Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 150 Comm: kworker/u8:5 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound bpf_map_free_deferred
RIP: 0010:free_all kernel/bpf/memalloc.c:268 [inline]
RIP: 0010:drain_mem_cache+0x77/0x4b0 kernel/bpf/memalloc.c:638
Code: 00 00 00 e8 0b d2 3f 00 49 87 9e a8 00 00 00 48 85 db 75 0f e8 ca a7 d5 ff eb 67 e8 c3 a7 d5 ff 4c 89 fb 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 3a cf 3f 00 4c 8b 3b 45 85 e4 74
RSP: 0018:ffffc90002f2f9c8 EFLAGS: 00010257
RAX: 0000000000000000 RBX: 0000000000000006 RCX: ffffffff81edad55
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffe8ffffc88278
RBP: ffffe8ffffc881d0 R08: ffffe8ffffc8827f R09: 1ffffd1ffff9104f
R10: dffffc0000000000 R11: fffff91ffff91050 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffe8ffffc881d0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124f96000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa6e92c7000 CR3: 0000000030760000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 bpf_mem_alloc_destroy+0x14a/0x4e0 kernel/bpf/memalloc.c:754
 htab_map_free+0x871/0x960 kernel/bpf/hashtab.c:1551
 bpf_map_free kernel/bpf/syscall.c:861 [inline]
 bpf_map_free_deferred+0xeb/0x110 kernel/bpf/syscall.c:887
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xac5/0x18e0 kernel/workqueue.c:3319
 worker_thread+0x870/0xd50 kernel/workqueue.c:3400
 kthread+0x7b9/0x940 kernel/kthread.c:464
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:free_all kernel/bpf/memalloc.c:268 [inline]
RIP: 0010:drain_mem_cache+0x77/0x4b0 kernel/bpf/memalloc.c:638
Code: 00 00 00 e8 0b d2 3f 00 49 87 9e a8 00 00 00 48 85 db 75 0f e8 ca a7 d5 ff eb 67 e8 c3 a7 d5 ff 4c 89 fb 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 3a cf 3f 00 4c 8b 3b 45 85 e4 74
RSP: 0018:ffffc90002f2f9c8 EFLAGS: 00010257
RAX: 0000000000000000 RBX: 0000000000000006 RCX: ffffffff81edad55
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffe8ffffc88278
RBP: ffffe8ffffc881d0 R08: ffffe8ffffc8827f R09: 1ffffd1ffff9104f
R10: dffffc0000000000 R11: fffff91ffff91050 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffe8ffffc881d0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124f96000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3a0a63 CR3: 000000000eb38000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	e8 0b d2 3f 00       	call   0x3fd212
   7:	49 87 9e a8 00 00 00 	xchg   %rbx,0xa8(%r14)
   e:	48 85 db             	test   %rbx,%rbx
  11:	75 0f                	jne    0x22
  13:	e8 ca a7 d5 ff       	call   0xffd5a7e2
  18:	eb 67                	jmp    0x81
  1a:	e8 c3 a7 d5 ff       	call   0xffd5a7e2
  1f:	4c 89 fb             	mov    %r15,%rbx
  22:	48 89 d8             	mov    %rbx,%rax
  25:	48 c1 e8 03          	shr    $0x3,%rax
* 29:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	48 89 df             	mov    %rbx,%rdi
  33:	e8 3a cf 3f 00       	call   0x3fcf72
  38:	4c 8b 3b             	mov    (%rbx),%r15
  3b:	45 85 e4             	test   %r12d,%r12d
  3e:	74                   	.byte 0x74