[v6.1] WARNING in ip_rt_bug (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 347385861c50 Linux 6.1.84
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1243e49d180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6572e59ce99583c
dashboard link: https://syzkaller.appspot.com/bug?extid=1c652bfe0f25b6acc6cd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/101d17869fc3/disk-34738586.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1fd47dc155f3/vmlinux-34738586.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3a82e916ef21/Image-34738586.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1c652b...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 0 at net/ipv4/route.c:1261 kfree_skb include/linux/skbuff.h:1225 [inline]
WARNING: CPU: 1 PID: 0 at net/ipv4/route.c:1261 ip_rt_bug+0x30/0x100 net/ipv4/route.c:1260
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ip_rt_bug+0x30/0x100 include/linux/skbuff.h:1225
lr : kfree_skb include/linux/skbuff.h:1225 [inline]
lr : ip_rt_bug+0x30/0x100 net/ipv4/route.c:1260
sp : ffff800008017600
x29: ffff800008017600 x28: 1ffff00001002f00 x27: ffff0000c3c95c80
x26: dfff800000000000 x25: 1fffe00018792b9b x24: dfff800000000000
x23: ffff0000d8269100 x22: ffff0000d8269130 x21: ffff0000c4f81380
x20: ffff0000c3c95c80 x19: ffff0000c3c95c80 x18: ffff800008016fe0
x17: ffff8000188cc000 x16: ffff800008305ec4 x15: ffff800010caa030
x14: ffff800010b6a990 x13: ffff8000083fbe64 x12: 0000000000000003
x11: 0000000000ff0100 x10: 0000000000000003 x9 : 0000000000000080
x8 : 00000000000000c0 x7 : ffff80001048d574 x6 : ffff80001048e08c
x5 : ffff0000d1527268 x4 : ffff800008017310 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff8000122ac6e0 x0 : 0000000000000001
Call trace:
kfree_skb include/linux/skbuff.h:1225 [inline]
ip_rt_bug+0x30/0x100 net/ipv4/route.c:1260
dst_output include/net/dst.h:444 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
ip_send_skb+0x134/0x2f8 net/ipv4/ip_output.c:1596
ip_push_pending_frames+0x68/0x84 net/ipv4/ip_output.c:1616
icmp_push_reply+0x2e0/0x3c0 net/ipv4/icmp.c:386
__icmp_send+0xb84/0x104c net/ipv4/icmp.c:767
ipv4_send_dest_unreach net/ipv4/route.c:1241 [inline]
ipv4_link_failure+0x544/0x8c4 net/ipv4/route.c:1248
dst_link_failure include/net/dst.h:423 [inline]
arp_error_report+0x11c/0x16c net/ipv4/arp.c:296
neigh_invalidate+0x2c0/0x514 net/core/neighbour.c:1059
neigh_timer_handler+0x630/0xe88 net/core/neighbour.c:1146
call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x554/0x718 kernel/time/timer.c:1820
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1833
__do_softirq+0x314/0xe38 kernel/softirq.c:571
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:650
irq_exit_rcu+0x14/0x84 kernel/softirq.c:662
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xdc kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x1e0/0x514 kernel/sched/idle.c:303
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:401
secondary_start_kernel+0x19c/0x1c4 arch/arm64/kernel/smp.c:265
__secondary_switched+0xb0/0xb4 arch/arm64/kernel/head.S:618
irq event stamp: 207393
hardirqs last enabled at (207392): [<ffff8000089792f4>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:242
hardirqs last disabled at (207393): [<ffff800012151e8c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (207166): [<ffff800008020d7c>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (207166): [<ffff800008020d7c>] __do_softirq+0xc1c/0xe38 kernel/softirq.c:600
softirqs last disabled at (207281): [<ffff80000802a99c>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup