GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 UID: 0 PID: 3566 Comm: kworker/u8:11 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:llc_conn_state_process+0xd09/0x1360 net/llc/llc_conn.c:-1
Code: 4c 89 f7 e8 89 b9 93 f8 31 c0 84 db 0f 94 c0 4d 8b 36 8d 5c 00 01 b8 01 00 00 00 bd 07 00 00 00 0f 44 e8 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 0e 06 00 00 41 89 1e 43 0f b6 04 2c 84
RSP: 0018:ffffc90000a08bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888033383d00 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000007 R08: ffff888033383d00 R09: 0000000000000005
R10: 0000000000000005 R11: 0000000000000100 R12: 1ffff1100425b202
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880212d9012
FS: 0000000000000000(0000) GS:ffff888125560000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561d48865a38 CR3: 000000000e54c000 CR4: 00000000003526f0
Call Trace:
llc_process_tmr_ev net/llc/llc_c_ac.c:1448 [inline]
llc_conn_tmr_common_cb+0x34a/0x790 net/llc/llc_c_ac.c:1331
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:395 [inline]
batadv_tt_local_purge+0x2a7/0x340 net/batman-adv/translation-table.c:1315
batadv_tt_purge+0x35/0x9e0 net/batman-adv/translation-table.c:3509
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:llc_conn_state_process+0xd09/0x1360 net/llc/llc_conn.c:-1
Code: 4c 89 f7 e8 89 b9 93 f8 31 c0 84 db 0f 94 c0 4d 8b 36 8d 5c 00 01 b8 01 00 00 00 bd 07 00 00 00 0f 44 e8 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 0e 06 00 00 41 89 1e 43 0f b6 04 2c 84
RSP: 0018:ffffc90000a08bd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000100
RDX: ffff888033383d00 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000007 R08: ffff888033383d00 R09: 0000000000000005
R10: 0000000000000005 R11: 0000000000000100 R12: 1ffff1100425b202
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880212d9012
FS: 0000000000000000(0000) GS:ffff888125560000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000561d48865a38 CR3: 000000000e54c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 4c 89 f7 mov %r14,%rdi
3: e8 89 b9 93 f8 call 0xf893b991
8: 31 c0 xor %eax,%eax
a: 84 db test %bl,%bl
c: 0f 94 c0 sete %al
f: 4d 8b 36 mov (%r14),%r14
12: 8d 5c 00 01 lea 0x1(%rax,%rax,1),%ebx
16: b8 01 00 00 00 mov $0x1,%eax
1b: bd 07 00 00 00 mov $0x7,%ebp
20: 0f 44 e8 cmove %eax,%ebp
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 0e 06 00 00 jne 0x645
37: 41 89 1e mov %ebx,(%r14)
3a: 43 0f b6 04 2c movzbl (%r12,%r13,1),%eax
3f: 84 .byte 0x84