Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:fib6_nh_get_excptn_bucket net/ipv6/route.c:1673 [inline]
RIP: 0010:rt6_find_cached_rt net/ipv6/route.c:1871 [inline]
RIP: 0010:ip6_pol_route+0x2e7/0x13d0 net/ipv6/route.c:2289
Code: e8 de 02 73 f7 85 db 4d 0f 44 f7 48 8d 5c 24 38 4c 8b 64 24 70 49 83 c4 60 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 e7 e8 ab 06 dd f7 4d 8b 3c 24 e8 62 4e 59
RSP: 0018:ffffc90000007460 EFLAGS: 00010206
RAX: 000000000000000c RBX: ffffc90000007498 RCX: dffffc0000000000
RDX: ffffffff8e494ec0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007570 R08: ffff888033885133 R09: 1ffff11006710a26
R10: dffffc0000000000 R11: ffffed1006710a27 R12: 0000000000000060
R13: ffffc900000079a8 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88812546f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000057eff8 CR3: 000000005a4b4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x36b/0x730 net/ipv6/fib6_rules.c:125
ip6_route_output_flags_noref net/ipv6/route.c:2697 [inline]
ip6_route_output_flags+0x364/0x5d0 net/ipv6/route.c:2709
ip6_dst_lookup_tail+0x2ae/0x15a0 net/ipv6/ip6_output.c:1156
ip6_dst_lookup_flow+0x47/0xe0 net/ipv6/ip6_output.c:1259
tipc_udp_xmit+0x360/0xc10 net/tipc/udp_media.c:210
tipc_udp_send_msg+0x27f/0x3f0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2b3/0x400 net/tipc/bearer.c:575
tipc_disc_timeout+0x595/0x6f0 net/tipc/discover.c:338
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:63
Code: 7e 6e 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 8d 1d 00 fb f4 7c ea 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8e407dc0 EFLAGS: 00000246
RAX: 00000000020c15bd RBX: ffffffff819a779d RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8deed5ed RDI: ffffffff8c279800
RBP: ffffffff8e407eb0 R08: ffff8880b863395b R09: 1ffff110170c672b
R10: dffffc0000000000 R11: ffffed10170c672c R12: ffffffff90114db0
R13: 1ffffffff1c929d8 R14: 0000000000000000 R15: 0000000000000000
arch_safe_halt arch/x86/kernel/process.c:766 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:767
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x1bd/0x500 kernel/sched/idle.c:332
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:430
rest_init+0x2de/0x300 init/main.c:760
start_kernel+0x385/0x3d0 init/main.c:1210
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x147
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fib6_nh_get_excptn_bucket net/ipv6/route.c:1673 [inline]
RIP: 0010:rt6_find_cached_rt net/ipv6/route.c:1871 [inline]
RIP: 0010:ip6_pol_route+0x2e7/0x13d0 net/ipv6/route.c:2289
Code: e8 de 02 73 f7 85 db 4d 0f 44 f7 48 8d 5c 24 38 4c 8b 64 24 70 49 83 c4 60 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 e7 e8 ab 06 dd f7 4d 8b 3c 24 e8 62 4e 59
RSP: 0018:ffffc90000007460 EFLAGS: 00010206
RAX: 000000000000000c RBX: ffffc90000007498 RCX: dffffc0000000000
RDX: ffffffff8e494ec0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007570 R08: ffff888033885133 R09: 1ffff11006710a26
R10: dffffc0000000000 R11: ffffed1006710a27 R12: 0000000000000060
R13: ffffc900000079a8 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88812546f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000057eff8 CR3: 000000005a4b4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: e8 de 02 73 f7 call 0xf77302e3
5: 85 db test %ebx,%ebx
7: 4d 0f 44 f7 cmove %r15,%r14
b: 48 8d 5c 24 38 lea 0x38(%rsp),%rbx
10: 4c 8b 64 24 70 mov 0x70(%rsp),%r12
15: 49 83 c4 60 add $0x60,%r12
19: 4c 89 e0 mov %r12,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 e7 mov %r12,%rdi
33: e8 ab 06 dd f7 call 0xf7dd06e3
38: 4d 8b 3c 24 mov (%r12),%r15
3c: e8 .byte 0xe8
3d: 62 .byte 0x62
3e: 4e 59 rex.WRX pop %rcx