Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010c839000
[0000000000000008] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 2809 Comm: kworker/0:3 Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: mld mld_ifc_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : em_u32_match+0x64/0xd8 net/sched/em_u32.c:29
lr : em_u32_match+0x64/0xd8 net/sched/em_u32.c:23
sp : ffff80000ffb3250
x29: ffff80000ffb3250 x28: 0000000000000000 x27: 0000000000000000
x26: ffff80000ffb32a8 x25: ffff0000cbbfe180 x24: 0000000000000001
x23: ffff0000c9df181e x22: ffff0000c9df1800 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000ca551f00 x18: 00000000000000c0
x17: ffff80000dda8198 x16: ffff80000dbe6158 x15: ffff0000cb163480
x14: 0000000000000000 x13: 7fffffffffffffff x12: ffff0000cb163480
x11: ff8080000b40e694 x10: 0000000000000000 x9 : ffff80000b40e694
x8 : ffff0000cb163480 x7 : ffff80000b26471c x6 : 0000000000000000
x5 : ffff80000e0d7770 x4 : 0000000000000000 x3 : ffff80000ffb3458
x2 : 0000000000000000 x1 : ffff0000cbbfe180 x0 : ffff0000ca551f00
Call trace:
em_u32_match+0x64/0xd8 net/sched/em_u32.c:23
tcf_em_match net/sched/ematch.c:492 [inline]
__tcf_em_tree_match+0xb0/0x340 net/sched/ematch.c:518
tcf_em_tree_match include/net/pkt_cls.h:502 [inline]
basic_classify+0xa8/0x1d4 net/sched/cls_basic.c:48
__tcf_classify net/sched/cls_api.c:1567 [inline]
tcf_classify+0x11c/0x4ac net/sched/cls_api.c:1633
prio_classify net/sched/sch_prio.c:42 [inline]
prio_enqueue+0xd8/0x38c net/sched/sch_prio.c:75
dev_qdisc_enqueue net/core/dev.c:3785 [inline]
__dev_xmit_skb+0x1b8/0x928 net/core/dev.c:3874
__dev_queue_xmit+0x414/0xdb8 net/core/dev.c:4222
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_hh_output include/net/neighbour.h:530 [inline]
neigh_output include/net/neighbour.h:544 [inline]
ip_finish_output2+0x670/0x818 net/ipv4/ip_output.c:228
__ip_finish_output+0x108/0x29c
ip_finish_output+0x168/0x188 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0x1d4/0x234 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:445 [inline]
ip_local_out+0xc0/0xf0 net/ipv4/ip_output.c:126
iptunnel_xmit+0x194/0x314 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x108/0x140 net/ipv4/udp_tunnel_core.c:172
geneve_xmit_skb drivers/net/geneve.c:996 [inline]
geneve_xmit+0x16ac/0x1aac drivers/net/geneve.c:1108
__netdev_start_xmit include/linux/netdevice.h:4840 [inline]
netdev_start_xmit include/linux/netdevice.h:4854 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0xd4/0x1ec net/core/dev.c:3606
__dev_queue_xmit+0x83c/0xdb8 net/core/dev.c:4256
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_resolve_output+0x350/0x3bc net/core/neighbour.c:1571
neigh_output include/net/neighbour.h:546 [inline]
ip6_finish_output2+0x704/0xbec net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x448/0x4c4 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x180/0x2dc net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
mld_sendpack+0x514/0x924 net/ipv6/mcast.c:1820
mld_send_cr+0x4e8/0x5a8 net/ipv6/mcast.c:2121
mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653
process_one_work+0x2d8/0x504 kernel/workqueue.c:2289
worker_thread+0x340/0x610 kernel/workqueue.c:2436
kthread+0x12c/0x158 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
Code: 0a090149 8b29c117 14000002 973a60e5 (b9800aa8)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 0a090149 and w9, w10, w9
4: 8b29c117 add x23, x8, w9, sxtw
8: 14000002 b 0x10
c: 973a60e5 bl 0xfffffffffce983a0
* 10: b9800aa8 ldrsw x8, [x21, #8] <-- trapping instruction