:4 Not tainted 6.15.0-rc4-syzkaller-00189-g2bfcee565c3a #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Workqueue: events_unbound bpf_map_free_deferred
RIP: 0010:free_all kernel/bpf/memalloc.c:268 [inline]
RIP: 0010:drain_mem_cache+0x68/0x480 kernel/bpf/memalloc.c:638
Code: de e8 4c 0b d8 ff 49 8d be a8 00 00 00 be 08 00 00 00 e8 6b fe 39 00 4d 87 be a8 00 00 00 4d 85 ff 74 6a 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 a9 fb 39 00 49 8b 2f 85 db 74 2a
RSP: 0018:ffffc90001557a28 EFLAGS: 00010256
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81e7b955
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffe8ffffd74358
RBP: 0000000000000000 R08: ffffe8ffffd7435f R09: 1ffffd1ffffae86b
R10: dffffc0000000000 R11: fffff91ffffae86c R12: ffffe8ffffd742b0
R13: dffffc0000000000 R14: ffffe8ffffd742b0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcd06e73f98 CR3: 0000000054095000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 bpf_mem_alloc_destroy+0x13d/0x4d0 kernel/bpf/memalloc.c:754
 trie_free+0x132/0x150 kernel/bpf/lpm_trie.c:652
 bpf_map_free kernel/bpf/syscall.c:861 [inline]
 bpf_map_free_deferred+0xed/0x110 kernel/bpf/syscall.c:887
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:free_all kernel/bpf/memalloc.c:268 [inline]
RIP: 0010:drain_mem_cache+0x68/0x480 kernel/bpf/memalloc.c:638
Code: de e8 4c 0b d8 ff 49 8d be a8 00 00 00 be 08 00 00 00 e8 6b fe 39 00 4d 87 be a8 00 00 00 4d 85 ff 74 6a 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 a9 fb 39 00 49 8b 2f 85 db 74 2a
RSP: 0018:ffffc90001557a28 EFLAGS: 00010256
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81e7b955
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffe8ffffd74358
RBP: 0000000000000000 R08: ffffe8ffffd7435f R09: 1ffffd1ffffae86b
R10: dffffc0000000000 R11: fffff91ffffae86c R12: ffffe8ffffd742b0
R13: dffffc0000000000 R14: ffffe8ffffd742b0 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc65cad38af CR3: 0000000032102000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	de e8                	fsubrp %st,%st(0)
   2:	4c 0b d8             	or     %rax,%r11
   5:	ff 49 8d             	decl   -0x73(%rcx)
   8:	be a8 00 00 00       	mov    $0xa8,%esi
   d:	be 08 00 00 00       	mov    $0x8,%esi
  12:	e8 6b fe 39 00       	call   0x39fe82
  17:	4d 87 be a8 00 00 00 	xchg   %r15,0xa8(%r14)
  1e:	4d 85 ff             	test   %r15,%r15
  21:	74 6a                	je     0x8d
  23:	4c 89 f8             	mov    %r15,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 ff             	mov    %r15,%rdi
  34:	e8 a9 fb 39 00       	call   0x39fbe2
  39:	49 8b 2f             	mov    (%r15),%rbp
  3c:	85 db                	test   %ebx,%ebx
  3e:	74 2a                	je     0x6a