Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 10321 Comm: kworker/u32:21 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
RIP: 0010:fib6_nh_get_excptn_bucket+0x11f/0x1e0 net/ipv6/route.c:1662
Code: 05 24 db 51 06 01 e8 b0 3e 7a f7 e9 2e ff ff ff e8 36 8d 9f f7 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 48 8b 5b 60 e8 de ad 58 01 31 ff 89
RSP: 0018:ffffc9000069fff0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a1fbc73
RDX: 000000000000000c RSI: ffffffff8a1f595a RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802aee54b0 R12: 0000000000000000
R13: fffff520000d402c R14: 1ffff920000d402d R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880d69f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000056c60000 CR4: 0000000000352ef0
Call Trace:
<IRQ>
rt6_find_cached_rt+0x151/0x280 net/ipv6/route.c:1860
ip6_pol_route+0x238/0x1230 net/ipv6/route.c:2276
pol_lookup_func include/net/ip6_fib.h:617 [inline]
__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]
fib6_rule_action+0x283/0x910 net/ipv6/fib6_rules.c:275
fib_rules_lookup+0x459/0x1030 net/core/fib_rules.c:339
fib6_rule_lookup+0x18b/0x720 net/ipv6/fib6_rules.c:112
ip6_route_output_flags_noref net/ipv6/route.c:2684 [inline]
ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2696
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_dst_lookup_tail.constprop.0+0xa52/0x2140 net/ipv6/ip6_output.c:1141
icmpv6_route_lookup+0x42d/0x570 net/ipv6/icmp.c:397
icmp6_send+0xf2f/0x3c50 net/ipv6/icmp.c:794
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
__udp6_lib_rcv+0x2349/0x3090 net/ipv6/udp.c:1168
ip6_protocol_deliver_rcu+0x6f0/0x1520 net/ipv6/ip6_input.c:438
ip6_input_finish+0x1e4/0x4b0 net/ipv6/ip6_input.c:489
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:500
dst_input include/net/dst.h:474 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ipv6_rcv+0x264/0x650 net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6250
process_backlog+0x4a2/0x1650 net/core/dev.c:6602
__napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x9f9/0xfa0 net/core/dev.c:7881
handle_softirqs+0x219/0x950 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:510
</IRQ>
<TASK>
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
wg_socket_send_skb_to_peer+0x145/0x210 drivers/net/wireguard/socket.c:184
wg_socket_send_buffer_to_peer+0x148/0x1a0 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation+0x225/0x360 drivers/net/wireguard/send.c:40
wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51
process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fib6_nh_get_excptn_bucket+0x11f/0x1e0 net/ipv6/route.c:1662
Code: 05 24 db 51 06 01 e8 b0 3e 7a f7 e9 2e ff ff ff e8 36 8d 9f f7 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 48 8b 5b 60 e8 de ad 58 01 31 ff 89
RSP: 0018:ffffc9000069fff0 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a1fbc73
RDX: 000000000000000c RSI: ffffffff8a1f595a RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802aee54b0 R12: 0000000000000000
R13: fffff520000d402c R14: 1ffff920000d402d R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880d69f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000000e184000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 05 24 db 51 06 add $0x651db24,%eax
5: 01 e8 add %ebp,%eax
7: b0 3e mov $0x3e,%al
9: 7a f7 jp 0x2
b: e9 2e ff ff ff jmp 0xffffff3e
10: e8 36 8d 9f f7 call 0xf79f8d4b
15: 48 8d 7b 60 lea 0x60(%rbx),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 a7 00 00 00 jne 0xdb
34: 48 8b 5b 60 mov 0x60(%rbx),%rbx
38: e8 de ad 58 01 call 0x158ae1b
3d: 31 ff xor %edi,%edi
3f: 89 .byte 0x89