Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 0 UID: 0 PID: 20093 Comm: syz.3.4482 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:fib_nexthop_info+0x8e/0xa80 net/ipv4/fib_semantics.c:1579
Code: 2e ca 89 4c 8d 7c 24 40 49 c1 ef 03 48 b8 f1 f1 f1 f1 f8 f2 f8 f3 4b 89 04 2f e8 0d 65 fb f7 49 8d 5e 17 49 89 dc 49 c1 ec 03 <43> 0f b6 04 2c 84 c0 0f 85 10 08 00 00 0f b6 1b 89 de 83 e6 01 31
RSP: 0018:ffffc900048c6ac0 EFLAGS: 00010203
RAX: ffffffff89ca2f43 RBX: 0000000000000017 RCX: 0000000000080000
RDX: ffffc90010b49000 RSI: 000000000000166e RDI: 000000000000166f
RBP: ffffc900048c6ba0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100a48ae1f R12: 0000000000000002
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92000918d60
FS:  00007fc8f1de56c0(0000) GS:ffff888125c3c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ed23ffc CR3: 000000003868e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rt6_fill_node_nexthop+0x1c1/0x710 net/ipv6/route.c:5763
 rt6_fill_node+0xfae/0x19f0 net/ipv6/route.c:5928
 inet6_rt_notify+0x1d2/0x470 net/ipv6/route.c:6379
 fib6_add_rt2node+0x1858/0x3940 net/ipv6/ip6_fib.c:1289
 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1372 [inline]
 fib6_add+0x978/0x1930 net/ipv6/ip6_fib.c:1532
 __ip6_ins_rt net/ipv6/route.c:1356 [inline]
 ip6_route_add+0xf5/0x1d0 net/ipv6/route.c:3970
 inet6_rtm_newroute+0x265/0x18e0 net/ipv6/route.c:5677
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
 __sock_sendmsg net/socket.c:825 [inline]
 ____sys_sendmsg+0x565/0x870 net/socket.c:2727
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2781
 __sys_sendmsg net/socket.c:2813 [inline]
 __do_sys_sendmsg net/socket.c:2818 [inline]
 __se_sys_sendmsg net/socket.c:2816 [inline]
 __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2816
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc8f3bade59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc8f1de5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc8f3e36090 RCX: 00007fc8f3bade59
RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000008
RBP: 00007fc8f3c43e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc8f3e36128 R14: 00007fc8f3e36090 R15: 00007fff3aa40e38
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	2e ca 89 4c          	cs lret $0x4c89
   4:	8d 7c 24 40          	lea    0x40(%rsp),%edi
   8:	49 c1 ef 03          	shr    $0x3,%r15
   c:	48 b8 f1 f1 f1 f1 f8 	movabs $0xf3f8f2f8f1f1f1f1,%rax
  13:	f2 f8 f3
  16:	4b 89 04 2f          	mov    %rax,(%r15,%r13,1)
  1a:	e8 0d 65 fb f7       	call   0xf7fb652c
  1f:	49 8d 5e 17          	lea    0x17(%r14),%rbx
  23:	49 89 dc             	mov    %rbx,%r12
  26:	49 c1 ec 03          	shr    $0x3,%r12
* 2a:	43 0f b6 04 2c       	movzbl (%r12,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 10 08 00 00    	jne    0x847
  37:	0f b6 1b             	movzbl (%rbx),%ebx
  3a:	89 de                	mov    %ebx,%esi
  3c:	83 e6 01             	and    $0x1,%esi
  3f:	31                   	.byte 0x31