Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 UID: 0 PID: 3 Comm: pool_workqueue_ Not tainted 6.11.0-rc5-syzkaller-00768-g221f9cce949a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:hsr_proxy_announce+0x2a2/0x4c0 net/hsr/hsr_device.c:437
Code: 8b 64 24 30 4c 8b 6c 24 28 eb 05 e8 58 22 f9 f5 48 8b 5c 24 20 48 83 c3 10 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 4c 8b 74 24 18 74 08 48 89 df e8 1b 6d 60 f6 48 8b 1b
RSP: 0018:ffffc90000007ae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000003 RDI: ffff88807a754cc0
RBP: ffffc90000007bb0 R08: ffffffff8b9a6832 R09: 1ffffffff283cb08
R10: dffffc0000000000 R11: fffffbfff283cb09 R12: 1ffff92000000f64
R13: ffffffff8b9a6801 R14: ffff88807a754cf0 R15: ffff88807a754cf0
FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556ca7555000 CR3: 000000007b562000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers kernel/time/timer.c:2417 [inline]
 __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
 run_timer_base kernel/time/timer.c:2437 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_irq+0xf6/0x1c0 kernel/sched/core.c:6851
Code: 89 f5 49 c1 ed 03 eb 0d 48 f7 03 08 00 00 00 0f 84 8b 00 00 00 bf 01 00 00 00 e8 e5 3e a0 f5 e8 70 30 d8 f5 fb bf 01 00 00 00 <e8> 55 ad ff ff 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 c5 17 38 f6 48
RSP: 0018:ffffc90000087b40 EFLAGS: 00000286
RAX: 07ada41af39ac800 RBX: 1ffff92000010f70 RCX: ffffffff9a33c903
RDX: dffffc0000000000 RSI: ffffffff8c0ad560 RDI: 0000000000000001
RBP: ffffc90000087bf0 R08: ffffffff90187a2f R09: 1ffffffff2030f45
R10: dffffc0000000000 R11: fffffbfff2030f46 R12: 1ffff92000010f68
R13: 1ffff92000010f6c R14: ffffc90000087b60 R15: dffffc0000000000
 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:synchronize_rcu+0x0/0x360 kernel/rcu/tree.c:4010
Code: e1 07 80 c1 03 38 c1 0f 8c 97 fe ff ff 4c 89 f7 e8 65 e4 80 00 e9 8a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0018:ffffc90000087cb8 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000010fa0 RCX: ffffffff9a33c903
RDX: 0000000000000001 RSI: ffffffff8c0ae240 RDI: ffffffff8c608d40
RBP: ffffc90000087da0 R08: ffffffff9a2ec87f R09: 1ffffffff345d90f
R10: dffffc0000000000 R11: fffffbfff345d910 R12: ffffffff9a2ebef8
R13: 1ffff92000010f9c R14: 0000000000000a07 R15: ffffc90000087d00
 lockdep_unregister_key+0x4b7/0x540 kernel/locking/lockdep.c:6487
 wq_unregister_lockdep kernel/workqueue.c:4780 [inline]
 pwq_release_workfn+0x6e9/0x860 kernel/workqueue.c:5073
 kthread_worker_fn+0x500/0xaf0 kernel/kthread.c:842
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hsr_proxy_announce+0x2a2/0x4c0 net/hsr/hsr_device.c:437
Code: 8b 64 24 30 4c 8b 6c 24 28 eb 05 e8 58 22 f9 f5 48 8b 5c 24 20 48 83 c3 10 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 4c 8b 74 24 18 74 08 48 89 df e8 1b 6d 60 f6 48 8b 1b
RSP: 0018:ffffc90000007ae0 EFLAGS: 00010202
RAX: 0000000000000002 RBX: 0000000000000010 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000003 RDI: ffff88807a754cc0
RBP: ffffc90000007bb0 R08: ffffffff8b9a6832 R09: 1ffffffff283cb08
R10: dffffc0000000000 R11: fffffbfff283cb09 R12: 1ffff92000000f64
R13: ffffffff8b9a6801 R14: ffff88807a754cf0 R15: ffff88807a754cf0
FS:  0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556ca7555000 CR3: 000000007b562000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	8b 64 24 30          	mov    0x30(%rsp),%esp
   4:	4c 8b 6c 24 28       	mov    0x28(%rsp),%r13
   9:	eb 05                	jmp    0x10
   b:	e8 58 22 f9 f5       	call   0xf5f92268
  10:	48 8b 5c 24 20       	mov    0x20(%rsp),%rbx
  15:	48 83 c3 10          	add    $0x10,%rbx
  19:	48 89 d8             	mov    %rbx,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  27:	fc ff df
* 2a:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1) <-- trapping instruction
  2e:	4c 8b 74 24 18       	mov    0x18(%rsp),%r14
  33:	74 08                	je     0x3d
  35:	48 89 df             	mov    %rbx,%rdi
  38:	e8 1b 6d 60 f6       	call   0xf6606d58
  3d:	48 8b 1b             	mov    (%rbx),%rbx