rds_connect_path_complete: Cannot transition to state UP, current state is 0
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: krdsd rds_tcp_accept_worker
RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 net/rds/tcp_listen.c:319
Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 2e 46 f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00
RSP: 0018:ffffc90000127960 EFLAGS: 00010202
RAX: 1ffff1100f966e63 RBX: 0000000000000012 RCX: 0000000000000046
RDX: 0000000000000004 RSI: ffffffff8e151a72 RDI: ffff88801daa5ac0
RBP: ffffc90000127ad8 R08: ffffffff90109177 R09: 1ffffffff202122e
R10: dffffc0000000000 R11: fffffbfff202122f R12: ffff888056f70000
R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff92000024f34
FS:  0000000000000000(0000) GS:ffff8881255ae000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000008038 CR3: 000000005def8000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rds_tcp_accept_worker+0x1d/0x70 net/rds/tcp.c:524
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rds_tcp_accept_one+0xa5b/0xd70 net/rds/tcp_listen.c:319
Code: 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 33 2e 46 f7 48 8b 1b 48 83 c3 12 49 89 de 49 c1 ee 03 <43> 0f b6 04 2e 84 c0 0f 85 53 02 00 00 44 0f b6 2b bf 08 00 00 00
RSP: 0018:ffffc90000127960 EFLAGS: 00010202
RAX: 1ffff1100f966e63 RBX: 0000000000000012 RCX: 0000000000000046
RDX: 0000000000000004 RSI: ffffffff8e151a72 RDI: ffff88801daa5ac0
RBP: ffffc90000127ad8 R08: ffffffff90109177 R09: 1ffffffff202122e
R10: dffffc0000000000 R11: fffffbfff202122f R12: ffff888056f70000
R13: dffffc0000000000 R14: 0000000000000002 R15: 1ffff92000024f34
FS:  0000000000000000(0000) GS:ffff8881255ae000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000015038 CR3: 000000005defa000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	48 83 c3 18          	add    $0x18,%rbx
   6:	48 89 d8             	mov    %rbx,%rax
   9:	48 c1 e8 03          	shr    $0x3,%rax
   d:	42 80 3c 28 00       	cmpb   $0x0,(%rax,%r13,1)
  12:	74 08                	je     0x1c
  14:	48 89 df             	mov    %rbx,%rdi
  17:	e8 33 2e 46 f7       	call   0xf7462e4f
  1c:	48 8b 1b             	mov    (%rbx),%rbx
  1f:	48 83 c3 12          	add    $0x12,%rbx
  23:	49 89 de             	mov    %rbx,%r14
  26:	49 c1 ee 03          	shr    $0x3,%r14
* 2a:	43 0f b6 04 2e       	movzbl (%r14,%r13,1),%eax <-- trapping instruction
  2f:	84 c0                	test   %al,%al
  31:	0f 85 53 02 00 00    	jne    0x28a
  37:	44 0f b6 2b          	movzbl (%rbx),%r13d
  3b:	bf 08 00 00 00       	mov    $0x8,%edi