general protection fault, probably for non-canonical address 0xe0001c0000000007: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x0001000000000038-0x000100000000003f]
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dst_dev_put+0x9b/0x2b0 net/core/dst.c:157
Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 02 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 f6 01 00 00 48 8b 6d 38 48 85 ed 74 12 e8 ad 48
RSP: 0018:ffffc90000d97c38 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880b5684e00 RCX: 0000000000000100
RDX: 0000200000000007 RSI: ffffffff8721c1de RDI: 0001000000000038
RBP: 0001000000000000 R08: 0000000000000000 R09: ffff88807e4845ab
R10: ffffffff87b4e890 R11: 0000000000086089 R12: 0000000000000000
R13: 0000607f4606caa0 R14: ffffffff8d6e7664 R15: ffff8880b5684e00
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeebbf1c88 CR3: 000000007af24000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rt_fibinfo_free_cpus.part.0+0xf5/0x180 net/ipv4/fib_semantics.c:202
 rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:194 [inline]
 fib_nh_common_release+0x10c/0x330 net/ipv4/fib_semantics.c:213
 fib_nh_release net/ipv4/fib_semantics.c:225 [inline]
 free_fib_info_rcu+0x24b/0x4e0 net/ipv4/fib_semantics.c:237
 rcu_do_batch kernel/rcu/tree.c:2508 [inline]
 rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2743
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:920 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:912
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Modules linked in:
---[ end trace 401a18a4ba66d688 ]---
RIP: 0010:dst_dev_put+0x9b/0x2b0 net/core/dst.c:157
Code: fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 02 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 08 48 8d 7d 38 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 f6 01 00 00 48 8b 6d 38 48 85 ed 74 12 e8 ad 48
RSP: 0018:ffffc90000d97c38 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880b5684e00 RCX: 0000000000000100
RDX: 0000200000000007 RSI: ffffffff8721c1de RDI: 0001000000000038
RBP: 0001000000000000 R08: 0000000000000000 R09: ffff88807e4845ab
R10: ffffffff87b4e890 R11: 0000000000086089 R12: 0000000000000000
R13: 0000607f4606caa0 R14: ffffffff8d6e7664 R15: ffff8880b5684e00
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffeebbf1c88 CR3: 000000007af24000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
   0:	48 c1 ea 03          	shr    $0x3,%rdx
   4:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   8:	0f 85 02 02 00 00    	jne    0x210
   e:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  15:	fc ff df
  18:	48 8b 6b 08          	mov    0x8(%rbx),%rbp
  1c:	48 8d 7d 38          	lea    0x38(%rbp),%rdi
  20:	48 89 fa             	mov    %rdi,%rdx
  23:	48 c1 ea 03          	shr    $0x3,%rdx
* 27:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2b:	0f 85 f6 01 00 00    	jne    0x227
  31:	48 8b 6d 38          	mov    0x38(%rbp),%rbp
  35:	48 85 ed             	test   %rbp,%rbp
  38:	74 12                	je     0x4c
  3a:	e8                   	.byte 0xe8
  3b:	ad                   	lods   %ds:(%rsi),%eax
  3c:	48                   	rex.W