general protection fault in icmpv6_sk

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in icmpv6_sk_exit (2) net	syz	error	error	5	1019d	1144d	0/28	auto-obsoleted due to no activity on 2023/01/15 04:48
upstream	general protection fault in icmpv6_sk_exit net				1	1375d	1375d	0/28	auto-closed as invalid on 2021/05/18 21:13

general protection fault, probably for non-canonical address 0xdffffc0000000052: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000290-0x0000000000000297] CPU: 1 PID: 647 Comm: kworker/u4:4 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:icmpv6_sk_exit+0x116/0x200 net/ipv6/icmp.c:1019 Code: 80 3c 28 00 74 08 4c 89 e7 e8 d6 e4 71 fd 49 8b 1c 24 48 85 db 74 2d e8 88 de 37 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 ab e4 71 fd 48 8b 3b e8 d3 71 8a RSP: 0018:ffffc9000631fc18 EFLAGS: 00010202 RAX: 0000000000000052 RBX: 0000000000000291 RCX: ffff88811cbf2780 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc9000631fc50 R08: ffffffff84351c85 R09: 0000000000000003 R10: fffff52000c63f51 R11: 0000000000000004 R12: ffffe8ffffc41020 R13: dffffc0000000000 R14: ffff88811c1042c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffee4ad5fa8 CR3: 0000000146e45000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ops_exit_list net/core/net_namespace.c:187 [inline] cleanup_net+0x6d4/0xd60 net/core/net_namespace.c:608 process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2296 worker_thread+0xb15/0x1600 kernel/workqueue.c:2442 kthread+0x371/0x390 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 Modules linked in: ---[ end trace 602b86f2942ea538 ]--- RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:icmpv6_sk_exit+0x116/0x200 net/ipv6/icmp.c:1019 Code: 80 3c 28 00 74 08 4c 89 e7 e8 d6 e4 71 fd 49 8b 1c 24 48 85 db 74 2d e8 88 de 37 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 ab e4 71 fd 48 8b 3b e8 d3 71 8a RSP: 0018:ffffc9000631fc18 EFLAGS: 00010202 RAX: 0000000000000052 RBX: 0000000000000291 RCX: ffff88811cbf2780 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc9000631fc50 R08: ffffffff84351c85 R09: 0000000000000003 R10: fffff52000c63f51 R11: 0000000000000004 R12: ffffe8ffffc41020 R13: dffffc0000000000 R14: ffff88811c1042c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555557478b38 CR3: 000000010c4f3000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 4: 74 08 je 0xe 6: 4c 89 e7 mov %r12,%rdi 9: e8 d6 e4 71 fd callq 0xfd71e4e4 e: 49 8b 1c 24 mov (%r12),%rbx 12: 48 85 db test %rbx,%rbx 15: 74 2d je 0x44 17: e8 88 de 37 fd callq 0xfd37dea4 1c: 48 81 c3 88 02 00 00 add $0x288,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 ab e4 71 fd callq 0xfd71e4e4 39: 48 8b 3b mov (%rbx),%rdi 3c: e8 .byte 0xe8 3d: d3 71 8a shll %cl,-0x76(%rcx)