==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 [inline]
BUG: KASAN: null-ptr-deref in __rcuref_put include/linux/rcuref.h:109 [inline]
BUG: KASAN: null-ptr-deref in rcuref_put+0x16c/0x210 include/linux/rcuref.h:173
Write of size 4 at addr 000000000000003f by task syz.1.784/8745

CPU: 1 UID: 0 PID: 8745 Comm: syz.1.784 Not tainted 6.16.0-syzkaller-06600-g1dbf1d590d10 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 [inline]
 __rcuref_put include/linux/rcuref.h:109 [inline]
 rcuref_put+0x16c/0x210 include/linux/rcuref.h:173
 dst_release+0x24/0x1b0 net/core/dst.c:167
 ip_rt_put include/net/route.h:285 [inline]
 pptp_xmit+0x14b/0x1a90 drivers/net/ppp/pptp.c:267
 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2286 [inline]
 ppp_input+0x27c/0x9f0 drivers/net/ppp/ppp_generic.c:2310
 pppoe_rcv_core+0xc4/0x2b0 drivers/net/ppp/pppoe.c:376
 sk_backlog_rcv include/net/sock.h:1148 [inline]
 __release_sock+0x249/0x350 net/core/sock.c:3194
 release_sock+0x5f/0x1f0 net/core/sock.c:3748
 pppoe_sendmsg+0x137/0x790 drivers/net/ppp/pppoe.c:904
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:729
 ____sys_sendmsg+0x52d/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
 __sys_sendmmsg+0x227/0x430 net/socket.c:2757
 __do_sys_sendmmsg net/socket.c:2784 [inline]
 __se_sys_sendmmsg net/socket.c:2781 [inline]
 __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2781
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76e0f8eb69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f76e1d6c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f76e11b5fa0 RCX: 00007f76e0f8eb69
RDX: 0000000000000001 RSI: 0000200000000a00 RDI: 0000000000000007
RBP: 00007f76e1011df1 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000240080cb R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f76e11b5fa0 R15: 00007ffed4cc3fa8
 </TASK>
==================================================================