Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 24011 Comm: syz.7.4120 Not tainted 6.13.0-rc7-syzkaller-00039-gc3812b15000c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 RIP: 0010:dst_dev_put+0x25/0x330 net/core/dst.c:146 Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 8c 16 97 f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 d6 02 00 00 48 8d 7b 3a 4c 8b 23 48 b8 00 00 00 RSP: 0000:ffffc9000e877c60 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff89a1cc79 RDX: 0000000000000000 RSI: ffffffff890237b4 RDI: 0000000000000001 RBP: 0000607f47642bc0 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 00000000000a2014 R12: fffffbfff1b06291 R13: dffffc0000000000 R14: 0000607f47642bc0 R15: 0000000000000001 FS: 000055556cc83500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b331e6ff8 CR3: 0000000039654000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rt_fibinfo_free_cpus.part.0+0xe7/0x1c0 net/ipv4/fib_semantics.c:201 rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:193 [inline] fib_nh_common_release+0x121/0x360 net/ipv4/fib_semantics.c:212 fib_nh_release net/ipv4/fib_semantics.c:224 [inline] free_fib_info_rcu+0x1a6/0x4d0 net/ipv4/fib_semantics.c:236 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0x79d/0x14d0 kernel/rcu/tree.c:2823 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x7f96a825f4e5 Code: 72 f3 48 83 e8 08 48 39 f2 73 17 66 2e 0f 1f 84 00 00 00 00 00 48 8b 70 f8 48 83 e8 08 48 39 f2 72 f3 48 39 c3 73 3e 48 89 33 <48> 83 c3 08 48 8b 70 f8 48 89 08 48 8b 0b 49 8b 14 24 eb bf 48 39 RSP: 002b:00007ffc45f6b1e0 EFLAGS: 00000287 RAX: 00007f96a5af18b0 RBX: 00007f96a5af1888 RCX: ffffffff81d360c7 RDX: ffffffff81d360c7 RSI: ffffffff81d360c7 RDI: 00007f96a5af1b40 RBP: 00007f96a5af1600 R08: 00007f96a5af1898 R09: 00007f96a8562000 R10: 00007f96a59f4008 R11: 000000000000001d R12: 00007f96a5af15f8 R13: 0000000000000017 R14: 0000000000000032 R15: 00007f96a59f4008 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dst_dev_put+0x25/0x330 net/core/dst.c:146 Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 8c 16 97 f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 d6 02 00 00 48 8d 7b 3a 4c 8b 23 48 b8 00 00 00 RSP: 0000:ffffc9000e877c60 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff89a1cc79 RDX: 0000000000000000 RSI: ffffffff890237b4 RDI: 0000000000000001 RBP: 0000607f47642bc0 R08: 0000000000000005 R09: 0000000000000007 R10: 0000000000000001 R11: 00000000000a2014 R12: fffffbfff1b06291 R13: dffffc0000000000 R14: 0000607f47642bc0 R15: 0000000000000001 FS: 000055556cc83500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b331e6ff8 CR3: 0000000039654000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: f3 0f 1e fa endbr64 9: 41 56 push %r14 b: 41 55 push %r13 d: 41 54 push %r12 f: 55 push %rbp 10: 53 push %rbx 11: 48 89 fb mov %rdi,%rbx 14: e8 8c 16 97 f8 call 0xf89716a5 19: 48 89 da mov %rbx,%rdx 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 d6 02 00 00 jne 0x30a 34: 48 8d 7b 3a lea 0x3a(%rbx),%rdi 38: 4c 8b 23 mov (%rbx),%r12 3b: 48 rex.W 3c: b8 .byte 0xb8 3d: 00 00 add %al,(%rax)