Oops: general protection fault, probably for non-canonical address 0xdffffc010000017f: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000800000bf8-0x0000000800000bff]
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events nsim_fib_event_work
RIP: 0010:fib_get_table+0x62/0xd0
Code: 80 07 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 2e 67 b2 f7 89 db 48 c1 e3 03 49 03 1e 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 0f 67 b2 f7 48 8b 1b 48 85 db 74
RSP: 0018:ffffc900001b7538 EFLAGS: 00010202
RAX: 000000010000017f RBX: 0000000800000bf8 RCX: ffff88801cad4880
RDX: ffff88801cad4880 RSI: 00000000000000ff RDI: 0000000000000000
RBP: 00000000000000ff R08: ffffffff8a768d27 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: 0000000000000020 R14: ffff888044410780 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599dcf64098 CR3: 0000000039cb6000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 fib_find_matching_alias net/ipv4/fib_trie.c:1019 [inline]
 fib_alias_hw_flags_set+0x173/0xb90 net/ipv4/fib_trie.c:1047
 nsim_fib_event drivers/net/netdevsim/fib.c:884 [inline]
 nsim_fib_event_work+0xd37/0x3f00 drivers/net/netdevsim/fib.c:1493
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fib_get_table+0x62/0xd0
Code: 80 07 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 2e 67 b2 f7 89 db 48 c1 e3 03 49 03 1e 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 0f 67 b2 f7 48 8b 1b 48 85 db 74
RSP: 0018:ffffc900001b7538 EFLAGS: 00010202
RAX: 000000010000017f RBX: 0000000800000bf8 RCX: ffff88801cad4880
RDX: ffff88801cad4880 RSI: 00000000000000ff RDI: 0000000000000000
RBP: 00000000000000ff R08: ffffffff8a768d27 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: 0000000000000020 R14: ffff888044410780 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599dcf64098 CR3: 0000000011cde000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	80 07 00             	addb   $0x0,(%rdi)
   3:	00 4c 89 f0          	add    %cl,-0x10(%rcx,%rcx,4)
   7:	48 c1 e8 03          	shr    $0x3,%rax
   b:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
  10:	74 08                	je     0x1a
  12:	4c 89 f7             	mov    %r14,%rdi
  15:	e8 2e 67 b2 f7       	call   0xf7b26748
  1a:	89 db                	mov    %ebx,%ebx
  1c:	48 c1 e3 03          	shl    $0x3,%rbx
  20:	49 03 1e             	add    (%r14),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	48 89 df             	mov    %rbx,%rdi
  34:	e8 0f 67 b2 f7       	call   0xf7b26748
  39:	48 8b 1b             	mov    (%rbx),%rbx
  3c:	48 85 db             	test   %rbx,%rbx
  3f:	74                   	.byte 0x74