WARNING in ip_rt_bug

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: dda0e292 Linux 4.19.114
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1790482be00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f32ac7e5b2d5c341
dashboard link: https://syzkaller.appspot.com/bug?extid=a3147d7c24d82b894fc2
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14083e0be00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13edec43e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+a3147d...@syzkaller.appspotmail.com

syz-executor852 uses obsolete (PF_INET,SOCK_PACKET)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6458 at net/ipv4/route.c:1236 ip_rt_bug+0x1d/0x30 net/ipv4/route.c:1236
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 6458 Comm: syz-executor852 Not tainted 4.19.114-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x188/0x20d lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x46 kernel/panic.c:541
report_bug+0x262/0x2a0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:ip_rt_bug+0x1d/0x30 net/ipv4/route.c:1236
Code: a5 fb e9 63 ff ff ff 66 0f 1f 44 00 00 55 48 89 d5 e8 47 e0 6f fb 48 89 ef e8 df 4b a0 ff 48 c7 c7 40 af 11 88 e8 7c fd 5a fb <0f> 0b 31 c0 5d c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 49
RSP: 0018:ffff8880a6667330 EFLAGS: 00010282
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8152d3a1 RDI: ffffed1014ccce58
RBP: ffff88809f0b1a00 R08: 0000000000000024 R09: ffffed1015ce5079
R10: ffffed1015ce5078 R11: ffff8880ae7283c7 R12: ffff88809e0b4100
R13: ffff88809f0b1a00 R14: ffff8880a623a600 R15: ffff88809f0b1a58
dst_output include/net/dst.h:447 [inline]
ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:124
ip_send_skb+0x3e/0xe0 net/ipv4/ip_output.c:1446
ip_push_pending_frames+0x5f/0x80 net/ipv4/ip_output.c:1466
icmp_push_reply+0x3b8/0x530 net/ipv4/icmp.c:395
__icmp_send+0xcb6/0x14a0 net/ipv4/icmp.c:744
icmp_send include/net/icmp.h:47 [inline]
ip_options_compile+0xad/0xf0 net/ipv4/ip_options.c:485
ip_rcv_options net/ipv4/ip_input.c:282 [inline]
ip_rcv_finish_core.isra.0+0x67f/0x1a90 net/ipv4/ip_input.c:356
ip_rcv_finish+0x142/0x2e0 net/ipv4/ip_input.c:412
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_rcv+0xd0/0x3d0 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0xf5/0x160 net/core/dev.c:4947
__netif_receive_skb+0x27/0x1c0 net/core/dev.c:5059
netif_receive_skb_internal+0xf9/0x400 net/core/dev.c:5149
tun_rx_batched.isra.0+0x483/0x7d0 drivers/net/tun.c:1535
tun_get_user+0x1359/0x4930 drivers/net/tun.c:1960
tun_chr_write_iter+0xb0/0x147 drivers/net/tun.c:1989
call_write_iter include/linux/fs.h:1821 [inline]
new_sync_write fs/read_write.c:474 [inline]
__vfs_write+0x512/0x760 fs/read_write.c:487
vfs_write+0x206/0x550 fs/read_write.c:549
ksys_write+0x12b/0x2a0 fs/read_write.c:599
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440699
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc6bd7ff98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440699
RDX: 000000000000100c RSI: 0000000020000240 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000002c00 R09: 00007ffc0000000d
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401f20
R13: 0000000000401fb0 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches