general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 5.18.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: wg-crypt-wg1 wg_packet_decrypt_worker

RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1396 [inline]
RIP: 0010:ip6_pol_route+0x741/0x1560 net/ipv6/route.c:2251
Code: e8 24 70 6e fd 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 b3 b6 2f fd 4d 85 f6 0f 84 a7 00 00 00 49 8d 5e 78 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 42 0b 00 00 44 8b 3b 31 ff 44 89 fe e8 d6
RSP: 0018:ffffc9000017ff80 EFLAGS: 00010206

RAX: 000000000000000f RBX: 0000000000000079 RCX: 0000000080000301
RDX: ffff88810026d3c0 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000180118 R08: ffffffff8440c64d R09: ffff88811268a000
R10: ffffc9000017ff00 R11: 1ffff9200003000e R12: ffff8881213dd880
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc90000180070
FS:  0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d3cffbff8 CR3: 00000001248ca000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ip6_pol_route_input+0x54/0x80 net/ipv6/route.c:2275
 pol_lookup_func include/net/ip6_fib.h:582 [inline]
 fib6_rule_lookup+0x259/0x600 net/ipv6/fib6_rules.c:116
 ip6_route_input_lookup net/ipv6/route.c:2287 [inline]
 ip6_route_input+0x732/0xbd0 net/ipv6/route.c:2583
 ip6_rcv_finish_core net/ipv6/ip6_input.c:63 [inline]
 ip6_list_rcv_finish net/ipv6/ip6_input.c:127 [inline]
 ip6_sublist_rcv+0x6c5/0xf70 net/ipv6/ip6_input.c:307
 ipv6_list_rcv+0x443/0x490 net/ipv6/ip6_input.c:342
 __netif_receive_skb_list_ptype net/core/dev.c:5448 [inline]
 __netif_receive_skb_list_core+0x71e/0x930 net/core/dev.c:5496
 __netif_receive_skb_list+0x4b1/0x580 net/core/dev.c:5548
 netif_receive_skb_list_internal+0x4cb/0x790 net/core/dev.c:5639
 gro_normal_list include/net/gro.h:430 [inline]
 napi_complete_done+0x33f/0x780 net/core/dev.c:5980
 wg_packet_rx_poll+0x1bd8/0x1c60 drivers/net/wireguard/receive.c:495
 __napi_poll+0xc7/0x5d0 net/core/dev.c:6413
 napi_poll net/core/dev.c:6480 [inline]
 net_rx_action+0x4a9/0xc70 net/core/dev.c:6567
 __do_softirq+0x24e/0x586 kernel/softirq.c:558
 do_softirq+0x14b/0x1c0 kernel/softirq.c:459
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:383
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x50/0x60 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:394 [inline]
 ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
 wg_packet_decrypt_worker+0xd2e/0xdc0 drivers/net/wireguard/receive.c:506
 process_one_work+0x6cb/0xbf0 kernel/workqueue.c:2289
 worker_thread+0xb3c/0x1390 kernel/workqueue.c:2436
 kthread+0x26b/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1396 [inline]
RIP: 0010:ip6_pol_route+0x741/0x1560 net/ipv6/route.c:2251
Code: e8 24 70 6e fd 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 b3 b6 2f fd 4d 85 f6 0f 84 a7 00 00 00 49 8d 5e 78 48 89 d8 48 c1 e8 03 <42> 8a 04 28 84 c0 0f 85 42 0b 00 00 44 8b 3b 31 ff 44 89 fe e8 d6
RSP: 0018:ffffc9000017ff80 EFLAGS: 00010206

RAX: 000000000000000f RBX: 0000000000000079 RCX: 0000000080000301
RDX: ffff88810026d3c0 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000180118 R08: ffffffff8440c64d R09: ffff88811268a000
R10: ffffc9000017ff00 R11: 1ffff9200003000e R12: ffff8881213dd880
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc90000180070
FS:  0000000000000000(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d3cffbff8 CR3: 000000000600f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	e8 24 70 6e fd       	callq  0xfd6e7029
   5:	48 8b 03             	mov    (%rbx),%rax
   8:	65 4c 8b 30          	mov    %gs:(%rax),%r14
   c:	31 ff                	xor    %edi,%edi
   e:	4c 89 f6             	mov    %r14,%rsi
  11:	e8 b3 b6 2f fd       	callq  0xfd2fb6c9
  16:	4d 85 f6             	test   %r14,%r14
  19:	0f 84 a7 00 00 00    	je     0xc6
  1f:	49 8d 5e 78          	lea    0x78(%r14),%rbx
  23:	48 89 d8             	mov    %rbx,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 8a 04 28          	mov    (%rax,%r13,1),%al <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 42 0b 00 00    	jne    0xb78
  36:	44 8b 3b             	mov    (%rbx),%r15d
  39:	31 ff                	xor    %edi,%edi
  3b:	44 89 fe             	mov    %r15d,%esi
  3e:	e8                   	.byte 0xe8
  3f:	d6                   	(bad)