BUG: unable to handle page fault for address: ffffffff00000190
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 5a8b067 P4D 5a8b067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 4007 Comm: syz-executor.3 Tainted: G        W           6.17.0-rc4-next-20250901 #1 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:perf_tp_event+0x186/0xe70
Code: 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 <44> 8b ab f0 01 00 00 31 ff 41 83 e5 01 44 89 ee e8 c5 4c ea ff 45
RSP: 0018:ffff88806ce08940 EFLAGS: 00010046
RAX: 0000000000000000 RBX: fffffffeffffffa0 RCX: 0000000000000002
RDX: ffff8880454b9b80 RSI: ffffffff8189a4e7 RDI: ffffffff00000190
RBP: ffff88806ce08bb0 R08: ffff88806ce313e8 R09: ffffe8ffffc16138
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 000000000000002c R14: ffff88806ce313e8 R15: dffffc0000000000
FS:  000055558c9dd400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff00000190 CR3: 000000004521e000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 perf_trace_run_bpf_submit+0xef/0x180
 perf_trace_lock+0x337/0x5d0
 lock_release+0x1ab/0x290
 _raw_spin_unlock_irqrestore+0x1a/0x50
 delete_object_full+0x46/0x70
 kmem_cache_free+0x33a/0x540
 dst_destroy+0x23c/0x340
 rcu_core+0x7c8/0x1800
 handle_softirqs+0x1b1/0x770
 __irq_exit_rcu+0xc4/0x100
 irq_exit_rcu+0x9/0x20
 sysvec_apic_timer_interrupt+0x70/0x80
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_acquire+0x47/0x2f0
Code: 48 83 ec 38 4c 89 0c 24 65 48 8b 05 cb a3 32 06 48 89 44 24 30 31 c0 66 90 65 8b 05 e7 a3 32 06 89 c0 48 0f a3 05 f9 d7 f1 04 <0f> 82 3a 01 00 00 8b 35 d1 e3 f1 04 85 f6 0f 85 84 00 00 00 48 8b
RSP: 0018:ffff88800e47f778 EFLAGS: 00000247
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff85c1c760
RBP: ffffffff85c1c760 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000003bea3 R11: 000000000001193c R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800e47f860
 unwind_next_frame+0xcd/0x2540
 arch_stack_walk+0x86/0xf0
 stack_trace_save+0x8e/0xc0
 kasan_save_stack+0x24/0x50
 kasan_record_aux_stack+0x89/0xa0
 __call_rcu_common.constprop.0+0x70/0x960
 kfree+0x31a/0x550
 seq_release_private+0xc4/0x120
 seq_release_net+0xd8/0x130
 close_pdeo.part.0+0xd9/0x260
 proc_reg_release+0x2f1/0x360
 __fput+0x401/0xb50
 fput_close_sync+0x10f/0x240
 __x64_sys_close+0x8f/0x120
 do_syscall_64+0xbf/0x360
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f12c4c2372b
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc2db991d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f12c4c2372b
RDX: 00007f12c4d88b58 RSI: 0000000000000080 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f12c4d88ae8
R10: 00007ffc2db992c0 R11: 0000000000000293 R12: 0000000000018b5a
R13: 00000000000003e8 R14: 00007f12c4d83f60 R15: 0000000000018b40
 </TASK>
Modules linked in:
CR2: ffffffff00000190
---[ end trace 0000000000000000 ]---
RIP: 0010:perf_tp_event+0x186/0xe70
Code: 89 85 c8 fd ff ff e8 c9 51 ea ff 48 8d bb f0 01 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e c5 0b 00 00 <44> 8b ab f0 01 00 00 31 ff 41 83 e5 01 44 89 ee e8 c5 4c ea ff 45
RSP: 0018:ffff88806ce08940 EFLAGS: 00010046
RAX: 0000000000000000 RBX: fffffffeffffffa0 RCX: 0000000000000002
RDX: ffff8880454b9b80 RSI: ffffffff8189a4e7 RDI: ffffffff00000190
RBP: ffff88806ce08bb0 R08: ffff88806ce313e8 R09: ffffe8ffffc16138
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: 000000000000002c R14: ffff88806ce313e8 R15: dffffc0000000000
FS:  000055558c9dd400(0000) GS:ffff8880e55d8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff00000190 CR3: 000000004521e000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	89 85 c8 fd ff ff    	mov    %eax,-0x238(%rbp)
   6:	e8 c9 51 ea ff       	callq  0xffea51d4
   b:	48 8d bb f0 01 00 00 	lea    0x1f0(%rbx),%rdi
  12:	48 89 f8             	mov    %rdi,%rax
  15:	48 c1 e8 03          	shr    $0x3,%rax
  19:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
  1e:	84 c0                	test   %al,%al
  20:	74 08                	je     0x2a
  22:	3c 03                	cmp    $0x3,%al
  24:	0f 8e c5 0b 00 00    	jle    0xbef
* 2a:	44 8b ab f0 01 00 00 	mov    0x1f0(%rbx),%r13d <-- trapping instruction
  31:	31 ff                	xor    %edi,%edi
  33:	41 83 e5 01          	and    $0x1,%r13d
  37:	44 89 ee             	mov    %r13d,%esi
  3a:	e8 c5 4c ea ff       	callq  0xffea4d04
  3f:	45                   	rex.RB