Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 5821 Comm: syz.1.17 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 RSP: 0018:ffffc90005b36620 EFLAGS: 00010003 RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 RBP: ffffc90005b36818 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e R10: dffffc0000000000 R11: ffffffff8199feb0 R12: ffff8880b863c658 R13: ffff888125a6b000 R14: 1ffff110170c7922 R15: 0000000000000014 FS: 00007f3d5ba3d6c0(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc0c0d556b8 CR3: 0000000040c3a000 CR4: 00000000003526f0 Call Trace: preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7552 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline] irqentry_exit+0x14f/0x8c0 kernel/entry/common.c:167 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:681 RIP: 0010:trim_netdev_trace+0x61c/0x840 net/core/dev.c:13433 Code: 24 08 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 ef e8 ad 29 1c f9 48 8b 44 24 08 4a 8b 1c f0 <48> 89 df 4c 89 fe e8 59 54 b0 f8 4c 39 fb 74 20 4c 89 e0 44 39 f0 RSP: 0018:ffffc90005b36940 EFLAGS: 00000246 RAX: ffffc90005b36a80 RBX: ffffffff89a373f6 RCX: dffffc0000000000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 RBP: ffffc90005b36a10 R08: 0000000000000000 R09: 0000000000000100 R10: ffffc90005b36980 R11: fffff52000b66d34 R12: 0000000000000013 R13: ffffc90005b36ab8 R14: 0000000000000007 R15: ffffffff818849de save_dst_trace_buffer+0x114/0x5b0 net/core/dst.c:103 dst_release+0x28/0x1b0 net/core/dst.c:250 refdst_drop include/net/dst.h:286 [inline] skb_dst_drop include/net/dst.h:298 [inline] skb_release_head_state+0x71/0x360 net/core/skbuff.c:1165 skb_release_all net/core/skbuff.c:1189 [inline] __kfree_skb+0x24/0x210 net/core/skbuff.c:1205 kfree_skb_reason include/linux/skbuff.h:1323 [inline] kfree_skb include/linux/skbuff.h:1332 [inline] l2tp_ip_recv+0x88d/0xcb0 net/l2tp/l2tp_ip.c:210 ip_protocol_deliver_rcu+0x2e0/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6205 [inline] __netif_receive_skb net/core/dev.c:6318 [inline] process_backlog+0x569/0xc60 net/core/dev.c:6669 __napi_poll+0xab/0x550 net/core/dev.c:7728 napi_poll net/core/dev.c:7791 [inline] net_rx_action+0x696/0xe00 net/core/dev.c:7948 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] __local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:914 [inline] __dev_queue_xmit+0x1eaf/0x3900 net/core/dev.c:4908 dev_queue_xmit include/linux/netdevice.h:3442 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xcab/0x10b0 net/ipv4/ip_output.c:236 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:437 __ip_queue_xmit+0x116a/0x1bb0 net/ipv4/ip_output.c:533 l2tp_ip_sendmsg+0x668/0x1620 net/l2tp/l2tp_ip.c:520 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:785 __sock_sendmsg net/socket.c:800 [inline] ____sys_sendmsg+0x55c/0x870 net/socket.c:2702 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2756 __sys_sendmmsg+0x279/0x4d0 net/socket.c:2845 __do_sys_sendmmsg net/socket.c:2872 [inline] __se_sys_sendmmsg net/socket.c:2869 [inline] __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2869 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3d5d80ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3d5ba3d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f3d5da86090 RCX: 00007f3d5d80ce59 RDX: 00000000040000cf RSI: 0000200000000900 RDI: 0000000000000003 RBP: 00007f3d5d8a2e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3d5da86128 R14: 00007f3d5da86090 R15: 00007ffc9d295e48 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:task_cpu include/linux/sched.h:2268 [inline] RIP: 0010:is_task_rq_idle kernel/sched/core.c:6169 [inline] RIP: 0010:cookie_equals kernel/sched/core.c:6174 [inline] RIP: 0010:pick_next_task kernel/sched/core.c:6355 [inline] RIP: 0010:__schedule+0x4030/0x5550 kernel/sched/core.c:7143 Code: 24 80 00 00 00 e8 80 97 f2 f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 RSP: 0018:ffffc90005b36620 EFLAGS: 00010003 RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 RBP: ffffc90005b36818 R08: ffffffff8fcf38f7 R09: 1ffffffff1f9e71e R10: dffffc0000000000 R11: ffffffff8199feb0 R12: ffff8880b863c658 R13: ffff888125a6b000 R14: 1ffff110170c7922 R15: 0000000000000014 FS: 00007f3d5ba3d6c0(0000) GS:ffff888125a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc0c0d556b8 CR3: 0000000040c3a000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 24 80 and $0x80,%al 2: 00 00 add %al,(%rax) 4: 00 e8 add %ch,%al 6: 80 97 f2 f6 48 8b 84 adcb $0x84,-0x74b7090e(%rdi) d: 24 80 and $0x80,%al f: 00 00 add %al,(%rax) 11: 00 48 8b add %cl,-0x75(%rax) 14: 18 4c 8d 7b sbb %cl,0x7b(%rbp,%rcx,4) 18: 14 4c adc $0x4c,%al 1a: 89 f8 mov %edi,%eax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx 27: fc ff df * 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction 2e: 84 c0 test %al,%al 30: 0f 85 87 04 00 00 jne 0x4bd 36: 45 8b 3f mov (%r15),%r15d 39: 49 83 ff 08 cmp $0x8,%r15 3d: 0f .byte 0xf 3e: 83 .byte 0x83 3f: 98 cwtl