team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
Oops: general protection fault, probably for non-canonical address 0xdffffc001fffe000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: probably user-memory-access in range [0x00000000ffff0000-0x00000000ffff0007]
CPU: 0 UID: 0 PID: 9047 Comm: kworker/u8:24 Not tainted 6.14.0-rc7-syzkaller-00183-g70facbf978ac #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: netns cleanup_net
RIP: 0010:ip6_mc_clear_src+0x11b/0x4e0 net/ipv6/mcast.c:2599
Code: ff ff ff e8 77 46 5b 01 89 c5 31 ff 89 c6 e8 1c 3a 14 f7 85 ed 74 43 e8 d3 35 14 f7 eb 05 e8 cc 35 14 f7 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 46 75 7b f7 48 8b 2b 48 8d 7b 30
RSP: 0018:ffffc900030373e0 EFLAGS: 00010206
RAX: 000000001fffe000 RBX: 00000000ffff0000 RCX: ffff88801f39da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff8aadaaa4 R09: 1ffffffff2079f2e
R10: dffffc0000000000 R11: fffffbfff2079f2f R12: ffff88807cd0c010
R13: dffffc0000000000 R14: 1ffff1100f9a1802 R15: 0000000000000538
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555575083808 CR3: 00000000616d4000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
mld_clear_delrec+0x11c/0x600 net/ipv6/mcast.c:826
ipv6_mc_destroy_dev+0x46/0x580 net/ipv6/mcast.c:2842
addrconf_ifdown+0x1619/0x1b00 net/ipv6/addrconf.c:3992
addrconf_notify+0x3cb/0x1020 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2244 [inline]
call_netdevice_notifiers net/core/dev.c:2258 [inline]
unregister_netdevice_many_notify+0x102f/0x1f10 net/core/dev.c:11887
unregister_netdevice_many net/core/dev.c:11951 [inline]
default_device_exit_batch+0x7ff/0x880 net/core/dev.c:12434
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x8ad/0xd60 net/core/net_namespace.c:652
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd30 kernel/workqueue.c:3400
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip6_mc_clear_src+0x11b/0x4e0 net/ipv6/mcast.c:2599
Code: ff ff ff e8 77 46 5b 01 89 c5 31 ff 89 c6 e8 1c 3a 14 f7 85 ed 74 43 e8 d3 35 14 f7 eb 05 e8 cc 35 14 f7 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 46 75 7b f7 48 8b 2b 48 8d 7b 30
RSP: 0018:ffffc900030373e0 EFLAGS: 00010206
RAX: 000000001fffe000 RBX: 00000000ffff0000 RCX: ffff88801f39da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff8aadaaa4 R09: 1ffffffff2079f2e
R10: dffffc0000000000 R11: fffffbfff2079f2f R12: ffff88807cd0c010
R13: dffffc0000000000 R14: 1ffff1100f9a1802 R15: 0000000000000538
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005654957a3f50 CR3: 0000000032ca0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 3 bytes skipped:
0: e8 77 46 5b 01 call 0x15b467c
5: 89 c5 mov %eax,%ebp
7: 31 ff xor %edi,%edi
9: 89 c6 mov %eax,%esi
b: e8 1c 3a 14 f7 call 0xf7143a2c
10: 85 ed test %ebp,%ebp
12: 74 43 je 0x57
14: e8 d3 35 14 f7 call 0xf71435ec
19: eb 05 jmp 0x20
1b: e8 cc 35 14 f7 call 0xf71435ec
20: 48 89 d8 mov %rbx,%rax
23: 48 c1 e8 03 shr $0x3,%rax
* 27: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction
2c: 74 08 je 0x36
2e: 48 89 df mov %rbx,%rdi
31: e8 46 75 7b f7 call 0xf77b757c
36: 48 8b 2b mov (%rbx),%rbp
39: 48 8d 7b 30 lea 0x30(%rbx),%rdi