Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 3 UID: 0 PID: 80 Comm: kworker/u32:4 Not tainted 6.16.0-rc1-syzkaller-00005-g488ef3560196 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:dst_dev_put+0x25/0x390 net/core/dst.c:146
Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 9c c1 5e f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 1c 03 00 00 48 8d 7b 3a 4c 8b 23 48 b8 00 00 00
RSP: 0018:ffffc900006f8d30 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000094 RCX: ffffffff8a010147
RDX: 0000000000000012 RSI: ffffffff895d5b14 RDI: 0000000000000094
RBP: 0000607e25d5ffe8 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff1be4c99
R13: dffffc0000000000 R14: 0000607e25d5ffe8 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d6a54000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feec542e2fe CR3: 000000003be1e000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 rt_fibinfo_free_cpus.part.0+0xe7/0x1c0 net/ipv4/fib_semantics.c:195
 rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:187 [inline]
 fib_nh_common_release+0x121/0x360 net/ipv4/fib_semantics.c:206
 fib_nh_release net/ipv4/fib_semantics.c:218 [inline]
 free_fib_info_rcu+0x1af/0x4e0 net/ipv4/fib_semantics.c:230
 rcu_do_batch kernel/rcu/tree.c:2576 [inline]
 rcu_core+0x79c/0x14e0 kernel/rcu/tree.c:2832
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 do_softirq kernel/softirq.c:480 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:467
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:407
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 cfg80211_inform_single_bss_data+0x9ae/0x1df0 net/wireless/scan.c:2383
 cfg80211_inform_bss_data+0x224/0x3bc0 net/wireless/scan.c:3222
 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3313
 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226
 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1905/0x2fd0 net/mac80211/ibss.c:1600
 ieee80211_iface_process_skb net/mac80211/iface.c:1668 [inline]
 ieee80211_iface_work+0xbf4/0x1020 net/mac80211/iface.c:1722
 cfg80211_wiphy_work+0x3df/0x550 net/wireless/core.c:435
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c5/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dst_dev_put+0x25/0x390 net/core/dst.c:146
Code: 90 90 90 90 90 f3 0f 1e fa 41 56 41 55 41 54 55 53 48 89 fb e8 9c c1 5e f8 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 1c 03 00 00 48 8d 7b 3a 4c 8b 23 48 b8 00 00 00
RSP: 0018:ffffc900006f8d30 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000094 RCX: ffffffff8a010147
RDX: 0000000000000012 RSI: ffffffff895d5b14 RDI: 0000000000000094
RBP: 0000607e25d5ffe8 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000000 R11: 0000000000000001 R12: fffffbfff1be4c99
R13: dffffc0000000000 R14: 0000607e25d5ffe8 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880d6a54000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007feec542e2fe CR3: 000000003be1e000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	f3 0f 1e fa          	endbr64
   9:	41 56                	push   %r14
   b:	41 55                	push   %r13
   d:	41 54                	push   %r12
   f:	55                   	push   %rbp
  10:	53                   	push   %rbx
  11:	48 89 fb             	mov    %rdi,%rbx
  14:	e8 9c c1 5e f8       	call   0xf85ec1b5
  19:	48 89 da             	mov    %rbx,%rdx
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 1c 03 00 00    	jne    0x350
  34:	48 8d 7b 3a          	lea    0x3a(%rbx),%rdi
  38:	4c 8b 23             	mov    (%rbx),%r12
  3b:	48                   	rex.W
  3c:	b8                   	.byte 0xb8
  3d:	00 00                	add    %al,(%rax)