general protection fault, probably for non-canonical address 0xdffffc000000005b: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000002d8-0x00000000000002df] CPU: 1 PID: 24345 Comm: syz.1.7143 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2025 RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:254 [inline] RIP: 0010:fib_lookup_good_nhc net/ipv4/fib_trie.c:1363 [inline] RIP: 0010:nexthop_get_nhc_lookup+0x1a2/0x6c0 include/net/nexthop.h:291 Code: 74 08 48 89 df e8 6e 70 bf fd 48 89 5d a8 48 8b 1b b8 d8 02 00 00 48 01 c3 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 40 70 bf fd 48 8b 1b 48 85 db 74 68 RSP: 0018:ffffc90000ebe128 EFLAGS: 00010202 RAX: 000000000000005b RBX: 00000000000002d8 RCX: dffffc0000000000 RDX: ffff888114b1bb40 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000ebe198 R08: ffff888114b1bb40 R09: 0000000000000003 R10: 0000000000000008 R11: 0000000000000002 R12: ffff88810a873400 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888127a23090 FS: 00007fe68a63b6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffffd CR3: 00000001289e2000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: fib_table_lookup+0xe4c/0x1730 net/ipv4/fib_trie.c:1542 fib4_rule_action+0x115/0x1a0 net/ipv4/fib_rules.c:135 fib_rules_lookup+0x489/0x8d0 net/core/fib_rules.c:318 __fib_lookup+0xe4/0x150 net/ipv4/fib_rules.c:92 fib_lookup include/net/ip_fib.h:371 [inline] ip_route_output_key_hash_rcu+0x345/0x20b0 net/ipv4/route.c:2670 ip_route_output_key_hash net/ipv4/route.c:2560 [inline] __ip_route_output_key include/net/route.h:126 [inline] ip_route_output_flow+0x123/0x2d0 net/ipv4/route.c:2792 ip_route_output_key include/net/route.h:142 [inline] ip_tunnel_xmit+0x6dd/0x2280 net/ipv4/ip_tunnel.c:760 __gre_xmit net/ipv4/ip_gre.c:469 [inline] erspan_xmit+0x97b/0x16d0 net/ipv4/ip_gre.c:718 __netdev_start_xmit include/linux/netdevice.h:4864 [inline] netdev_start_xmit include/linux/netdevice.h:4878 [inline] xmit_one net/core/dev.c:3608 [inline] dev_hard_start_xmit+0x244/0x670 net/core/dev.c:3624 sch_direct_xmit+0x24b/0x8b0 net/sched/sch_generic.c:336 qdisc_restart net/sched/sch_generic.c:401 [inline] __qdisc_run+0x9be/0x1330 net/sched/sch_generic.c:409 qdisc_run+0x10a/0x300 include/net/pkt_sched.h:127 __dev_xmit_skb net/core/dev.c:3819 [inline] __dev_queue_xmit+0xbc7/0x2540 net/core/dev.c:4175 dev_queue_xmit+0x17/0x20 net/core/dev.c:4243 neigh_resolve_output+0x6cf/0x770 net/core/neighbour.c:1509 neigh_output include/net/neighbour.h:517 [inline] ip_finish_output2+0xad5/0xec0 net/ipv4/ip_output.c:237 __ip_finish_output+0x3fb/0x720 net/ipv4/ip_output.c:-1 ip_finish_output+0x33/0x1f0 net/ipv4/ip_output.c:325 NF_HOOK_COND include/linux/netfilter.h:288 [inline] ip_output+0x1e1/0x360 net/ipv4/ip_output.c:439 dst_output include/net/dst.h:451 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] ip_send_skb+0xb2/0x140 net/ipv4/ip_output.c:1591 udp_send_skb+0x938/0x1240 net/ipv4/udp.c:977 udp_sendmsg+0x171b/0x2080 net/ipv4/udp.c:1265 udpv6_sendmsg+0x8aa/0x2550 net/ipv6/udp.c:1369 inet6_sendmsg+0xa5/0xc0 net/ipv6/af_inet6.c:663 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] ____sys_sendmsg+0x5a2/0x8c0 net/socket.c:2376 ___sys_sendmsg+0x1f0/0x260 net/socket.c:2430 __sys_sendmmsg+0x273/0x450 net/socket.c:2516 __do_sys_sendmmsg net/socket.c:2545 [inline] __se_sys_sendmmsg net/socket.c:2542 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2542 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe68bbd2be9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe68a63b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007fe68be09fa0 RCX: 00007fe68bbd2be9 RDX: 0000000000000001 RSI: 0000200000000b80 RDI: 0000000000000003 RBP: 00007fe68bc55e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004880 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe68be0a038 R14: 00007fe68be09fa0 R15: 00007ffdca2c7918 Modules linked in: ---[ end trace 5c31ee4c93f22165 ]--- RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:254 [inline] RIP: 0010:fib_lookup_good_nhc net/ipv4/fib_trie.c:1363 [inline] RIP: 0010:nexthop_get_nhc_lookup+0x1a2/0x6c0 include/net/nexthop.h:291 Code: 74 08 48 89 df e8 6e 70 bf fd 48 89 5d a8 48 8b 1b b8 d8 02 00 00 48 01 c3 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 40 70 bf fd 48 8b 1b 48 85 db 74 68 RSP: 0018:ffffc90000ebe128 EFLAGS: 00010202 RAX: 000000000000005b RBX: 00000000000002d8 RCX: dffffc0000000000 RDX: ffff888114b1bb40 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000ebe198 R08: ffff888114b1bb40 R09: 0000000000000003 R10: 0000000000000008 R11: 0000000000000002 R12: ffff88810a873400 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888127a23090 FS: 00007fe68a63b6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffffd CR3: 00000001289e2000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 74 08 je 0xa 2: 48 89 df mov %rbx,%rdi 5: e8 6e 70 bf fd call 0xfdbf7078 a: 48 89 5d a8 mov %rbx,-0x58(%rbp) e: 48 8b 1b mov (%rbx),%rbx 11: b8 d8 02 00 00 mov $0x2d8,%eax 16: 48 01 c3 add %rax,%rbx 19: 48 89 d8 mov %rbx,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 48 89 df mov %rbx,%rdi 33: e8 40 70 bf fd call 0xfdbf7078 38: 48 8b 1b mov (%rbx),%rbx 3b: 48 85 db test %rbx,%rbx 3e: 74 68 je 0xa8