Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 2 UID: 0 PID: 6149 Comm: syz.0.109 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:flow_block_cb_is_busy net/core/flow_offload.c:326 [inline]
RIP: 0010:flow_block_cb_setup_simple+0x4e6/0xa20 net/core/flow_offload.c:351
Code: 4c 89 fa 48 c1 ea 03 42 80 3c 2a 00 0f 85 78 03 00 00 4d 8b 3f 4c 39 fd 74 5e e8 75 58 87 f8 49 8d 7f 20 48 89 fa 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 6c 03 00 00 49 3b 5f 20 75 c0 e8 54 58 87 f8
RSP: 0018:ffffc90003346f78 EFLAGS: 00010202

RAX: 0000000000000000 RBX: ffffffff87515fc0 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff898227ab RDI: 0000000000000020
RBP: ffffffff8fdafa20 R08: 0000000000000005 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90003347010
R13: dffffc0000000000 R14: ffff888057b4cec0 R15: 0000000000000000
FS:  0000555577bab500(0000) GS:ffff8880d62e0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000600 CR3: 000000002c1fc000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 nsim_setup_tc+0x1af/0x200 drivers/net/netdevsim/tc.c:87
 nft_block_offload_cmd+0x144/0x2f0 net/netfilter/nf_tables_offload.c:397
 nft_chain_offload_cmd net/netfilter/nf_tables_offload.c:451 [inline]
 nft_flow_block_chain+0x175/0x4b0 net/netfilter/nf_tables_offload.c:471
 nft_flow_offload_chain net/netfilter/nf_tables_offload.c:513 [inline]
 nft_flow_rule_offload_commit+0x535/0x6a0 net/netfilter/nf_tables_offload.c:584
 nf_tables_commit+0x5f0/0x92e0 net/netfilter/nf_tables_api.c:10926
 nfnetlink_rcv_batch+0x1a4d/0x2880 net/netfilter/nfnetlink.c:574
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
 nfnetlink_rcv+0x3bd/0x440 net/netfilter/nfnetlink.c:665
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmsg+0x160/0x210 net/socket.c:2770
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9a3319de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff6c544c08 EFLAGS: 00000246
 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f9a33425fa0 RCX: 00007f9a3319de59
RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003
RBP: 00007f9a33233e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9a33425fac R14: 00007f9a33425fa0 R15: 00007f9a33425fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	4c 89 fa             	mov    %r15,%rdx
   3:	48 c1 ea 03          	shr    $0x3,%rdx
   7:	42 80 3c 2a 00       	cmpb   $0x0,(%rdx,%r13,1)
   c:	0f 85 78 03 00 00    	jne    0x38a
  12:	4d 8b 3f             	mov    (%r15),%r15
  15:	4c 39 fd             	cmp    %r15,%rbp
  18:	74 5e                	je     0x78
  1a:	e8 75 58 87 f8       	call   0xf8875894
  1f:	49 8d 7f 20          	lea    0x20(%r15),%rdi
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	42 80 3c 2a 00       	cmpb   $0x0,(%rdx,%r13,1) <-- trapping instruction
  2f:	0f 85 6c 03 00 00    	jne    0x3a1
  35:	49 3b 5f 20          	cmp    0x20(%r15),%rbx
  39:	75 c0                	jne    0xfffffffb
  3b:	e8 54 58 87 f8       	call   0xf8875894