BUG: unable to handle page fault for address: ffffffffa002a0b0
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 6210067 P4D 6210067 PUD 6211063 PMD 107fbd067 PTE 8000000115e0a163
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 19892 Comm: syz-executor.2 Not tainted 5.10.117-syzkaller-00814-gfdd06dc6b0f8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0xffffffffa002a0b0
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
RSP: 0018:ffffc900062eef78 EFLAGS: 00010246
RAX: 1ffff9200000e606 RBX: ffff8881518de000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc90000073038 RDI: ffff8881518de000
RBP: ffffc900062ef060 R08: ffffffff83d03133 R09: ffffc900062eefc0
R10: fffff52000c5ddfb R11: 1ffff92000c5ddf8 R12: ffffc90000073030
R13: 1ffff9200000e600 R14: ffffc90000073038 R15: ffff8881518de000
FS: 00007f95a4917700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa002a0b0 CR3: 000000010cb39000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
run_bpf_filter net/core/sock_reuseport.c:236 [inline]
reuseport_select_sock+0x389/0x560 net/core/sock_reuseport.c:286
lookup_reuseport net/ipv4/udp.c:424 [inline]
udp4_lib_lookup2+0x3f0/0x620 net/ipv4/udp.c:447
__udp4_lib_lookup+0x3ca/0x690 net/ipv4/udp.c:525
__udp4_lib_lookup_skb+0x19d/0x240 net/ipv4/udp.c:541
__udp4_lib_rcv+0x1060/0x1c70 net/ipv4/udp.c:2402
udp_rcv+0x21/0x30 net/ipv4/udp.c:2575
ip_protocol_deliver_rcu+0x2ed/0x650 net/ipv4/ip_input.c:204
ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
NF_HOOK include/linux/netfilter.h:304 [inline]
ip_local_deliver+0x2f4/0x5b0 net/ipv4/ip_input.c:252
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
NF_HOOK include/linux/netfilter.h:304 [inline]
ip_rcv+0x191/0x320 net/ipv4/ip_input.c:539
__netif_receive_skb_one_core net/core/dev.c:5361 [inline]
__netif_receive_skb+0x1c5/0x500 net/core/dev.c:5475
netif_receive_skb_internal+0xa2/0x240 net/core/dev.c:5580
netif_receive_skb+0x1e/0x210 net/core/dev.c:5639
tun_rx_batched+0x774/0x910 include/linux/skbuff.h:4377
tun_get_user+0x217c/0x2b10 drivers/net/tun.c:1952
tun_chr_write_iter+0x1a6/0x250 drivers/net/tun.c:1985
call_write_iter include/linux/fs.h:1947 [inline]
new_sync_write fs/read_write.c:518 [inline]
vfs_write+0xc1c/0xf40 fs/read_write.c:605
ksys_write+0x198/0x2c0 fs/read_write.c:658
__do_sys_write fs/read_write.c:670 [inline]
__se_sys_write fs/read_write.c:667 [inline]
__x64_sys_write+0x7b/0x90 fs/read_write.c:667
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f95a5774c1f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48
RSP: 002b:00007f95a4917130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f95a58d5030 RCX: 00007f95a5774c1f
RDX: 000000000000002a RSI: 0000000020000200 RDI: 00000000000000c8
RBP: 00007f95a581c05d R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000002a R11: 0000000000000293 R12: 0000000000000000
R13: 00007fff12d4259f R14: 00007f95a4917300 R15: 0000000000022000
Modules linked in:
CR2: ffffffffa002a0b0
---[ end trace 4b9e12f293a8e807 ]---
RIP: 0010:0xffffffffa002a0b0
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
RSP: 0018:ffffc900062eef78 EFLAGS: 00010246
RAX: 1ffff9200000e606 RBX: ffff8881518de000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffc90000073038 RDI: ffff8881518de000
RBP: ffffc900062ef060 R08: ffffffff83d03133 R09: ffffc900062eefc0
R10: fffff52000c5ddfb R11: 1ffff92000c5ddf8 R12: ffffc90000073030
R13: 1ffff9200000e600 R14: ffffc90000073038 R15: ffff8881518de000
FS: 00007f95a4917700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa002a0b0 CR3: 000000010cb39000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: cc int3 <-- trapping instruction
2b: cc int3
2c: cc int3
2d: cc int3
2e: cc int3
2f: cc int3
30: cc int3
31: cc int3
32: cc int3
33: cc int3
34: cc int3
35: cc int3
36: cc int3
37: cc int3
38: cc int3
39: cc int3
3a: cc int3
3b: cc int3
3c: cc int3
3d: cc int3
3e: cc int3
3f: cc int3