BUG: unable to handle page fault for address: ffff88809780d000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1b001067 P4D 1b001067 PUD 0 
Oops: Oops: 0002 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 8484 Comm: syz.3.713 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bond_rr_gen_slave_id+0x1d5/0x250 drivers/net/bonding/bond_main.c:4927
Code: bc 24 f0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7a 49 8b 84 24 f0 00 00 00 bb 01 00 00 00 <65> 0f c1 18 e8 22 66 79 fb 83 c3 01 89 d8 5b 5d 41 5c 41 5d 41 5e
RSP: 0018:ffffc90007207830 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffc9000cad2000
RDX: 1ffff110055d19ce RSI: ffffffff8642f139 RDI: ffff88802ae8ce70
RBP: ffff88802ae8c000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802ae8cd80
R13: 000000000000dd86 R14: ffff88802ae8cd80 R15: ffff888077188000
FS:  0000000000000000(0000) GS:ffff88809780d000(0063) knlGS:00000000f54adb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff88809780d000 CR3: 0000000067904000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 bond_xdp_xmit_roundrobin_slave_get drivers/net/bonding/bond_main.c:5014 [inline]
 bond_xdp_get_xmit_slave+0x2a9/0x6b0 drivers/net/bonding/bond_main.c:5597
 xdp_master_redirect+0x161/0x330 net/core/filter.c:4377
 bpf_prog_run_xdp include/net/xdp.h:700 [inline]
 tun_build_skb.constprop.0+0xdd6/0x1510 drivers/net/tun.c:1653
 tun_get_user+0x149c/0x3cc0 drivers/net/tun.c:1770
 tun_chr_write_iter+0xdc/0x210 drivers/net/tun.c:1999
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x7d3/0x11d0 fs/read_write.c:686
 ksys_write+0x12a/0x250 fs/read_write.c:738
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x7c/0x300 arch/x86/entry/syscall_32.c:306
 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf70bd579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f54ad520 EFLAGS: 00000293 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 00000000800005c0
RDX: 000000000000004a RSI: 00000000f7456ff4 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
CR2: ffff88809780d000
---[ end trace 0000000000000000 ]---
RIP: 0010:bond_rr_gen_slave_id+0x1d5/0x250 drivers/net/bonding/bond_main.c:4927
Code: bc 24 f0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7a 49 8b 84 24 f0 00 00 00 bb 01 00 00 00 <65> 0f c1 18 e8 22 66 79 fb 83 c3 01 89 d8 5b 5d 41 5c 41 5d 41 5e
RSP: 0018:ffffc90007207830 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffc9000cad2000
RDX: 1ffff110055d19ce RSI: ffffffff8642f139 RDI: ffff88802ae8ce70
RBP: ffff88802ae8c000 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802ae8cd80
R13: 000000000000dd86 R14: ffff88802ae8cd80 R15: ffff888077188000
FS:  0000000000000000(0000) GS:ffff88809780d000(0063) knlGS:00000000f54adb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff88809780d000 CR3: 0000000067904000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   9:	fc ff df
   c:	48 89 fa             	mov    %rdi,%rdx
   f:	48 c1 ea 03          	shr    $0x3,%rdx
  13:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  17:	75 7a                	jne    0x93
  19:	49 8b 84 24 f0 00 00 	mov    0xf0(%r12),%rax
  20:	00
  21:	bb 01 00 00 00       	mov    $0x1,%ebx
* 26:	65 0f c1 18          	xadd   %ebx,%gs:(%rax) <-- trapping instruction
  2a:	e8 22 66 79 fb       	call   0xfb796651
  2f:	83 c3 01             	add    $0x1,%ebx
  32:	89 d8                	mov    %ebx,%eax
  34:	5b                   	pop    %rbx
  35:	5d                   	pop    %rbp
  36:	41 5c                	pop    %r12
  38:	41 5d                	pop    %r13
  3a:	41 5e                	pop    %r14