Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 0 UID: 0 PID: 8812 Comm: syz.5.1016 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:fib6_nh_get_excptn_bucket+0x11f/0x1e0 net/ipv6/route.c:1662
Code: 05 50 a4 52 06 01 e8 e0 6c 56 f7 e9 2e ff ff ff e8 46 83 7a f7 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 48 8b 5b 60 e8 ae 35 53 01 31 ff 89
RSP: 0018:ffffc90000006b88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a417753
RDX: 000000000000000c RSI: ffffffff8a410b8a RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: fffff52000000d9f R14: 1ffff92000000da0 R15: dffffc0000000000
FS: 0000555588879500(0000) GS:ffff8880d66b5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555576bd7808 CR3: 0000000038caf000 CR4: 0000000000352ef0
Call Trace:
rt6_find_cached_rt+0x151/0x280 net/ipv6/route.c:1860
ip6_pol_route+0x238/0x1230 net/ipv6/route.c:2276
pol_lookup_func include/net/ip6_fib.h:617 [inline]
__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]
fib6_rule_action+0x283/0x910 net/ipv6/fib6_rules.c:275
fib_rules_lookup+0x459/0x1030 net/core/fib_rules.c:339
fib6_rule_lookup+0x18b/0x720 net/ipv6/fib6_rules.c:112
ip6_route_output_flags_noref net/ipv6/route.c:2684 [inline]
ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2696
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_dst_lookup_tail.constprop.0+0xa52/0x2140 net/ipv6/ip6_output.c:1131
ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1262
udp_tunnel6_dst_lookup+0x2cd/0x4b0 net/ipv6/ip6_udp_tunnel.c:165
geneve6_xmit_skb drivers/net/geneve.c:958 [inline]
geneve_xmit+0x96e/0x5620 drivers/net/geneve.c:1045
__netdev_start_xmit include/linux/netdevice.h:5222 [inline]
netdev_start_xmit include/linux/netdevice.h:5231 [inline]
xmit_one net/core/dev.c:3839 [inline]
dev_hard_start_xmit+0x94/0x740 net/core/dev.c:3855
__dev_queue_xmit+0xa46/0x4490 net/core/dev.c:4725
dev_queue_xmit include/linux/netdevice.h:3361 [inline]
neigh_resolve_output net/core/neighbour.c:1595 [inline]
neigh_resolve_output+0x53a/0x940 net/core/neighbour.c:1575
neigh_output include/net/neighbour.h:547 [inline]
ip6_finish_output2+0xaee/0x2020 net/ipv6/ip6_output.c:141
__ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:215
ip6_finish_output net/ipv6/ip6_output.c:226 [inline]
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x1ca/0x3e0 net/ipv6/ip6_output.c:248
dst_output include/net/dst.h:461 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xa66/0x1e30 net/ipv6/ndisc.c:512
ndisc_send_rs+0x129/0x670 net/ipv6/ndisc.c:722
addrconf_rs_timer+0x40d/0x840 net/ipv6/addrconf.c:4037
call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 8a ce 00 f6 48 89 df e8 72 22 01 f6 e8 fd 81 2c f6 fb bf 01 00 00 00 52 1f f1 f5 65 8b 05 2b bc 3f 08 85 c0 74 06 5b e9 11 4d 00 00
RSP: 0018:ffffc90003b97cd8 EFLAGS: 00000202
RAX: 00000000000365ef RBX: ffff88802c7b40c0 RCX: ffffffff81c374ef
RDX: 0000000000000000 RSI: ffffffff8de522d0 RDI: 0000000000000001
RBP: ffff88802c7b42c0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90ab6b97 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000011 R14: 0000000000000200 R15: ffff88802c7b40c0
spin_unlock_irq include/linux/spinlock.h:401 [inline]
get_signal+0x1e6c/0x26d0 kernel/signal.c:3037
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4493c14a5
Code: 24 0c 89 3c 24 48 89 4c 24 18 e8 f6 54 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 8b 74 24 0c 8b 3c 24 b8 e6 00 00 00 0f 05 <44> 89 c7 48 89 04 24 e8 4f 55 ff ff 48 8b 04 24 48 83 c4 28 f7 d8
RSP: 002b:00007ffda1cb59d0 EFLAGS: 00000293
RAX: fffffffffffffffc RBX: 00007ff4495c5fa0 RCX: 00007ff4493c14a5
RDX: 00007ffda1cb5a10 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ff4495c7da0 R08: 0000000000000000 R09: 00007ff44a270000
R10: 0000000000000000 R11: 0000000000000293 R12: 000000000001b622
R13: 00007ffda1cb5b30 R14: ffffffffffffffff R15: 00007ffda1cb5b50
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fib6_nh_get_excptn_bucket+0x11f/0x1e0 net/ipv6/route.c:1662
Code: 05 50 a4 52 06 01 e8 e0 6c 56 f7 e9 2e ff ff ff e8 46 83 7a f7 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 48 8b 5b 60 e8 ae 35 53 01 31 ff 89
RSP: 0018:ffffc90000006b88 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff8a417753
RDX: 000000000000000c RSI: ffffffff8a410b8a RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: fffff52000000d9f R14: 1ffff92000000da0 R15: dffffc0000000000
FS: 0000555588879500(0000) GS:ffff8880d66b5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555576bd7808 CR3: 0000000038caf000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 6 bytes skipped:
0: e8 e0 6c 56 f7 call 0xf7566ce5
5: e9 2e ff ff ff jmp 0xffffff38
a: e8 46 83 7a f7 call 0xf77a8355
f: 48 8d 7b 60 lea 0x60(%rbx),%rdi
13: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1a: fc ff df
1d: 48 89 fa mov %rdi,%rdx
20: 48 c1 ea 03 shr $0x3,%rdx
* 24: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
28: 0f 85 a7 00 00 00 jne 0xd5
2e: 48 8b 5b 60 mov 0x60(%rbx),%rbx
32: e8 ae 35 53 01 call 0x15335e5
37: 31 ff xor %edi,%edi
39: 89 .byte 0x89