general protection fault, probably for non-canonical address 0xdffffc000000005a: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000002d0-0x00000000000002d7]
CPU: 1 PID: 22986 Comm: syz.2.5786 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:259 [inline]
RIP: 0010:fib_lookup_good_nhc net/ipv4/fib_trie.c:1413 [inline]
RIP: 0010:nexthop_get_nhc_lookup+0x17e/0x750 include/net/nexthop.h:405
Code: d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 38 ba 7b fd 48 89 5d a8 48 8b 1b b8 d0 02 00 00 48 01 c3 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 13 ba 7b fd 48 8b 1b 48 85 db 0f
RSP: 0018:ffffc900001afdf8 EFLAGS: 00010206
RAX: 000000000000005a RBX: 00000000000002d0 RCX: 0000000000000100
RDX: ffff888116de8000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001afe68 R08: ffff888116de8000 R09: 0000000000000003
R10: 0000000000000008 R11: 0000000000000100 R12: ffff888116c2f100
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc900001b0490
FS: 00007fdda56606c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000016f94c000 CR4: 00000000003506a0
Call Trace:
fib_table_lookup+0x10b7/0x1a60 net/ipv4/fib_trie.c:1590
fib4_rule_action+0x115/0x1a0 net/ipv4/fib_rules.c:136
fib_rules_lookup+0x4ae/0x900 net/core/fib_rules.c:318
__fib_lookup+0xe4/0x150 net/ipv4/fib_rules.c:93
fib_lookup include/net/ip_fib.h:376 [inline]
ip_route_output_key_hash_rcu+0x33e/0x2030 net/ipv4/route.c:2784
ip_route_output_key_hash net/ipv4/route.c:2674 [inline]
__ip_route_output_key include/net/route.h:137 [inline]
ip_route_output_flow+0x12e/0x2e0 net/ipv4/route.c:2904
ip_route_output_key include/net/route.h:153 [inline]
ip_tunnel_xmit+0xa4b/0x2700 net/ipv4/ip_tunnel.c:776
ipip_tunnel_xmit+0x330/0x4e0 net/ipv4/ipip.c:307
__netdev_start_xmit include/linux/netdevice.h:4930 [inline]
netdev_start_xmit include/linux/netdevice.h:4944 [inline]
xmit_one net/core/dev.c:3681 [inline]
dev_hard_start_xmit+0x20b/0x750 net/core/dev.c:3697
__dev_queue_xmit+0x18d9/0x3420 net/core/dev.c:4357
dev_queue_xmit include/linux/netdevice.h:3085 [inline]
neigh_connected_output+0x469/0x500 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:552 [inline]
ip_finish_output2+0xc27/0xef0 net/ipv4/ip_output.c:228
__ip_finish_output+0x172/0x370 net/ipv4/ip_output.c:-1
ip_finish_output+0x31/0x2b0 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:294 [inline]
ip_output+0x1e1/0x360 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:453 [inline]
ip_local_out+0xa7/0xc0 net/ipv4/ip_output.c:126
igmpv3_sendpack+0x227/0x400 net/ipv4/igmp.c:427
igmpv3_send_cr net/ipv4/igmp.c:723 [inline]
igmp_ifc_timer_expire+0x964/0xe10 net/ipv4/igmp.c:813
call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1510
expire_timers kernel/time/timer.c:1555 [inline]
__run_timers+0x639/0x9a0 kernel/time/timer.c:1826
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1839
handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
__do_softirq kernel/softirq.c:680 [inline]
invoke_softirq kernel/softirq.c:497 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x55/0x80 kernel/locking/spinlock.c:194
Code: 00 d1 ed 86 e8 bc 69 c0 fc 4c 89 f7 48 83 3d 51 b3 f9 01 00 74 30 e8 1e 0d 00 00 90 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 16 96 57 fc 65 8b 05 f7 4f 0e 7b 85 c0 74 05 5b 41 5e 5d c3 e8
RSP: 0018:ffffc900019075e0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000a02 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000a02 RDI: 0000000000000001
RBP: ffffc900019075f0 R08: dffffc0000000000 R09: ffffed102a9b1f5f
R10: ffffed102a9b1f5f R11: 1ffff1102a9b1f5e R12: ffff888154d8fa00
R13: ffff8881103994ec R14: ffffc900019077c0 R15: dffffc0000000000
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__skb_try_recv_datagram+0x17b/0x4d0 net/core/datagram.c:265
__unix_dgram_recvmsg+0x2cf/0xd70 net/unix/af_unix.c:2453
unix_dgram_recvmsg+0xc7/0xe0 net/unix/af_unix.c:2550
____sys_recvmsg+0x2a0/0x590 net/socket.c:-1
___sys_recvmsg+0x1b2/0x510 net/socket.c:2770
do_recvmmsg+0x359/0x7a0 net/socket.c:2864
__sys_recvmmsg net/socket.c:2943 [inline]
__do_sys_recvmmsg net/socket.c:2966 [inline]
__se_sys_recvmmsg net/socket.c:2959 [inline]
__x64_sys_recvmmsg+0x18d/0x240 net/socket.c:2959
x64_sys_call+0x3e7/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fdda478eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdda5660038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007fdda49e5fa0 RCX: 00007fdda478eec9
RDX: 03fffffffffffeda RSI: 00002000000000c0 RDI: 0000000000000004
RBP: 00007fdda4811f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdda49e6038 R14: 00007fdda49e5fa0 R15: 00007ffd37694d78
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:259 [inline]
RIP: 0010:fib_lookup_good_nhc net/ipv4/fib_trie.c:1413 [inline]
RIP: 0010:nexthop_get_nhc_lookup+0x17e/0x750 include/net/nexthop.h:405
Code: d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 38 ba 7b fd 48 89 5d a8 48 8b 1b b8 d0 02 00 00 48 01 c3 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 13 ba 7b fd 48 8b 1b 48 85 db 0f
RSP: 0018:ffffc900001afdf8 EFLAGS: 00010206
RAX: 000000000000005a RBX: 00000000000002d0 RCX: 0000000000000100
RDX: ffff888116de8000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001afe68 R08: ffff888116de8000 R09: 0000000000000003
R10: 0000000000000008 R11: 0000000000000100 R12: ffff888116c2f100
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffc900001b0490
FS: 00007fdda56606c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000016f94c000 CR4: 00000000003506a0
----------------
Code disassembly (best guess):
0: d8 48 c1 fmuls -0x3f(%rax)
3: e8 03 42 80 3c call 0x3c80420b
8: 28 00 sub %al,(%rax)
a: 74 08 je 0x14
c: 48 89 df mov %rbx,%rdi
f: e8 38 ba 7b fd call 0xfd7bba4c
14: 48 89 5d a8 mov %rbx,-0x58(%rbp)
18: 48 8b 1b mov (%rbx),%rbx
1b: b8 d0 02 00 00 mov $0x2d0,%eax
20: 48 01 c3 add %rax,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 13 ba 7b fd call 0xfd7bba4c
39: 48 8b 1b mov (%rbx),%rbx
3c: 48 85 db test %rbx,%rbx
3f: 0f .byte 0xf