------------[ cut here ]------------
WARNING: CPU: 1 PID: 27645 at net/ipv4/route.c:1259 kfree_skb include/linux/skbuff.h:1218 [inline]
WARNING: CPU: 1 PID: 27645 at net/ipv4/route.c:1259 ip_rt_bug+0x28/0x120 net/ipv4/route.c:1258
Modules linked in:
CPU: 1 PID: 27645 Comm: syz-executor.4 Not tainted 6.2.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023
RIP: 0010:ip_rt_bug+0x28/0x120 net/ipv4/route.c:1259
Code: 00 00 f3 0f 1e fa 41 54 55 48 89 d5 53 48 83 ec 08 e8 3c b4 37 f9 66 90 e8 35 b4 37 f9 be 02 00 00 00 48 89 ef e8 b8 dd 78 ff <0f> 0b 48 83 c4 08 31 c0 5b 5d 41 5c c3 e8 16 b4 37 f9 48 8d 7d 10
RSP: 0018:ffffc900001e0870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888060a69cc0 RCX: 0000000000000100
RDX: ffff8880481e3a80 RSI: ffffffff88499e68 RDI: 0000000000000000
RBP: ffff888043971b40 R08: 0000000000000000 R09: ffffffff91339b57
R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880770ea900
R13: ffff888043971b40 R14: 0000000000000000 R15: ffff888043971b98
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30e43000 CR3: 000000000c48e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 dst_output include/net/dst.h:444 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 ip_send_skb net/ipv4/ip_output.c:1586 [inline]
 ip_push_pending_frames+0x129/0x2b0 net/ipv4/ip_output.c:1606
 icmp_push_reply+0x319/0x440 net/ipv4/icmp.c:386
 __icmp_send+0xb80/0x13f0 net/ipv4/icmp.c:762
 ipv4_send_dest_unreach net/ipv4/route.c:1239 [inline]
 ipv4_link_failure+0x5aa/0x9b0 net/ipv4/route.c:1246
 dst_link_failure include/net/dst.h:423 [inline]
 arp_error_report+0xcb/0x1c0 net/ipv4/arp.c:296
 neigh_invalidate+0x20d/0x560 net/core/neighbour.c:1067
 neigh_timer_handler+0xd9e/0x1150 net/core/neighbour.c:1154
 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700
 expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751
 __run_timers kernel/time/timer.c:2022 [inline]
 __run_timers kernel/time/timer.c:1995 [inline]
 run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
 __do_softirq+0x1fb/0xadc kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:get_page_owner mm/page_owner.c:106 [inline]
RIP: 0010:__reset_page_owner+0xe4/0x180 mm/page_owner.c:151
Code: 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 e4 34 a9 ff e8 df 34 a9 ff be 08 00 00 00 48 89 ef e8 92 41 f7 ff 48 0f ba 75 00 01 <48> 8b 05 95 b3 b9 0a 48 01 e8 48 8d 78 0c 48 89 fa 48 c1 ea 03 42
RSP: 0018:ffffc90005307720 EFLAGS: 00000247
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff81d81dbe
RDX: ffffed10028c3759 RSI: 0000000000000008 RDI: ffff88801461bac0
RBP: ffff88801461bac0 R08: 0000000000000001 R09: ffff88801461bac7
R10: ffffed10028c3758 R11: ffffc90005307f50 R12: 0000000000000001
R13: 0000000000000000 R14: dffffc0000000000 R15: 000001001a4ef9b1
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1446 [inline]
 free_pcp_prepare+0x65c/0xc00 mm/page_alloc.c:1496
 free_unref_page_prepare mm/page_alloc.c:3369 [inline]
 free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3510
 release_pages+0xcb1/0x1330 mm/swap.c:1076
 tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
 tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
 tlb_flush_mmu mm/mmu_gather.c:299 [inline]
 tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
 exit_mmap+0x202/0x7b0 mm/mmap.c:3096
 __mmput+0x128/0x4c0 kernel/fork.c:1207
 mmput+0x60/0x70 kernel/fork.c:1229
 exit_mm kernel/exit.c:563 [inline]
 do_exit+0x9ac/0x2950 kernel/exit.c:854
 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012
 get_signal+0x21c3/0x2450 kernel/signal.c:2859
 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
 exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
 exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296
 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fe90988c0c9
Code: Unable to access opcode bytes at 0x7fe90988c09f.
RSP: 002b:00007fe90a676218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fe9099abf88 RCX: 00007fe90988c0c9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe9099abf88
RBP: 00007fe9099abf80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe9099abf8c
R13: 00007ffd6ec55ccf R14: 00007fe90a676300 R15: 0000000000022000
 </TASK>
----------------
Code disassembly (best guess):
   0:	83 c4 18             	add    $0x18,%esp
   3:	5b                   	pop    %rbx
   4:	5d                   	pop    %rbp
   5:	41 5c                	pop    %r12
   7:	41 5d                	pop    %r13
   9:	41 5e                	pop    %r14
   b:	41 5f                	pop    %r15
   d:	e9 e4 34 a9 ff       	jmpq   0xffa934f6
  12:	e8 df 34 a9 ff       	callq  0xffa934f6
  17:	be 08 00 00 00       	mov    $0x8,%esi
  1c:	48 89 ef             	mov    %rbp,%rdi
  1f:	e8 92 41 f7 ff       	callq  0xfff741b6
  24:	48 0f ba 75 00 01    	btrq   $0x1,0x0(%rbp)
* 2a:	48 8b 05 95 b3 b9 0a 	mov    0xab9b395(%rip),%rax        # 0xab9b3c6 <-- trapping instruction
  31:	48 01 e8             	add    %rbp,%rax
  34:	48 8d 78 0c          	lea    0xc(%rax),%rdi
  38:	48 89 fa             	mov    %rdi,%rdx
  3b:	48 c1 ea 03          	shr    $0x3,%rdx
  3f:	42                   	rex.X