8<--- cut here ---
Unable to handle kernel paging request at virtual address df000000 when read
[df000000] *pgd=80000080007003, *pmd=00000000
Internal error: Oops: 206 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 12939 Comm: syz.1.2076 Not tainted 6.11.0-rc3-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at csum_partial+0x2c/0x130 arch/arm/lib/csumpartial.S:115
LR is at 0x0
pc : [<819250d4>] lr : [<00000000>] psr: 80000013
sp : dfbe5b80 ip : a6d00020 fp : dfbe5bbc
r10: 00000000 r9 : 85d0002b r8 : 85b3aed0
r7 : dfbe5c54 r6 : 00000000 r5 : 00000000 r4 : 00000000
r3 : 00000000 r2 : 4045475d r1 : ffffff97 r0 : defffff4
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
Control: 30c5387d Table: 85b71dc0 DAC: fffffffd
Register r0 information: non-slab/vmalloc memory
Register r1 information: non-paged memory
Register r2 information: non-paged memory
Register r3 information: NULL pointer
Register r4 information: NULL pointer
Register r5 information: NULL pointer
Register r6 information: NULL pointer
Register r7 information: 2-page vmalloc region starting at 0xdfbe4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r8 information: slab kmalloc-cg-2k start 85b3a800 pointer offset 1744 size 2048
Register r9 information: non-slab/vmalloc memory
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xdfbe4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r12 information: non-slab/vmalloc memory
Process syz.1.2076 (pid: 12939, stack limit = 0xdfbe4000)
Stack: (0xdfbe5b80 to 0xdfbe6000)
5b80: 85e550c0 85d00092 85d00092 81794f34 8145a7c8 81454280 85e550c0 85b3a800
5ba0: 00000000 00000040 0000dd7a 0000c117 dfbe5bfc dfbe5bc0 81798938 81794e20
5bc0: 00010020 85b3aeb8 00000000 83d80400 80c81afc 85e550c0 85b3a800 85b3aeb8
5be0: 85b75e40 00000040 00000000 dfbe5c54 dfbe5c94 dfbe5c00 80c85040 81798884
5c00: dfbe5c54 85b3aed0 00000000 00000040 00000000 0000dd7a 0000c117 00000000
5c20: dfbe5c74 dfbe5c30 00000070 85ce0000 85448d00 85448d00 00000000 0000dd7a
5c40: 85b3ae80 84c34000 00020000 85e550c0 dfbe5c94 00000000 00000000 00000000
5c60: aa1414ac d421191a 85e550c0 85e550c0 81b76968 85b3a800 857dbc00 00000000
5c80: 856f4600 00000000 dfbe5cdc dfbe5c98 8147a598 80c84498 dfbe5cdc dfbe5ca8
5ca0: dfbe5d00 824b9fce 82606000 00010010 85e550c0 85e550c0 824b9fcc 856f4600
5cc0: 85b3a800 dfbe5ce0 00000000 00000000 dfbe5d9c dfbe5ce0 8147aa80 8147a4c0
5ce0: dfbe5d90 00000000 0000007f 808060c4 20000013 ffffffff dfbe5d14 00003500
5d00: fffffff4 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5d20: 00000000 00000000 00000000 0000007f 0000007f 0000007f 00000000 d421191a
5d40: dfbe5d84 85e550c0 dfbe5e1c 00020000 dfbe5dbc dfbe5d60 8179df5c 81454538
5d60: dfbe5dbc dfbe5d70 8179d134 d421191a 00000000 85e550c0 8319d900 855b3000
5d80: 855b3000 85e550c0 dfbe5e98 85cfff00 dfbe5dbc dfbe5da0 8179a364 8147a8b8
5da0: 0001001a 8319d900 855b3000 855b3000 dfbe5e6c dfbe5dc0 8179f3b8 8179a2d4
5dc0: dfbe5e18 00000003 dfbe5dd4 00000000 dfbe5df4 00000002 dfbe5de4 00000000
5de0: 00000000 00000000 855b3000 00000000 00000000 00000000 00000070 85b3ab48
5e00: 85b3ab4c 00000000 0000000e 0000000a 85b3a800 00000000 00000000 ff91050b
5e20: ff89fff4 dfbe0006 00000000 00000000 00000000 00000000 806f3be4 d421191a
5e40: dfbe5e6c 00000000 dfbe5e98 8319d900 8319d900 00000003 857dbc00 00000122
5e60: dfbe5e8c dfbe5e70 8144860c 8179e3ec 00000000 00000000 20000140 8319d900
5e80: dfbe5f8c dfbe5e90 8144abd4 814485d4 00000000 00000001 dfbe5ee4 00000014
5ea0: 00000000 00000000 00010000 0001001a 20000180 00000000 00000001 00000000
5ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ee0: 8020c014 00000011 0000003d 06000001 00000000 00000000 00000000 00000000
5f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5f20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5f60: 00000000 d421191a 0014d2e0 20000140 00000014 002762fc 00000122 8020029c
5f80: dfbe5fa4 dfbe5f90 8144ac34 8144aad8 20000140 00000014 00000000 dfbe5fa8
5fa0: 80200060 8144ac24 20000140 00000014 00000003 20000180 0001001a 00000000
5fc0: 20000140 00000014 002762fc 00000122 00000000 00006364 003d0f00 76b360bc
5fe0: 76b35ec0 76b35eb0 000189a0 00132d80 60000010 00000003 00000000 00000000
Call trace:
[<81794e14>] (udp6_set_csum) from [<81798938>] (udp_tunnel6_xmit_skb+0xc0/0x2f0 net/ipv6/ip6_udp_tunnel.c:99)
r9:0000c117 r8:0000dd7a r7:00000040 r6:00000000 r5:85b3a800 r4:85e550c0
[<81798878>] (udp_tunnel6_xmit_skb) from [<80c85040>] (geneve6_xmit_skb drivers/net/geneve.c:1006 [inline])
[<81798878>] (udp_tunnel6_xmit_skb) from [<80c85040>] (geneve_xmit+0xbb4/0x1388 drivers/net/geneve.c:1036)
r10:dfbe5c54 r9:00000000 r8:00000040 r7:85b75e40 r6:85b3aeb8 r5:85b3a800
r4:85e550c0
[<80c8448c>] (geneve_xmit) from [<8147a598>] (__netdev_start_xmit include/linux/netdevice.h:4913 [inline])
[<80c8448c>] (geneve_xmit) from [<8147a598>] (netdev_start_xmit include/linux/netdevice.h:4922 [inline])
[<80c8448c>] (geneve_xmit) from [<8147a598>] (xmit_one net/core/dev.c:3580 [inline])
[<80c8448c>] (geneve_xmit) from [<8147a598>] (dev_hard_start_xmit+0xe4/0x2b4 net/core/dev.c:3596)
r10:00000000 r9:856f4600 r8:00000000 r7:857dbc00 r6:85b3a800 r5:81b76968
r4:85e550c0
[<8147a4b4>] (dev_hard_start_xmit) from [<8147aa80>] (__dev_queue_xmit+0x1d4/0xf0c net/core/dev.c:4423)
r10:00000000 r9:00000000 r8:dfbe5ce0 r7:85b3a800 r6:856f4600 r5:824b9fcc
r4:85e550c0
[<8147a8ac>] (__dev_queue_xmit) from [<8179a364>] (dev_queue_xmit include/linux/netdevice.h:3105 [inline])
[<8147a8ac>] (__dev_queue_xmit) from [<8179a364>] (packet_xmit net/packet/af_packet.c:276 [inline])
[<8147a8ac>] (__dev_queue_xmit) from [<8179a364>] (packet_xmit+0x9c/0x104 net/packet/af_packet.c:273)
r10:85cfff00 r9:dfbe5e98 r8:85e550c0 r7:855b3000 r6:855b3000 r5:8319d900
r4:85e550c0
[<8179a2c8>] (packet_xmit) from [<8179f3b8>] (packet_snd net/packet/af_packet.c:3145 [inline])
[<8179a2c8>] (packet_xmit) from [<8179f3b8>] (packet_sendmsg+0xfd8/0x1618 net/packet/af_packet.c:3177)
r7:855b3000 r6:855b3000 r5:8319d900 r4:0001001a
[<8179e3e0>] (packet_sendmsg) from [<8144860c>] (sock_sendmsg_nosec net/socket.c:730 [inline])
[<8179e3e0>] (packet_sendmsg) from [<8144860c>] (__sock_sendmsg+0x44/0x78 net/socket.c:745)
r10:00000122 r9:857dbc00 r8:00000003 r7:8319d900 r6:8319d900 r5:dfbe5e98
r4:00000000
[<814485c8>] (__sock_sendmsg) from [<8144abd4>] (__sys_sendto+0x108/0x14c net/socket.c:2204)
r7:8319d900 r6:20000140 r5:00000000 r4:00000000
[<8144aacc>] (__sys_sendto) from [<8144ac34>] (__do_sys_sendto net/socket.c:2216 [inline])
[<8144aacc>] (__sys_sendto) from [<8144ac34>] (sys_sendto+0x1c/0x24 net/socket.c:2212)
r8:8020029c r7:00000122 r6:002762fc r5:00000014 r4:20000140
[<8144ac18>] (sys_sendto) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xdfbe5fa8 to 0xdfbe5ff0)
5fa0: 20000140 00000014 00000003 20000180 0001001a 00000000
5fc0: 20000140 00000014 002762fc 00000122 00000000 00006364 003d0f00 76b360bc
5fe0: 76b35ec0 76b35eb0 000189a0 00132d80
Code: 1bffffee e3d1c01f 0a00000e e92d0030 (e8b04038)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 1bffffee blne 0xffffffc0
4: e3d1c01f bics ip, r1, #31
8: 0a00000e beq 0x48
c: e92d0030 push {r4, r5}
* 10: e8b04038 ldm r0!, {r3, r4, r5, lr} <-- trapping instruction