Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 UID: 0 PID: 23 Comm: ksoftirqd/2 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:dst_dev_put+0x25/0x390 net/core/dst.c:146
Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 2c b7 75 f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 23 03 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
RSP: 0018:ffffc9000050fad8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff89efe1c9
RDX: 0000000000000000 RSI: ffffffff8948a194 RDI: 0000000000000001
RBP: 0000607f1494ede0 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000001 R11: ffff88801bf18b30 R12: fffffbfff1bae8cf
R13: dffffc0000000000 R14: 0000607f1494ede0 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880978fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f73d9154 CR3: 000000006cdff000 CR4: 0000000000352ef0
Call Trace:
<TASK>
rt_fibinfo_free_cpus.part.0+0xe7/0x1c0 net/ipv4/fib_semantics.c:195
rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:187 [inline]
fib_nh_common_release+0x121/0x360 net/ipv4/fib_semantics.c:206
fib_nh_release net/ipv4/fib_semantics.c:218 [inline]
free_fib_info_rcu+0x1af/0x4e0 net/ipv4/fib_semantics.c:230
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0x79c/0x15f0 kernel/rcu/tree.c:2857
handle_softirqs+0x219/0x950 kernel/softirq.c:622
run_ksoftirqd kernel/softirq.c:1063 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:1055
smpboot_thread_fn+0x3f7/0xae0 kernel/smpboot.c:160
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dst_dev_put+0x25/0x390 net/core/dst.c:146
Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 2c b7 75 f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 23 03 00 00 48 8d 7b 3a 48 8b 2b 48 b8 00 00 00
RSP: 0018:ffffc9000050fad8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff89efe1c9
RDX: 0000000000000000 RSI: ffffffff8948a194 RDI: 0000000000000001
RBP: 0000607f1494ede0 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000001 R11: ffff88801bf18b30 R12: fffffbfff1bae8cf
R13: dffffc0000000000 R14: 0000607f1494ede0 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880978fd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f73d9154 CR3: 000000006cdff000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: f3 0f 1e fa endbr64
9: 41 56 push %r14
b: 41 55 push %r13
d: 41 54 push %r12
f: 55 push %rbp
10: 53 push %rbx
11: 48 89 fb mov %rdi,%rbx
14: e8 2c b7 75 f8 call 0xf875b745
19: 48 89 da mov %rbx,%rdx
1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
23: fc ff df
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2e: 0f 85 23 03 00 00 jne 0x357
34: 48 8d 7b 3a lea 0x3a(%rbx),%rdi
38: 48 8b 2b mov (%rbx),%rbp
3b: 48 rex.W
3c: b8 .byte 0xb8
3d: 00 00 add %al,(%rax)