Oops: general protection fault, probably for non-canonical address 0xe003fbfffff80000: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x001fffffffc00000-0x001fffffffc00007]
CPU: 0 UID: 0 PID: 3000 Comm: kworker/u8:6 Not tainted 6.15.0-rc2-syzkaller-00042-g1a1d569a75f3 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker
RIP: 0010:get_work_pool+0xea/0x180 kernel/workqueue.c:887
Code: de e8 fa 7a 38 00 81 fb ff ff ff 7f 75 37 e8 0d 76 38 00 31 c0 eb 25 e8 04 76 38 00 48 81 e3 00 fe ff ff 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 77 1e a0 00 48 8b 03 5b 41 5e 5d
RSP: 0018:ffffc90000007148 EFLAGS: 00010006
RAX: 0003fffffff80000 RBX: 001fffffffc00000 RCX: ffff888030a05a00
RDX: 0000000000000100 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff818ace39 R09: 1ffffd1ffffa6590
R10: dffffc0000000000 R11: fffff91ffffa6591 R12: 1ffff1100446fd38
R13: ffff88807d38e800 R14: dffffc0000000000 R15: ffffe8ffffd32c80
FS:  0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558f48669668 CR3: 0000000054cf2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __queue_work+0x602/0x10a0 kernel/workqueue.c:2283
 queue_work_on+0x1c4/0x380 kernel/workqueue.c:2392
 wg_packet_receive+0x1344/0x2580 drivers/net/wireguard/receive.c:570
 wg_receive+0x75/0xa0 drivers/net/wireguard/socket.c:326
 udp_queue_rcv_one_skb+0x1616/0x1820 net/ipv4/udp.c:2385
 udp_unicast_rcv_skb+0x255/0x3d0 net/ipv4/udp.c:2623
 __udp4_lib_rcv+0x136d/0x2720 net/ipv4/udp.c:2699
 ip_protocol_deliver_rcu+0x290/0x450 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x343/0x600 net/ipv4/ip_input.c:233
 NF_HOOK+0x3a0/0x450 include/linux/netfilter.h:314
 NF_HOOK+0x3a0/0x450 include/linux/netfilter.h:314
 __netif_receive_skb_one_core net/core/dev.c:5885 [inline]
 __netif_receive_skb+0x2c9/0x670 net/core/dev.c:5998
 process_backlog+0x664/0x15c0 net/core/dev.c:6350
 __napi_poll+0xcb/0x480 net/core/dev.c:7322
 napi_poll net/core/dev.c:7386 [inline]
 net_rx_action+0x89d/0x1240 net/core/dev.c:7508
 handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
 do_softirq+0x11f/0x1e0 kernel/softirq.c:480
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1be/0x200 kernel/softirq.c:407
 wg_socket_send_skb_to_peer+0x176/0x1d0 drivers/net/wireguard/socket.c:184
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x1ef/0x330 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
 worker_thread+0x870/0xd50 kernel/workqueue.c:3400
 kthread+0x7b7/0x940 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:get_work_pool+0xea/0x180 kernel/workqueue.c:887
Code: de e8 fa 7a 38 00 81 fb ff ff ff 7f 75 37 e8 0d 76 38 00 31 c0 eb 25 e8 04 76 38 00 48 81 e3 00 fe ff ff 48 89 d8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 df e8 77 1e a0 00 48 8b 03 5b 41 5e 5d
RSP: 0018:ffffc90000007148 EFLAGS: 00010006
RAX: 0003fffffff80000 RBX: 001fffffffc00000 RCX: ffff888030a05a00
RDX: 0000000000000100 RSI: 0000000000000004 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff818ace39 R09: 1ffffd1ffffa6590
R10: dffffc0000000000 R11: fffff91ffffa6591 R12: 1ffff1100446fd38
R13: ffff88807d38e800 R14: dffffc0000000000 R15: ffffe8ffffd32c80
FS:  0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558f48669668 CR3: 0000000054cf2000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e8 fa 7a 38 00       	call   0x387aff
   5:	81 fb ff ff ff 7f    	cmp    $0x7fffffff,%ebx
   b:	75 37                	jne    0x44
   d:	e8 0d 76 38 00       	call   0x38761f
  12:	31 c0                	xor    %eax,%eax
  14:	eb 25                	jmp    0x3b
  16:	e8 04 76 38 00       	call   0x38761f
  1b:	48 81 e3 00 fe ff ff 	and    $0xfffffffffffffe00,%rbx
  22:	48 89 d8             	mov    %rbx,%rax
  25:	48 c1 e8 03          	shr    $0x3,%rax
* 29:	42 80 3c 30 00       	cmpb   $0x0,(%rax,%r14,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	48 89 df             	mov    %rbx,%rdi
  33:	e8 77 1e a0 00       	call   0xa01eaf
  38:	48 8b 03             	mov    (%rbx),%rax
  3b:	5b                   	pop    %rbx
  3c:	41 5e                	pop    %r14
  3e:	5d                   	pop    %rbp