Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 1 UID: 0 PID: 32518 Comm: syz.6.6428 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:dst_dev_put+0x27/0x2b0 net/core/dst.c:147 Code: 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 90 35 45 f8 49 89 dd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 48 89 df e8 39 8e b0 f8 4c 8b 33 48 8d 7b RSP: 0018:ffffc90000a08d18 EFLAGS: 00010207 RAX: ffffffff89808120 RBX: 0000000000000094 RCX: ffff888035e60000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000094 RBP: 1ffffffff1c4d7d6 R08: ffff888029080653 R09: 1ffff110052100ca R10: dffffc0000000000 R11: ffffed10052100cb R12: dffffc0000000000 R13: 0000000000000012 R14: 0000607eda99e908 R15: 0000000000000001 FS: 00007fd3c36d76c0(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3e1ffea540 CR3: 00000000aab10000 CR4: 00000000003526f0 Call Trace: rt_fibinfo_free_cpus net/ipv4/fib_semantics.c:195 [inline] fib_nh_common_release+0x1ed/0x420 net/ipv4/fib_semantics.c:206 fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__nla_put+0xb/0xd0 lib/nlattr.c:1037 Code: cb 73 43 fd e9 5b ff ff ff 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 <41> 54 53 48 89 cb 41 89 d6 41 89 f4 49 89 ff 49 bd 00 00 00 00 00 RSP: 0018:ffffc900052fe678 EFLAGS: 00000287 RAX: ffffffff84ed9e7f RBX: dffffc0000000000 RCX: ffffc900052fe790 RDX: 0000000000000002 RSI: 0000000000000045 RDI: ffff888035dc0500 RBP: 0000000000000045 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed10053d941f R12: 0000000000000dcc R13: 0000000000000008 R14: 0000000000000002 R15: ffff888035dc0500 nla_put+0xd0/0x150 lib/nlattr.c:1099 nla_put_u16 include/net/netlink.h:1407 [inline] rtnl_fill_ifinfo+0x1c60/0x2770 net/core/rtnetlink.c:2144 rtmsg_ifinfo_build_skb+0x17d/0x260 net/core/rtnetlink.c:4525 rtmsg_ifinfo_event net/core/rtnetlink.c:4558 [inline] rtmsg_ifinfo+0x8c/0x1a0 net/core/rtnetlink.c:4567 __dev_notify_flags+0xf2/0x310 net/core/dev.c:9786 netif_change_flags+0xe8/0x1a0 net/core/dev.c:9819 do_setlink+0xfa5/0x45a0 net/core/rtnetlink.c:3207 rtnl_group_changelink net/core/rtnetlink.c:3855 [inline] __rtnl_newlink net/core/rtnetlink.c:4023 [inline] rtnl_newlink+0x14ca/0x1bb0 net/core/rtnetlink.c:4151 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:7068 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x75c/0x8e0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd3c279ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd3c36d7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fd3c2a15fa0 RCX: 00007fd3c279ce59 RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 RBP: 00007fd3c2832d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fd3c2a16038 R14: 00007fd3c2a15fa0 R15: 00007fff49079108 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dst_dev_put+0x27/0x2b0 net/core/dst.c:147 Code: 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 89 fb 49 bc 00 00 00 00 00 fc ff df e8 90 35 45 f8 49 89 dd 49 c1 ed 03 <43> 80 7c 25 00 00 74 08 48 89 df e8 39 8e b0 f8 4c 8b 33 48 8d 7b RSP: 0018:ffffc90000a08d18 EFLAGS: 00010207 RAX: ffffffff89808120 RBX: 0000000000000094 RCX: ffff888035e60000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000094 RBP: 1ffffffff1c4d7d6 R08: ffff888029080653 R09: 1ffff110052100ca R10: dffffc0000000000 R11: ffffed10052100cb R12: dffffc0000000000 R13: 0000000000000012 R14: 0000607eda99e908 R15: 0000000000000001 FS: 00007fd3c36d76c0(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3e1ffea540 CR3: 00000000aab10000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: f3 0f 1e fa endbr64 7: 55 push %rbp 8: 41 57 push %r15 a: 41 56 push %r14 c: 41 55 push %r13 e: 41 54 push %r12 10: 53 push %rbx 11: 48 89 fb mov %rdi,%rbx 14: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 1b: fc ff df 1e: e8 90 35 45 f8 call 0xf84535b3 23: 49 89 dd mov %rbx,%r13 26: 49 c1 ed 03 shr $0x3,%r13 * 2a: 43 80 7c 25 00 00 cmpb $0x0,0x0(%r13,%r12,1) <-- trapping instruction 30: 74 08 je 0x3a 32: 48 89 df mov %rbx,%rdi 35: e8 39 8e b0 f8 call 0xf8b08e73 3a: 4c 8b 33 mov (%rbx),%r14 3d: 48 rex.W 3e: 8d .byte 0x8d 3f: 7b .byte 0x7b