Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 976 Comm: kworker/u8:5 Not tainted 6.11.0-rc6-syzkaller-00180-g4c8002277167 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: netns cleanup_net
RIP: 0010:send_hsr_supervision_frame+0x37/0xa90 net/hsr/hsr_device.c:290
Code: 53 48 83 ec 38 48 89 54 24 30 49 89 f7 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 54 a0 f9 f5 49 8d 6d 18 48 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 48 89 ef e8 7b e6 60 f6 48 8b 6d 00 4d 89 fc 49
RSP: 0018:ffffc90000a18a70 EFLAGS: 00010206
RAX: 0000000000000003 RBX: dffffc0000000000 RCX: ffff8880270a1e00
RDX: 0000000000000100 RSI: ffffc90000a18b40 RDI: 0000000000000000
RBP: 0000000000000018 R08: ffffffff8b995013 R09: 1ffffffff283c908
R10: dffffc0000000000 R11: ffffffff8b99ec30 R12: ffff888012db0e98
R13: 0000000000000000 R14: ffff888012db0cf0 R15: ffffc90000a18b40
FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2a09c1af98 CR3: 0000000033374000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hsr_proxy_announce+0x23a/0x4c0 net/hsr/hsr_device.c:420
 call_timer_fn+0x18e/0x650 kernel/time/timer.c:1792
 expire_timers kernel/time/timer.c:1843 [inline]
 __run_timers kernel/time/timer.c:2417 [inline]
 __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2428
 run_timer_base kernel/time/timer.c:2437 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2447
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:synchronize_rcu+0x0/0x360 kernel/rcu/tree.c:4010
Code: e1 07 80 c1 03 38 c1 0f 8c 97 fe ff ff 4c 89 f7 e8 b5 df 80 00 e9 8a fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0018:ffffc90003d47718 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff920007a8eec RCX: ffffffff9a33b903
RDX: 0000000000000001 RSI: ffffffff8c0ae240 RDI: ffffffff8c608d80
RBP: ffffc90003d477f8 R08: ffffffff9a2ec597 R09: 1ffffffff345d8b2
R10: dffffc0000000000 R11: fffffbfff345d8b3 R12: ffffffff9a2eaef8
R13: 1ffff920007a8ee8 R14: 0000000000000a02 R15: ffffc90003d47760
 lockdep_unregister_key+0x4b7/0x540 kernel/locking/lockdep.c:6487
 __qdisc_destroy+0x165/0x410 net/sched/sch_generic.c:1079
 netdev_for_each_tx_queue include/linux/netdevice.h:2513 [inline]
 dev_shutdown+0x9b/0x450 net/sched/sch_generic.c:1490
 unregister_netdevice_many_notify+0x97b/0x1c40 net/core/dev.c:11342
 cleanup_net+0x75d/0xcc0 net/core/net_namespace.c:635
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:send_hsr_supervision_frame+0x37/0xa90 net/hsr/hsr_device.c:290
Code: 53 48 83 ec 38 48 89 54 24 30 49 89 f7 49 89 fd 48 bb 00 00 00 00 00 fc ff df e8 54 a0 f9 f5 49 8d 6d 18 48 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 48 89 ef e8 7b e6 60 f6 48 8b 6d 00 4d 89 fc 49
RSP: 0018:ffffc90000a18a70 EFLAGS: 00010206
RAX: 0000000000000003 RBX: dffffc0000000000 RCX: ffff8880270a1e00
RDX: 0000000000000100 RSI: ffffc90000a18b40 RDI: 0000000000000000
RBP: 0000000000000018 R08: ffffffff8b995013 R09: 1ffffffff283c908
R10: dffffc0000000000 R11: ffffffff8b99ec30 R12: ffff888012db0e98
R13: 0000000000000000 R14: ffff888012db0cf0 R15: ffffc90000a18b40
FS:  0000000000000000(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2a09c1af98 CR3: 0000000033374000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	53                   	push   %rbx
   1:	48 83 ec 38          	sub    $0x38,%rsp
   5:	48 89 54 24 30       	mov    %rdx,0x30(%rsp)
   a:	49 89 f7             	mov    %rsi,%r15
   d:	49 89 fd             	mov    %rdi,%r13
  10:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  17:	fc ff df
  1a:	e8 54 a0 f9 f5       	call   0xf5f9a073
  1f:	49 8d 6d 18          	lea    0x18(%r13),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	48 89 ef             	mov    %rbp,%rdi
  33:	e8 7b e6 60 f6       	call   0xf660e6b3
  38:	48 8b 6d 00          	mov    0x0(%rbp),%rbp
  3c:	4d 89 fc             	mov    %r15,%r12
  3f:	49                   	rex.WB