------------[ cut here ]------------
WARNING: CPU: 0 PID: 3139 at mm/kfence/core.c:1147 __kfence_free+0x7c/0xb4 mm/kfence/core.c:1147
Modules linked in:
CPU: 0 PID: 3139 Comm: syz-executor.0 Not tainted 6.7.0-rc7-syzkaller #0
Hardware name: linux,dummy-virt (DT)
pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __kfence_free+0x7c/0xb4 mm/kfence/core.c:1147
lr : kfence_free include/linux/kfence.h:187 [inline]
lr : __slab_free+0x48c/0x508 mm/slub.c:3614
sp : ffff800082bfb9f0
x29: ffff800082bfb9f0 x28: fbff000002c03e00 x27: 0000000000000000
x26: 0000000000000000 x25: ffff00007ffbbfe8 x24: ffff00007ffbbc00
x23: 0000000000000001 x22: ffff00007ffbbc00 x21: ffff00007ffbbc00
x20: ffff800080242dbc x19: fffffc0001ffeec0 x18: 0000000000000001
x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffa3b54c00
x14: 0000000000000002 x13: 0000000000000000 x12: 0000000000005800
x11: f3ff00002a13ea24 x10: f3ff00002a13ea00 x9 : 0000000000000000
x8 : ffff800082bfbad0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800080242dbc x4 : ffff00007f868000 x3 : ffff8000824b02b8
x2 : f3ff00000500d500 x1 : ffff00007f8a7700 x0 : ffff00007ffbbc00
Call trace:
 __kfence_free+0x7c/0xb4 mm/kfence/core.c:1147
 kfence_free include/linux/kfence.h:187 [inline]
 __slab_free+0x48c/0x508 mm/slub.c:3614
 do_slab_free mm/slub.c:3757 [inline]
 slab_free mm/slub.c:3810 [inline]
 __kmem_cache_free+0x220/0x230 mm/slub.c:3822
 kfree+0x5c/0x74 mm/slab_common.c:1056
 kvfree+0x3c/0x4c mm/util.c:663
 xt_free_table_info+0x78/0x90 net/netfilter/x_tables.c:1212
 __do_replace+0x23c/0x308 net/ipv4/netfilter/ip_tables.c:1084
 do_replace net/ipv4/netfilter/ip_tables.c:1137 [inline]
 do_ipt_set_ctl+0x2fc/0x374 net/ipv4/netfilter/ip_tables.c:1627
 nf_setsockopt+0x68/0x94 net/netfilter/nf_sockopt.c:101
 ip_setsockopt+0x74/0x9c net/ipv4/ip_sockglue.c:1426
 tcp_setsockopt+0x20/0x3c net/ipv4/tcp.c:3724
 sock_common_setsockopt+0x1c/0x28 net/core/sock.c:3711
 do_sock_setsockopt+0xa0/0x188 net/socket.c:2311
 __sys_setsockopt+0x74/0xcc net/socket.c:2334
 __do_sys_setsockopt net/socket.c:2343 [inline]
 __se_sys_setsockopt net/socket.c:2340 [inline]
 __arm64_sys_setsockopt+0x28/0x38 net/socket.c:2340
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:51
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:155
 el0_svc+0x34/0xd8 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:595
---[ end trace 0000000000000000 ]---
EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.