Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 10477 Comm: syz.4.1587 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:fib_nexthop_info+0x8e/0xa80 net/ipv4/fib_semantics.c:1579
Code: 2e ca 89 4c 8d 7c 24 40 49 c1 ef 03 48 b8 f1 f1 f1 f1 f8 f2 f8 f3 4b 89 04 2f e8 0d 65 fb f7 49 8d 5e 17 49 89 dc 49 c1 ec 03 <43> 0f b6 04 2c 84 c0 0f 85 10 08 00 00 0f b6 1b 89 de 83 e6 01 31
RSP: 0018:ffffc9000428eac0 EFLAGS: 00010203
RAX: ffffffff89ca2f43 RBX: 0000000000000017 RCX: 0000000000080000
RDX: ffffc9000794a000 RSI: 0000000000001692 RDI: 0000000000001693
RBP: ffffc9000428eba0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10069741a7 R12: 0000000000000002
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92000851d60
FS:  00007fbaf57366c0(0000) GS:ffff888125d3c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2596dcc2b CR3: 0000000042d9e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rt6_fill_node_nexthop+0x1c1/0x710 net/ipv6/route.c:5763
 rt6_fill_node+0xfae/0x19f0 net/ipv6/route.c:5928
 inet6_rt_notify+0x1d2/0x470 net/ipv6/route.c:6379
 fib6_add_rt2node+0x1858/0x3940 net/ipv6/ip6_fib.c:1289
 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1372 [inline]
 fib6_add+0x978/0x1930 net/ipv6/ip6_fib.c:1532
 __ip6_ins_rt net/ipv6/route.c:1356 [inline]
 ip6_route_add+0xf5/0x1d0 net/ipv6/route.c:3970
 inet6_rtm_newroute+0x265/0x18e0 net/ipv6/route.c:5677
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
 __sock_sendmsg net/socket.c:825 [inline]
 ____sys_sendmsg+0x565/0x870 net/socket.c:2727
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2781
----------------
Code disassembly (best guess):
   0:	2e ca 89 4c          	cs lret $0x4c89
   4:	8d 7c 24 40          	lea    0x40(%rsp),%edi
   8:	49 c1 ef 03          	shr    $0x3,%r15
   c:	48 b8 f1 f1 f1 f1 f8 	movabs $0xf3f8f2f8f1f1f1f1,%rax
  13:	f2 f8 f3
  16:	4b 89 04 2f          	mov    %rax,(%r15,%r13,1)
  1a:	e8 0d 65 fb f7       	call   0xf7fb652c
  1f:	49 8d 5e 17          	lea    0x17(%r14),%rbx
  23:	49 89 dc             	mov    %rbx,%r12
  26:	49 c1 ec 03          	shr    $0x3,%r12
* 2a:	43 0f b6 04 2c       	movzbl (%r12,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 10 08 00 00    	jne    0x847
  37:	0f b6 1b             	movzbl (%rbx),%ebx
  3a:	89 de                	mov    %ebx,%esi
  3c:	83 e6 01             	and    $0x1,%esi
  3f:	31                   	.byte 0x31