veth0_vlan: left promiscuous mode 8<--- cut here --- Unable to handle kernel paging request at virtual address 6c5f6674 when read [6c5f6674] *pgd=80000080005003, *pmd=00000000 Internal error: Oops: 206 [#1] SMP ARM Modules linked in: CPU: 1 UID: 0 PID: 15099 Comm: kworker/u8:0 Not tainted 6.15.0-syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Workqueue: netns cleanup_net PC is at __rb_change_child include/linux/rbtree_augmented.h:199 [inline] PC is at __rb_erase_augmented include/linux/rbtree_augmented.h:242 [inline] PC is at rb_erase+0x270/0x394 lib/rbtree.c:443 LR is at 0x0 pc : [<81a442c0>] lr : [<00000000>] psr: 20010013 sp : dfe09d80 ip : 6c5f666c fp : dfe09d94 r10: 850f1b00 r9 : 829d1204 r8 : 00000004 r7 : 8619b000 r6 : 00000001 r5 : 8619bc48 r4 : 8619bc00 r3 : 6c5f666e r2 : 00000000 r1 : 8619b034 r0 : 8619bc68 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 30c5387d Table: 846cb440 DAC: 00000000 Register r0 information: slab kmalloc-128 start 8619bc00 pointer offset 104 size 128 Register r1 information: slab kmalloc-128 start 8619b000 pointer offset 52 size 128 Register r2 information: NULL pointer Register r3 information: non-paged memory Register r4 information: slab kmalloc-128 start 8619bc00 pointer offset 0 size 128 Register r5 information: slab kmalloc-128 start 8619bc00 pointer offset 72 size 128 Register r6 information: non-paged memory Register r7 information: slab kmalloc-128 start 8619b000 pointer offset 0 size 128 Register r8 information: non-paged memory Register r9 information: non-slab/vmalloc memory Register r10 information: slab net_namespace start 850f1b00 pointer offset 0 size 3456 Register r11 information: 2-page vmalloc region starting at 0xdfe08000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2859 Register r12 information: non-paged memory Process kworker/u8:0 (pid: 15099, stack limit = 0xdfe08000) Stack: (0xdfe09d80 to 0xdfe0a000) 9d80: 8619bc00 8619bc48 dfe09dd4 dfe09d98 8060b7c4 81a4405c 0000000c 60010013 9da0: ddde099c 60010013 00000000 e61b2138 848f6e00 8543bc00 848f6e00 00000001 9dc0: 8619bc00 0000000b dfe09e14 dfe09dd8 8060b7f8 8060b700 20010013 830e73c0 9de0: 000094b8 82ac9268 848f6e00 e61b2138 dfe09e14 8543bc00 848f6e00 829dddfc 9e00: dfe09e90 829d1204 dfe09e2c dfe09e18 8060b8c8 8060b700 85204380 848f6e00 9e20: dfe09e3c dfe09e30 81985104 8060b8ac dfe09e54 dfe09e40 816701d8 81985100 9e40: 85204380 dfe09e90 dfe09e74 dfe09e58 8153dee4 816701c8 829dddfc 82c1e7c0 9e60: 829d11c0 dfe09e90 dfe09ed4 dfe09e78 81540370 8153deb0 81a6048c 80294814 9e80: 82c1e7c0 829d11c0 808cb0c0 8153df0c 852043a0 852043a0 00000100 00000122 9ea0: 00000000 e61b2138 81c01f84 85152280 829d11d8 8301bc00 8300e600 832e8c00 9ec0: 8301bc15 8300f070 dfe09f2c dfe09ed8 8027eb9c 815400cc 81c01a40 832e8c00 9ee0: dfe09f14 dfe09ef0 829d11dc 829d11d8 829d11dc 829d11d8 dfe09f2c 00000000 9f00: 8027a4d8 85152280 8300e620 8300e600 82804d40 851522ac 832e8c00 61c88647 9f20: dfe09f6c dfe09f30 8027f7e4 8027e9f4 81a6048c 80294814 dfe09f6c dfe09f48 9f40: 8028632c 00000001 832e8c00 85122180 ed3a1e60 8027f5e8 85152280 00000000 9f60: dfe09fac dfe09f70 80286810 8027f5f4 8026c664 81a60414 832e8c00 e61b2138 9f80: dfe09fac 84828440 802866e4 00000000 00000000 00000000 00000000 00000000 9fa0: 00000000 dfe09fb0 80200114 802866f0 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 Call trace: [<81a44050>] (rb_erase) from [<8060b7c4>] (erase_entry fs/proc/proc_sysctl.c:189 [inline]) [<81a44050>] (rb_erase) from [<8060b7c4>] (erase_header fs/proc/proc_sysctl.c:225 [inline]) [<81a44050>] (rb_erase) from [<8060b7c4>] (start_unregistering fs/proc/proc_sysctl.c:322 [inline]) [<81a44050>] (rb_erase) from [<8060b7c4>] (drop_sysctl_table+0xd0/0x1ac fs/proc/proc_sysctl.c:1514) r5:8619bc48 r4:8619bc00 [<8060b6f4>] (drop_sysctl_table) from [<8060b7f8>] (drop_sysctl_table+0x104/0x1ac fs/proc/proc_sysctl.c:1521) r8:0000000b r7:8619bc00 r6:00000001 r5:848f6e00 r4:8543bc00 [<8060b6f4>] (drop_sysctl_table) from [<8060b8c8>] (unregister_sysctl_table fs/proc/proc_sysctl.c:1539 [inline]) [<8060b6f4>] (drop_sysctl_table) from [<8060b8c8>] (unregister_sysctl_table+0x28/0x38 fs/proc/proc_sysctl.c:1531) r8:829d1204 r7:dfe09e90 r6:829dddfc r5:848f6e00 r4:8543bc00 [<8060b8a0>] (unregister_sysctl_table) from [<81985104>] (unregister_net_sysctl_table+0x10/0x14 net/sysctl_net.c:177) r5:848f6e00 r4:85204380 [<819850f4>] (unregister_net_sysctl_table) from [<816701d8>] (netfilter_log_sysctl_exit net/netfilter/nf_log.c:519 [inline]) [<819850f4>] (unregister_net_sysctl_table) from [<816701d8>] (nf_log_net_exit+0x1c/0x5c net/netfilter/nf_log.c:560) [<816701bc>] (nf_log_net_exit) from [<8153dee4>] (ops_exit_list+0x40/0x68 net/core/net_namespace.c:172) r5:dfe09e90 r4:85204380 [<8153dea4>] (ops_exit_list) from [<81540370>] (cleanup_net+0x2b0/0x49c net/core/net_namespace.c:654) r7:dfe09e90 r6:829d11c0 r5:82c1e7c0 r4:829dddfc [<815400c0>] (cleanup_net) from [<8027eb9c>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3238) r10:8300f070 r9:8301bc15 r8:832e8c00 r7:8300e600 r6:8301bc00 r5:829d11d8 r4:85152280 [<8027e9e8>] (process_one_work) from [<8027f7e4>] (process_scheduled_works kernel/workqueue.c:3319 [inline]) [<8027e9e8>] (process_one_work) from [<8027f7e4>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3400) r10:61c88647 r9:832e8c00 r8:851522ac r7:82804d40 r6:8300e600 r5:8300e620 r4:85152280 [<8027f5e8>] (worker_thread) from [<80286810>] (kthread+0x12c/0x280 kernel/kthread.c:464) r10:00000000 r9:85152280 r8:8027f5e8 r7:ed3a1e60 r6:85122180 r5:832e8c00 r4:00000001 [<802866e4>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdfe09fb0 to 0xdfe09ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802866e4 r4:84828440 Code: e5903000 e3530003 9a00001b e3c3c003 (e59c2008) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e5903000 ldr r3, [r0] 4: e3530003 cmp r3, #3 8: 9a00001b bls 0x7c c: e3c3c003 bic ip, r3, #3 * 10: e59c2008 ldr r2, [ip, #8] <-- trapping instruction