Oops: general protection fault, probably for non-canonical address 0xdffffc010000017f: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: probably user-memory-access in range [0x0000000800000bf8-0x0000000800000bff]
CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events nsim_fib_event_work
RIP: 0010:fib_get_table+0x62/0xd0
Code: 80 07 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 2e 67 b2 f7 89 db 48 c1 e3 03 49 03 1e 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 0f 67 b2 f7 48 8b 1b 48 85 db 74
RSP: 0018:ffffc900001b7538 EFLAGS: 00010202
RAX: 000000010000017f RBX: 0000000800000bf8 RCX: ffff88801cad4880
RDX: ffff88801cad4880 RSI: 00000000000000ff RDI: 0000000000000000
RBP: 00000000000000ff R08: ffffffff8a768d27 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: 0000000000000020 R14: ffff888044410780 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599dcf64098 CR3: 0000000039cb6000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fib_find_matching_alias net/ipv4/fib_trie.c:1019 [inline]
fib_alias_hw_flags_set+0x173/0xb90 net/ipv4/fib_trie.c:1047
nsim_fib_event drivers/net/netdevsim/fib.c:884 [inline]
nsim_fib_event_work+0xd37/0x3f00 drivers/net/netdevsim/fib.c:1493
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:fib_get_table+0x62/0xd0
Code: 80 07 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 2e 67 b2 f7 89 db 48 c1 e3 03 49 03 1e 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 0f 67 b2 f7 48 8b 1b 48 85 db 74
RSP: 0018:ffffc900001b7538 EFLAGS: 00010202
RAX: 000000010000017f RBX: 0000000800000bf8 RCX: ffff88801cad4880
RDX: ffff88801cad4880 RSI: 00000000000000ff RDI: 0000000000000000
RBP: 00000000000000ff R08: ffffffff8a768d27 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: 0000000000000020 R14: ffff888044410780 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599dcf64098 CR3: 0000000011cde000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 80 07 00 addb $0x0,(%rdi)
3: 00 4c 89 f0 add %cl,-0x10(%rcx,%rcx,4)
7: 48 c1 e8 03 shr $0x3,%rax
b: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
10: 74 08 je 0x1a
12: 4c 89 f7 mov %r14,%rdi
15: e8 2e 67 b2 f7 call 0xf7b26748
1a: 89 db mov %ebx,%ebx
1c: 48 c1 e3 03 shl $0x3,%rbx
20: 49 03 1e add (%r14),%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 0f 67 b2 f7 call 0xf7b26748
39: 48 8b 1b mov (%rbx),%rbx
3c: 48 85 db test %rbx,%rbx
3f: 74 .byte 0x74