Oops: general protection fault, probably for non-canonical address 0xdffffc0000000014: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000a0-0x00000000000000a7]
CPU: 1 PID: 1089 Comm: kworker/u32:7 Not tainted 6.9.0-syzkaller-09868-g6e51b4b5bbc0 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1407 [inline]
RIP: 0010:ip6_pol_route+0x3bc/0x1150 net/ipv6/route.c:2262
Code: f8 48 85 ed 0f 84 52 03 00 00 e8 6f 9e 06 f8 48 8d bd 98 00 00 00 49 89 ec 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a3 08 00 00 8b 85 98 00 00 00
RSP: 0018:ffffc9000722f510 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8880214fb980 RCX: ffffffff8987e253
RDX: 0000000000000014 RSI: ffffffff8987e261 RDI: 00000000000000a5
RBP: 000000000000000d R08: 0000000000000007 R09: 0000000000000000
R10: 000000000000000d R11: 0000000000000005 R12: 000000000000000d
R13: 1ffff92000e45ea6 R14: 0000000000000080 R15: ffffc9000722f590
FS:  0000000000000000(0000) GS:ffff88802c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000edd70000 CR3: 0000000056a50000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x24c/0x720 net/ipv6/fib6_rules.c:116
 ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]
 ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2649
 ip6_route_output include/net/ip6_route.h:93 [inline]
 ip6_dst_lookup_tail.constprop.0+0x573/0x1760 net/ipv6/ip6_output.c:1120
 ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250
 send6+0x611/0xd20 drivers/net/wireguard/socket.c:139
 wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178
 wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200
 wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40
 wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51
 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1407 [inline]
RIP: 0010:ip6_pol_route+0x3bc/0x1150 net/ipv6/route.c:2262
Code: f8 48 85 ed 0f 84 52 03 00 00 e8 6f 9e 06 f8 48 8d bd 98 00 00 00 49 89 ec 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a3 08 00 00 8b 85 98 00 00 00
RSP: 0018:ffffc9000722f510 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff8880214fb980 RCX: ffffffff8987e253
RDX: 0000000000000014 RSI: ffffffff8987e261 RDI: 00000000000000a5
RBP: 000000000000000d R08: 0000000000000007 R09: 0000000000000000
R10: 000000000000000d R11: 0000000000000005 R12: 000000000000000d
R13: 1ffff92000e45ea6 R14: 0000000000000080 R15: ffffc9000722f590
FS:  0000000000000000(0000) GS:ffff88802c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000edd70000 CR3: 0000000056a50000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	f8                   	clc
   1:	48 85 ed             	test   %rbp,%rbp
   4:	0f 84 52 03 00 00    	je     0x35c
   a:	e8 6f 9e 06 f8       	call   0xf8069e7e
   f:	48 8d bd 98 00 00 00 	lea    0x98(%rbp),%rdi
  16:	49 89 ec             	mov    %rbp,%r12
  19:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  20:	fc ff df
  23:	48 89 fa             	mov    %rdi,%rdx
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	0f b6 04 02          	movzbl (%rdx,%rax,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	74 08                	je     0x3a
  32:	3c 03                	cmp    $0x3,%al
  34:	0f 8e a3 08 00 00    	jle    0x8dd
  3a:	8b 85 98 00 00 00    	mov    0x98(%rbp),%eax