Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 6341 Comm: syz.4.237 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:flow_block_cb_is_busy net/core/flow_offload.c:328 [inline]
RIP: 0010:flow_block_cb_setup_simple+0x1be/0x740 net/core/flow_offload.c:353
Code: f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 d9 b2 ae f8 4d 8b 2e 4d 39 f5 0f 84 b6 00 00 00 49 8d 6d 20 48 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 48 89 ef e8 b4 b2 ae f8 4c 39 65 00 74 07 e8 99
RSP: 0018:ffffc90002e86790 EFLAGS: 00010202

RAX: 0000000000000004 RBX: dffffc0000000000 RCX: ffff88802ebc8000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888031a21140
RBP: 0000000000000020 R08: ffff88802ebc8000 R09: 0000000000000002
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff871779c0
R13: 0000000000000000 R14: ffffffff8edad860 R15: ffff888030f0cd80
FS:  00005555823aa500(0000) GS:ffff888125c11000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000380 CR3: 000000002900a000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 nft_block_offload_cmd net/netfilter/nf_tables_offload.c:397 [inline]
 nft_chain_offload_cmd+0x290/0x660 net/netfilter/nf_tables_offload.c:451
 nft_flow_block_chain net/netfilter/nf_tables_offload.c:471 [inline]
 nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]
 nft_flow_rule_offload_commit+0x814/0x1b60 net/netfilter/nf_tables_offload.c:584
 nf_tables_commit+0x675/0x8700 net/netfilter/nf_tables_api.c:10933
 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:574 [inline]
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
 nfnetlink_rcv+0x1a4e/0x2520 net/netfilter/nfnetlink.c:665
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x82c/0x9e0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x219/0x270 net/socket.c:729
 ____sys_sendmsg+0x505/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
----------------
Code disassembly (best guess):
   0:	f0 48 c1 e8 03       	lock shr $0x3,%rax
   5:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1)
   9:	74 08                	je     0x13
   b:	4c 89 f7             	mov    %r14,%rdi
   e:	e8 d9 b2 ae f8       	call   0xf8aeb2ec
  13:	4d 8b 2e             	mov    (%r14),%r13
  16:	4d 39 f5             	cmp    %r14,%r13
  19:	0f 84 b6 00 00 00    	je     0xd5
  1f:	49 8d 6d 20          	lea    0x20(%r13),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	48 89 ef             	mov    %rbp,%rdi
  33:	e8 b4 b2 ae f8       	call   0xf8aeb2ec
  38:	4c 39 65 00          	cmp    %r12,0x0(%rbp)
  3c:	74 07                	je     0x45
  3e:	e8                   	.byte 0xe8
  3f:	99                   	cltd