syzbot
assert "!ISSET(rt->rt_flags, RTF_LOCAL)" failed in nd6.c (4)
Status:
upstream: reported on 2026/07/22 08:14
Reported-by: syzbot+7b7e690f0ba72ecb65c5@syzkaller.appspotmail.com
First crash: 58d, last: 28d
Sample crash report:
panic: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/main/kernel/sys/netinet6/nd6.c", line 704
Stopped at db_enter+0x25: addq $0x8,%rsp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83489e59) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff834c5b67,ffffffff834d1153,2c0,ffffffff834c7451) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff5000cb01e68,ffff8000015f7000,0) at nd6_free+0x2ad
nd6_purge(ffff8000015f7000) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015f7000) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015f7000) at if_detach+0x333 sys/net/if.c:1314
tun_clone_destroy(ffff8000015f7000) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80003c8e2d90) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003c8e2e50) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff5006bae0cf8,7,fffff50007ffd340,ffff80002ccaa560) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff5006eff7530,ffff80002ccaa560) at fdrop+0x121 sys/kern/kern_descrip.c:1281
end trace frame: 0xffff80003c8e2fd0, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: kernel diagnostic assertion "!ISSET(rt->rt_flags, RTF_LOCAL)" failed: file "/syzkaller/managers/main/kernel/sys/netinet6/nd6.c", line 704
ddb> show kasan
No such command
ddb> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83489e59) at panic+0x1cf sys/kern/subr_prf.c:198
__assert(ffffffff834c5b67,ffffffff834d1153,2c0,ffffffff834c7451) at __assert+0x29 sys/kern/subr_prf.c:-1
nd6_free(fffff5000cb01e68,ffff8000015f7000,0) at nd6_free+0x2ad
nd6_purge(ffff8000015f7000) at nd6_purge+0x16b sys/netinet6/nd6.c:521
in6_ifdetach(ffff8000015f7000) at in6_ifdetach+0x106 sys/netinet6/in6_ifattach.c:426
if_detach(ffff8000015f7000) at if_detach+0x333 sys/net/if.c:1314
tun_clone_destroy(ffff8000015f7000) at tun_clone_destroy+0x2a2 sys/net/if_tun.c:343
if_clone_destroy(ffff80003c8e2d90) at if_clone_destroy+0x1d5 sys/net/if.c:1479
tun_dev_close(5d05,7) at tun_dev_close+0x1d9 sys/net/if_tun.c:526
spec_close(ffff80003c8e2e50) at spec_close+0x417 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffff5006bae0cf8,7,fffff50007ffd340,ffff80002ccaa560) at VOP_CLOSE+0x129 sys/kern/vfs_vops.c:156
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffff5006eff7530,ffff80002ccaa560) at vn_closefile+0x11d sys/kern/vfs_vnops.c:621
fdrop(fffff5006eff7530,ffff80002ccaa560) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffff5006eff7530,ffff80002ccaa560) at closef+0x190 sys/kern/kern_descrip.c:1265
fdfree(ffff80002ccaa560) at fdfree+0x115 sys/kern/kern_descrip.c:1196
exit1(ffff80002ccaa560,43,0,1) at exit1+0x595 sys/kern/kern_exit.c:215
sys_exit(ffff80002ccaa560,ffff80003c8e31b0,ffff80003c8e3100) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c8e31b0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8e31b0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7844f650a160, count: -20
ddb>
* Struck through repros no longer work on HEAD.