IPVS: stop unused estimator thread 0...
Oops: general protection fault, probably for non-canonical address 0xdffffc00000002b3: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x0000000000001598-0x000000000000159f]
CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: netns cleanup_net

RIP: 0010:__xfrm_policy_unlink+0x351/0x3a0 net/xfrm/xfrm_policy.c:2349
Code: bf 07 00 00 00 44 89 f6 e8 fc f3 d2 f7 41 83 fe 06 77 39 e8 b1 ef d2 f7 4e 8d 34 b5 00 00 00 00 4d 01 ee 4c 89 f0 48 c1 e8 03 <0f> b6 04 28 84 c0 75 30 41 ff 0e 48 89 d8 48 83 c4 28 5b 41 5c 41
RSP: 0018:ffffc900001177b8 EFLAGS: 00010202
RAX: 00000000000002b3 RBX: ffff8880278b3000 RCX: ffff88801c2bdac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000022ef4 R12: ffff88807e560180
R13: 0000000000001598 R14: 0000000000001598 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125e0f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1f9e44f727 CR3: 0000000077c5c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 xfrm_policy_flush+0x2fc/0x530 net/xfrm/xfrm_policy.c:1839
 xfrm_policy_fini+0x43/0x3e0 net/xfrm/xfrm_policy.c:4282
 xfrm_net_exit+0x25/0x70 net/xfrm/xfrm_policy.c:4353
 ops_exit_list net/core/net_namespace.c:199 [inline]
 ops_undo_list+0x49a/0x990 net/core/net_namespace.c:252
 cleanup_net+0x4d8/0x820 net/core/net_namespace.c:695
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__xfrm_policy_unlink+0x351/0x3a0 net/xfrm/xfrm_policy.c:2349
Code: bf 07 00 00 00 44 89 f6 e8 fc f3 d2 f7 41 83 fe 06 77 39 e8 b1 ef d2 f7 4e 8d 34 b5 00 00 00 00 4d 01 ee 4c 89 f0 48 c1 e8 03 <0f> b6 04 28 84 c0 75 30 41 ff 0e 48 89 d8 48 83 c4 28 5b 41 5c 41
RSP: 0018:ffffc900001177b8 EFLAGS: 00010202
RAX: 00000000000002b3 RBX: ffff8880278b3000 RCX: ffff88801c2bdac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000022ef4 R12: ffff88807e560180
R13: 0000000000001598 R14: 0000000000001598 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888125e0f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1f9e44f727 CR3: 0000000077c5c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	bf 07 00 00 00       	mov    $0x7,%edi
   5:	44 89 f6             	mov    %r14d,%esi
   8:	e8 fc f3 d2 f7       	call   0xf7d2f409
   d:	41 83 fe 06          	cmp    $0x6,%r14d
  11:	77 39                	ja     0x4c
  13:	e8 b1 ef d2 f7       	call   0xf7d2efc9
  18:	4e 8d 34 b5 00 00 00 	lea    0x0(,%r14,4),%r14
  1f:	00
  20:	4d 01 ee             	add    %r13,%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	75 30                	jne    0x62
  32:	41 ff 0e             	decl   (%r14)
  35:	48 89 d8             	mov    %rbx,%rax
  38:	48 83 c4 28          	add    $0x28,%rsp
  3c:	5b                   	pop    %rbx
  3d:	41 5c                	pop    %r12
  3f:	41                   	rex.B