Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 2124 Comm: kworker/u8:7 Not tainted 6.13.0-rc4-syzkaller-00012-g9b2ffa6148b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: netns cleanup_net
RIP: 0010:rtnl_prop_list_size+0xce/0x2d0 net/core/rtnetlink.c:1211
Code: eb 10 49 39 dc 0f 84 a7 01 00 00 49 bd 00 00 00 00 00 fc ff df 31 ed e8 50 95 94 f8 48 8d 7b 10 83 c5 01 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 cc 01 00 00 48 8b 5b 10 48 83 eb 10 49 39 dc
RSP: 0018:ffffc90004e27880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: fffffffffffffff0 RCX: ffffffff8904baa7
RDX: ffff8880297e9e00 RSI: ffffffff8904ba00 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000004 R12: ffff88802665fb00
R13: dffffc0000000000 R14: 00000000000000c4 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0df256b7e0 CR3: 00000000693ea000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 if_nlmsg_size+0x401/0xa70 net/core/rtnetlink.c:1303
 rtmsg_ifinfo_build_skb+0x6d/0x280 net/core/rtnetlink.c:4347
 rtmsg_ifinfo_event net/core/rtnetlink.c:4389 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4379 [inline]
 rtmsg_ifinfo+0x9f/0x1a0 net/core/rtnetlink.c:4398
 dev_close_many+0x318/0x6a0 net/core/dev.c:1588
 unregister_netdevice_many_notify+0x489/0x1e60 net/core/dev.c:11500
 cleanup_net+0x58c/0xbd0 net/core/net_namespace.c:643
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rtnl_prop_list_size+0xce/0x2d0 net/core/rtnetlink.c:1211
Code: eb 10 49 39 dc 0f 84 a7 01 00 00 49 bd 00 00 00 00 00 fc ff df 31 ed e8 50 95 94 f8 48 8d 7b 10 83 c5 01 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 cc 01 00 00 48 8b 5b 10 48 83 eb 10 49 39 dc
RSP: 0018:ffffc90004e27880 EFLAGS: 00010246
RAX: 0000000000000000 RBX: fffffffffffffff0 RCX: ffffffff8904baa7
RDX: ffff8880297e9e00 RSI: ffffffff8904ba00 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000004 R12: ffff88802665fb00
R13: dffffc0000000000 R14: 00000000000000c4 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b304fcff8 CR3: 00000000693ea000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	eb 10                	jmp    0x12
   2:	49 39 dc             	cmp    %rbx,%r12
   5:	0f 84 a7 01 00 00    	je     0x1b2
   b:	49 bd 00 00 00 00 00 	movabs $0xdffffc0000000000,%r13
  12:	fc ff df
  15:	31 ed                	xor    %ebp,%ebp
  17:	e8 50 95 94 f8       	call   0xf894956c
  1c:	48 8d 7b 10          	lea    0x10(%rbx),%rdi
  20:	83 c5 01             	add    $0x1,%ebp
  23:	48 89 f8             	mov    %rdi,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2f:	0f 85 cc 01 00 00    	jne    0x201
  35:	48 8b 5b 10          	mov    0x10(%rbx),%rbx
  39:	48 83 eb 10          	sub    $0x10,%rbx
  3d:	49 39 dc             	cmp    %rbx,%r12