BUG: stack guard page was hit in inet_stream_connect

Status: upstream: reported on 2026/10/08 05:26
Reported-by: syzbot+ab223458d638b5975d65@syzkaller.appspotmail.com
First crash: 6d13h, last: 6d13h
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: stack guard page was hit in inet_stream_connect prio:low net nfs -1 syz, C 29 1d05h 50d 0/29 upstream: reported C repro on 2026/08/24 19:47
upstream kernel panic: corrupted stack end in inet_stream_connect net 2 1 804d 804d 0/29 auto-obsoleted due to no activity on 2024/11/07 06:16

Sample crash report:
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48  max: 48!
48 locks held by syz.2.16045/5564:
 #0: ffff88814bc6a160 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
 #0: ffff88814bc6a160 (sk_lock-AF_INET6){+.+.}-{0:0}, at: inet_stream_connect+0x4d/0xa0 net/ipv4/af_inet.c:735
 #1: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #3: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #4: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #5: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #6: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #7: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #8: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #9: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #10: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #11: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #12: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #13: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #14: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #15: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #16: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #17: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #18: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #19: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #20: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #21: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #22: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #23: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #24: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #25: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #26: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #27: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #28: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #29: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #30: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #31: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #32: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #33: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #34: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #35: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #36: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #37: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #38: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #39: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #40: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #41: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #42: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #43: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #44: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #45: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
 #46: ffff8880b8f2a258 (hrtimer_bases.lock){-.-.}-{2:2}, at: hrtimer_interrupt+0xf7/0x8b0 kernel/time/hrtimer.c:1792
 #47: ffffffff8d131788 (tk_core.seq.seqcount){----}-{0:0}, at: ktime_get_update_offsets_now+0x44/0x3e0 kernel/time/timekeeping.c:2306
INFO: lockdep is turned off.
CPU: 1 PID: 5564 Comm: syz.2.16045 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 __lock_acquire+0x170f/0x7d40 kernel/locking/lockdep.c:-1
 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
 seqcount_lockdep_reader_access+0xcd/0x1d0 include/linux/seqlock.h:103
 ktime_get_update_offsets_now+0x44/0x3e0 kernel/time/timekeeping.c:2306
 hrtimer_update_base kernel/time/hrtimer.c:621 [inline]
 hrtimer_interrupt+0x121/0x8b0 kernel/time/hrtimer.c:1793
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 5f ce 86 f7 65 8b 05 e0 e4 36 76 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc9000338acc0 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 56d7ebb5f6c9f700
RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001
RBP: ffffc9000338ad50 R08: ffffffff9101518f R09: 1ffffffff2202a31
R10: dffffc0000000000 R11: fffffbfff2202a32 R12: dffffc0000000000
R13: ffff88806210e6c0 R14: ffffffff972cb4c8 R15: 1ffff92000671598
 __debug_check_no_obj_freed lib/debugobjects.c:999 [inline]
 debug_check_no_obj_freed+0x471/0x520 lib/debugobjects.c:1020
 slab_free_hook mm/slub.c:1685 [inline]
 slab_free_freelist_hook+0x8b/0x170 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kfree+0xef/0x2a0 mm/slub.c:4564
 rpl_do_srh_inline include/linux/skbuff.h:-1 [inline]
 rpl_do_srh+0x9c1/0xe50 net/ipv6/rpl_iptunnel.c:201
 rpl_output+0x178/0x730 net/ipv6/rpl_iptunnel.c:217
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 NF_HOOK include/linux/netfilter.h:302 [inline]
 ip6_xmit+0x1089/0x16e0 net/ipv6/ip6_output.c:340
 inet6_csk_xmit+0x405/0x680 net/ipv6/inet6_connection_sock.c:135
 dccp_transmit_skb+0xafb/0xf10 net/dccp/output.c:138
 dccp_connect+0x4e1/0x750 net/dccp/output.c:569
 dccp_v6_connect+0xbd8/0x1220 net/dccp/ipv6.c:965
 __inet_stream_connect+0x244/0xd80 net/ipv4/af_inet.c:672
 inet_stream_connect+0x62/0xa0 net/ipv4/af_inet.c:736
 __sys_connect_file net/socket.c:1933 [inline]
 __sys_connect+0x3cb/0x450 net/socket.c:1950
 __do_sys_connect net/socket.c:1960 [inline]
 __se_sys_connect net/socket.c:1957 [inline]
 __x64_sys_connect+0x76/0x80 net/socket.c:1957
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9dda0aa199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9dd8302028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f9dda331fa0 RCX: 00007f9dda0aa199
RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000003
RBP: 00007f9dda141888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9dda332038 R14: 00007f9dda331fa0 R15: 00007ffd81d6a138
 </TASK>
vkms_vblank_simulate: vblank timer overrun
BUG: TASK stack guard page was hit at ffffc90003387ff8 (stack is ffffc90003388000..ffffc90003390000)
stack guard page: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5564 Comm: syz.2.16045 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__unwind_start+0x0/0x650 arch/x86/kernel/unwind_orc.c:631
Code: 5f 5d c3 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 5d ff ff ff 4c 89 ff e8 0e 2c 89 00 e9 50 ff ff ff 66 0f 1f 84 00 00 00 00 00 <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 4c 24 08 49 89 d4
RSP: 0018:ffffc90003388000 EFLAGS: 00010246
RAX: ffff888057f31dc0 RBX: ffffc900033880c0 RCX: ffffc90003388090
RDX: 0000000000000000 RSI: ffff888057f31dc0 RDI: ffffc90003388008
RBP: ffffc90003388090 R08: ffffc900033881ff R09: ffffc90003388180
R10: dffffc0000000000 R11: fffff52000671040 R12: ffff888057f31dc0
R13: 1ffff1100afe6468 R14: ffffffff81679160 R15: 0000000000000000
FS:  00007f9dd83026c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003387ff8 CR3: 0000000074f99000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unwind_start arch/x86/include/asm/unwind.h:60 [inline]
 arch_stack_walk+0xda/0x140 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 save_stack+0x121/0x230 mm/page_owner.c:119
 __set_page_owner+0x41/0x2d0 mm/page_owner.c:181
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 __alloc_pages_node include/linux/gfp.h:570 [inline]
 alloc_pages_node include/linux/gfp.h:584 [inline]
 kmalloc_large_node+0x7d/0x1a0 mm/slub.c:4426
 __kmalloc_node_track_caller+0x219/0x3a0 mm/slub.c:4949
 kmalloc_reserve net/core/skbuff.c:356 [inline]
 pskb_expand_head+0x128/0x1100 net/core/skbuff.c:1714
 __skb_cow include/linux/skbuff.h:3406 [inline]
 skb_cow_head include/linux/skbuff.h:3440 [inline]
 rpl_do_srh_inline net/ipv6/rpl_iptunnel.c:157 [inline]
 rpl_do_srh+0x50a/0xe50 net/ipv6/rpl_iptunnel.c:201
 rpl_output+0x178/0x730 net/ipv6/rpl_iptunnel.c:217
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
 lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
 dst_output include/net/dst.h:452 [inline]
 NF_HOOK include/linux/netfilter.h:302 [inline]
 ip6_xmit+0x1089/0x16e0 net/ipv6/ip6_output.c:340
 inet6_csk_xmit+0x405/0x680 net/ipv6/inet6_connection_sock.c:135
 dccp_transmit_skb+0xafb/0xf10 net/dccp/output.c:138
 dccp_connect+0x4e1/0x750 net/dccp/output.c:569
 dccp_v6_connect+0xbd8/0x1220 net/dccp/ipv6.c:965
 __inet_stream_connect+0x244/0xd80 net/ipv4/af_inet.c:672
 inet_stream_connect+0x62/0xa0 net/ipv4/af_inet.c:736
 __sys_connect_file net/socket.c:1933 [inline]
 __sys_connect+0x3cb/0x450 net/socket.c:1950
 __do_sys_connect net/socket.c:1960 [inline]
 __se_sys_connect net/socket.c:1957 [inline]
 __x64_sys_connect+0x76/0x80 net/socket.c:1957
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9dda0aa199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9dd8302028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f9dda331fa0 RCX: 00007f9dda0aa199
RDX: 000000000000001c RSI: 0000200000000040 RDI: 0000000000000003
RBP: 00007f9dda141888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9dda332038 R14: 00007f9dda331fa0 R15: 00007ffd81d6a138
 </TASK>
Modules linked in:
---[ end trace 5346d3cb3fce8c5c ]---
RIP: 0010:__unwind_start+0x0/0x650 arch/x86/kernel/unwind_orc.c:631
Code: 5f 5d c3 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 5d ff ff ff 4c 89 ff e8 0e 2c 89 00 e9 50 ff ff ff 66 0f 1f 84 00 00 00 00 00 <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 4c 24 08 49 89 d4
RSP: 0018:ffffc90003388000 EFLAGS: 00010246
RAX: ffff888057f31dc0 RBX: ffffc900033880c0 RCX: ffffc90003388090
RDX: 0000000000000000 RSI: ffff888057f31dc0 RDI: ffffc90003388008
RBP: ffffc90003388090 R08: ffffc900033881ff R09: ffffc90003388180
R10: dffffc0000000000 R11: fffff52000671040 R12: ffff888057f31dc0
R13: 1ffff1100afe6468 R14: ffffffff81679160 R15: 0000000000000000
FS:  00007f9dd83026c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90003387ff8 CR3: 0000000074f99000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	c7 44 24 20 00 00 00 	movl   $0x0,0x20(%rsp)
   7:	00
   8:	9c                   	pushf
   9:	8f 44 24 20          	pop    0x20(%rsp)
   d:	f7 44 24 20 00 02 00 	testl  $0x200,0x20(%rsp)
  14:	00
  15:	41 c6 04 07 f8       	movb   $0xf8,(%r15,%rax,1)
  1a:	75 4b                	jne    0x67
  1c:	f7 c3 00 02 00 00    	test   $0x200,%ebx
  22:	74 01                	je     0x25
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 5f ce 86 f7       	call   0xf786ce8e <-- trapping instruction
  2f:	65 8b 05 e0 e4 36 76 	mov    %gs:0x7636e4e0(%rip),%eax        # 0x7636e516
  36:	85 c0                	test   %eax,%eax
  38:	74 3c                	je     0x76
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	04 24                	add    $0x24,%al
  3e:	0e                   	(bad)
  3f:	36                   	ss

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/08 05:25 linux-5.15.y a051a4bf909f 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan BUG: stack guard page was hit in inet_stream_connect
* Struck through repros no longer work on HEAD.