BUG: unable to handle kernel NULL pointer dereference
sctp_copy_local_addr_list+0x499/0x690 net/sctp/protocol.c:180
at 0000000000000000
PGD 1cf037067
P4D 1cf037067
PUD 1b503f067
PMD 0
sctp_copy_one_addr+0x5d/0x170 net/sctp/bind_addr.c:449
Oops: 0010 [#1] SMP KASAN
CPU: 0 PID: 5636 Comm: syz-executor4 Not tainted 4.17.0+ #83
sctp_bind_addr_copy+0x16b/0x45b net/sctp/bind_addr.c:71
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010: (null)
Code:
Bad RIP value.
sctp_assoc_set_bind_addr_from_ep+0x165/0x1c0 net/sctp/associola.c:1585
RSP: 0018:ffff8801947b7590 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801ca2cc800 RCX: 1ffffffff10ea785
sctp_sendmsg_new_asoc+0x3c1/0x1120 net/sctp/socket.c:1744
RDX: ffff8801947b7ab0 RSI: ffff8801ceb97a40 RDI: ffff8801aa73e780
RBP: ffff8801947b7700 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff100328f6eb7
R13: ffff8801947b7ab0 R14: ffff8801ca2cc812 R15: ffff8801ca2ccc58
FS: 00007faf15285700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001d6f28000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
sctp_sendmsg+0x1888/0x1d70 net/sctp/socket.c:2097
inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798
sock_poll+0x1d1/0x710 net/socket.c:1156
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:643
vfs_poll+0x77/0x2a0 fs/select.c:40
___sys_sendmsg+0x525/0x940 net/socket.c:2149
do_pollfd fs/select.c:848 [inline]
do_poll fs/select.c:896 [inline]
do_sys_poll+0x6fd/0x1100 fs/select.c:990
__sys_sendmmsg+0x240/0x6f0 net/socket.c:2244
__do_sys_sendmmsg net/socket.c:2273 [inline]
__se_sys_sendmmsg net/socket.c:2270 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2270
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
__do_sys_poll fs/select.c:1048 [inline]
__se_sys_poll fs/select.c:1036 [inline]
__x64_sys_poll+0x189/0x510 fs/select.c:1036
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4559f9
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
Code:
1d
ba
fb
ff
c3
entry_SYSCALL_64_after_hwframe+0x49/0xbe
66 2e
RIP: 0033:0x4559f9
0f
Code:
1f
1d
84
ba
00
fb
00
ff
00
c3
00
66
00
2e
66
0f
90
1f
48
84
89
00
f8
00
48
00
89
00
f7
00
48
66
89
90
d6
48
48
89
89
f8
ca
48
4d
89
89
f7
c2
48
4d
89
89
d6
c8
48
4c
89
8b
ca
4c
4d
24
89
08
c2
0f
4d
05
89
<48>
c8
3d
4c
01
8b
f0
4c
ff
24 08
ff
0f
0f
05
83
<48>
eb
3d
b9
01
fb
f0
ff
ff
c3
ff
66
0f
2e
83
0f
eb
1f
b9
84
fb
00
ff
00
c3
00
66
00
2e
0f
RSP: 002b:00007efd33f28c68 EFLAGS: 00000246
1f
ORIG_RAX: 0000000000000133
84
RAX: ffffffffffffffda RBX: 00007efd33f296d4 RCX: 00000000004559f9
00
RDX: 0000000000000001 RSI: 0000000020006f00 RDI: 0000000000000013
00
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
00 00
R10: 0000000000040040 R11: 0000000000000246 R12: 0000000000000014
RSP: 002b:00007faf15284c68 EFLAGS: 00000246
R13: 00000000004c0959 R14: 00000000004d02e0 R15: 0000000000000040
ORIG_RAX: 0000000000000007
RAX: ffffffffffffffda RBX: 00007faf152856d4 RCX: 00000000004559f9
RDX: 0000000000000003 RSI: 2000000000000112 RDI: 0000000020000040
RBP: 000000000072c0b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004c047c R14: 00000000004cf968 R15: 0000000000000003
Modules linked in:
Dumping ftrace buffer:
(ftrace buffer empty)
CR2: 0000000000000000
---[ end trace ff18eee4e89cdc2a ]---
RIP: 0010: (null)
Code: Bad RIP value.
RSP: 0018:ffff8801947b7590 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801ca2cc800 RCX: 1ffffffff10ea785
RDX: ffff8801947b7ab0 RSI: ffff8801ceb97a40 RDI: ffff8801aa73e780
RBP: ffff8801947b7700 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff100328f6eb7
R13: ffff8801947b7ab0 R14: ffff8801ca2cc812 R15: ffff8801ca2ccc58
FS: 00007faf15285700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001d6f28000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400