Unable to handle kernel paging request at virtual address dfff800000000035
KASAN: null-ptr-deref in range [0x00000000000001a8-0x00000000000001af]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000035] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 4997 Comm: syz.2.436 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : htb_deactivate net/sched/sch_htb.c:613 [inline]
pc : htb_qlen_notify+0x30/0xb8 net/sched/sch_htb.c:1489
lr : qdisc_tree_reduce_backlog+0x19c/0x398 net/sched/sch_api.c:811
sp : ffff80008dcf6fa0
x29: ffff80008dcf6fa0 x28: 1ffff00010c8e7a8 x27: ffff800086473d20
x26: 00000000000affe0 x25: ffff800086473d40 x24: 0000000000000000
x23: 0000000000000000 x22: 00000000000001a8 x21: 0000000000000035
x20: ffff0000140b6000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
x14: 00000000000246ce x13: 0000000000000000 x12: 0000000000000006
x11: 0000000000000002 x10: ffff00000fb4c710 x9 : ffff800089773000
x8 : 0000000000000000 x7 : 00a241a92305cd1c x6 : ffff00000fb4c760
x5 : 0000000000000000 x4 : 000000006ea48840 x3 : 0000000000000000
x2 : dfff800000000000 x1 : 0000000000000003 x0 : ffff0000140b6000
Call trace:
 htb_deactivate net/sched/sch_htb.c:613 [inline] (P)
 htb_qlen_notify+0x30/0xb8 net/sched/sch_htb.c:1489 (P)
 qdisc_tree_reduce_backlog+0x19c/0x398 net/sched/sch_api.c:811
 codel_change+0x558/0x998 net/sched/sch_codel.c:153
 codel_init+0x26c/0x378 net/sched/sch_codel.c:172
 qdisc_create+0x2e4/0xc04 net/sched/sch_api.c:1324
 __tc_modify_qdisc net/sched/sch_api.c:1749 [inline]
 tc_modify_qdisc+0xb80/0x17bc net/sched/sch_api.c:1813
 rtnetlink_rcv_msg+0x2e8/0x8d4 net/core/rtnetlink.c:6953
 netlink_rcv_skb+0x198/0x334 net/netlink/af_netlink.c:2534
 rtnetlink_rcv+0x18/0x24 net/core/rtnetlink.c:6971
 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
 netlink_unicast+0x3c0/0x670 net/netlink/af_netlink.c:1339
 netlink_sendmsg+0x644/0xa54 net/netlink/af_netlink.c:1883
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0xc8/0x168 net/socket.c:727
 ____sys_sendmsg+0x504/0x768 net/socket.c:2566
 ___sys_sendmsg+0x11c/0x19c net/socket.c:2620
 __sys_sendmsg+0x114/0x19c net/socket.c:2652
 __do_sys_sendmsg net/socket.c:2657 [inline]
 __se_sys_sendmsg net/socket.c:2655 [inline]
 __arm64_sys_sendmsg+0x70/0xa0 net/socket.c:2655
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x6c/0x258 arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x50/0x198 arch/arm64/kernel/entry-common.c:767
 el0t_64_sync_handler+0x10c/0x138 arch/arm64/kernel/entry-common.c:786
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Code: a90153f3 aa0003f4 aa0103f3 52800061 (38e26aa0) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	a90153f3 	stp	x19, x20, [sp, #16]
   4:	aa0003f4 	mov	x20, x0
   8:	aa0103f3 	mov	x19, x1
   c:	52800061 	mov	w1, #0x3                   	// #3
* 10:	38e26aa0 	ldrsb	w0, [x21, x2] <-- trapping instruction