------------[ cut here ]------------ WARNING: CPU: 1 PID: 3763 at net/ipv4/route.c:1259 kfree_skb include/linux/skbuff.h:1206 [inline] WARNING: CPU: 1 PID: 3763 at net/ipv4/route.c:1259 ip_rt_bug+0x27/0x120 net/ipv4/route.c:1258 Modules linked in: CPU: 1 PID: 3763 Comm: syz-fuzzer Not tainted 5.19.0-rc7-syzkaller-01445-g3c47fb2f4c4d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:ip_rt_bug+0x27/0x120 net/ipv4/route.c:1259 Code: 44 00 00 55 48 89 d5 53 48 83 ec 08 e8 32 82 a7 f9 66 90 e8 2b 82 a7 f9 e8 26 82 a7 f9 be 01 00 00 00 48 89 ef e8 99 cc 7a ff <0f> 0b 48 83 c4 08 31 c0 5b 5d c3 e8 09 82 a7 f9 48 8d 7d 10 48 b8 RSP: 0000:ffffc9000417f7e8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880218b8000 RCX: 0000000000000100 RDX: ffff888079079d80 RSI: ffffffff87d2ef67 RDI: 0000000000000000 RBP: ffff88805fe3d140 R08: 0000000000000000 R09: ffffffff9068d99f R10: 0000000000000001 R11: 0000000000000001 R12: ffff88805dcaad00 R13: ffff88805fe3d140 R14: 0000000000000000 R15: ffff88805fe3d198 FS: 000000c0008da090(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbc777a0000 CR3: 00000000729c9000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb net/ipv4/ip_output.c:1589 [inline] ip_push_pending_frames+0x125/0x2b0 net/ipv4/ip_output.c:1609 icmp_push_reply+0x2da/0x400 net/ipv4/icmp.c:386 __icmp_send+0xb78/0x13e0 net/ipv4/icmp.c:762 ipv4_send_dest_unreach net/ipv4/route.c:1239 [inline] ipv4_link_failure+0x5a6/0x9a0 net/ipv4/route.c:1246 dst_link_failure include/net/dst.h:430 [inline] arp_error_report+0xc7/0x1c0 net/ipv4/arp.c:296 neigh_invalidate+0x20d/0x560 net/core/neighbour.c:1024 neigh_timer_handler+0xd47/0x10e0 net/core/neighbour.c:1111 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790 __run_timers kernel/time/timer.c:1768 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x45/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0033:0x43d4af Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 35 48 83 ec 18 48 89 6c 24 10 <48> 8d 6c 24 10 80 3d 15 ba 40 01 00 74 0f 48 89 44 24 08 e8 59 8a RSP: 002b:000000c00596bf98 EFLAGS: 00000212 RAX: 000000c000000b60 RBX: 000000c0008da000 RCX: 000000c0008da000 RDX: 0000000000835f50 RSI: 000000c0008dc1a0 RDI: 0000000000000003 RBP: 000000c00002f7d0 R08: 0000000000000a5b R09: 000000000000000a R10: 0000000000000a5f R11: 00000000000000aa R12: 000000000043d4a0 R13: 0000000000000002 R14: 000000c0008dc1a0 R15: 00007fa4d2b2d2e0