Unable to handle kernel write to read-only memory at virtual address ffff7fffe2c40000
KASAN: probably wild-memory-access in range [0xffffffff16200000-0xffffffff16200007]
Mem abort info:
ESR = 0x000000009600004f
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x0f: level 3 permission fault
Data abort info:
ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000047334000
[ffff7fffe2c40000] pgd=0000000000000000, p4d=10000000ba0d5403, pud=10000000492a3403, pmd=00000000492a2003, pte=00600000492a6783
Internal error: Oops: 000000009600004f [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 9427 Comm: syz.7.1920 Not tainted syzkaller #0 PREEMPT
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ll_sc__cmpxchg_case_mb_64 arch/arm64/include/asm/atomic_ll_sc.h:293 [inline]
pc : __cmpxchg_case_mb_64 arch/arm64/include/asm/cmpxchg.h:129 [inline]
pc : __cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:171 [inline]
pc : rt_cache_route+0x130/0x190 net/ipv4/route.c:1506
lr : instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
lr : rt_cache_route+0x94/0x190 net/ipv4/route.c:1506
sp : ffff8000a11b75c0
x29: ffff8000a11b75c0 x28: ffff000057cb7664 x27: ffff0000160a0d08
x26: 0000000000000001 x25: 00000000656c6966 x24: 0000000000000000
x23: 0000000000000000 x22: ffff000057cb7640 x21: 0000000000000000
x20: ffff000057cb7600 x19: ffff7fffe2c40000 x18: ffff0000160a0d19
x17: ffff800084ddbf10 x16: ffff8000852edaec x15: ffff800084c760e8
x14: ffff800084c7523c x13: ffff800089bc9370 x12: ffff6ffffc588001
x11: 1fffeffffc588000 x10: ffff6ffffc588000 x9 : dfff800000000000
x8 : ffff7fffe2c40007 x7 : 0000000000000001 x6 : ffff6ffffc588000
x5 : ffff7fffe2c40000 x4 : ffff6ffffc588001 x3 : ffff800084c6cc84
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
__ll_sc__cmpxchg_case_mb_64 arch/arm64/include/asm/atomic_ll_sc.h:293 [inline] (P)
__cmpxchg_case_mb_64 arch/arm64/include/asm/cmpxchg.h:129 [inline] (P)
__cmpxchg_mb arch/arm64/include/asm/cmpxchg.h:171 [inline] (P)
rt_cache_route+0x130/0x190 net/ipv4/route.c:1506 (P)
rt_set_nexthop.isra.0+0x35c/0xdc0 net/ipv4/route.c:1621
__mkroute_output net/ipv4/route.c:2681 [inline]
ip_route_output_key_hash_rcu+0xab0/0x1de8 net/ipv4/route.c:2875
ip_route_output_key_hash+0x10c/0x210 net/ipv4/route.c:2705
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x28/0x160 net/ipv4/route.c:2932
l2tp_ip_sendmsg+0xac4/0x1424 net/l2tp/l2tp_ip.c:502
inet_sendmsg+0x90/0xe0 net/ipv4/af_inet.c:859
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0xc8/0x168 net/socket.c:742
____sys_sendmsg+0x524/0x730 net/socket.c:2592
___sys_sendmsg+0x124/0x1a4 net/socket.c:2646
__sys_sendmsg+0x118/0x1a4 net/socket.c:2678
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__arm64_sys_sendmsg+0x70/0xa0 net/socket.c:2681
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x70/0x260 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:132
do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x54/0x29c arch/arm64/kernel/entry-common.c:724
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: f9800271 c85f7e60 ca150001 b5000081 (c801fe74)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: f9800271 prfm pstl1strm, [x19]
4: c85f7e60 ldxr x0, [x19]
8: ca150001 eor x1, x0, x21
c: b5000081 cbnz x1, 0x1c
* 10: c801fe74 stlxr w1, x20, [x19] <-- trapping instruction