general protection fault, probably for non-canonical address 0xfbd59c0000000007: 0000 [#1] PREEMPT SMP KASAN KASAN: maybe wild-memory-access in range [0xdead000000000038-0xdead00000000003f] CPU: 0 PID: 8217 Comm: kworker/0:5 Not tainted 5.15.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: mld mld_ifc_work RIP: 0010:__ipv6_get_lladdr+0x5e/0x180 net/ipv6/addrconf.c:1847 Code: 20 00 74 08 48 89 df e8 b0 d1 fe f8 48 8b 1b 49 39 dd 0f 84 ea 00 00 00 0f 1f 40 00 48 8d ab 1a ff ff ff 48 89 e8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 96 00 00 00 0f b7 6d 00 bf 20 00 00 00 RSP: 0018:ffffc90016c279a8 EFLAGS: 00010a03 RAX: 1bd5a00000000007 RBX: dead000000000122 RCX: ffff88808c40b900 RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000 RBP: dead00000000003c R08: ffffffff88cf0e7f R09: ffffed1029067de6 R10: ffffed1029067de6 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff88808b251008 R14: ffffc90016c27a60 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555557284848 CR3: 0000000090712000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mld_newpack+0x332/0x9f0 net/ipv6/mcast.c:1762 add_grhead net/ipv6/mcast.c:1857 [inline] add_grec+0x1178/0x15c0 net/ipv6/mcast.c:1995 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x70d/0xc70 net/ipv6/mcast.c:2659 process_one_work+0x853/0x1140 kernel/workqueue.c:2297 worker_thread+0xac1/0x1320 kernel/workqueue.c:2444 kthread+0x453/0x480 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 Modules linked in: ---[ end trace 17837bb7bd382bfe ]--- RIP: 0010:__ipv6_get_lladdr+0x5e/0x180 net/ipv6/addrconf.c:1847 Code: 20 00 74 08 48 89 df e8 b0 d1 fe f8 48 8b 1b 49 39 dd 0f 84 ea 00 00 00 0f 1f 40 00 48 8d ab 1a ff ff ff 48 89 e8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 96 00 00 00 0f b7 6d 00 bf 20 00 00 00 RSP: 0018:ffffc90016c279a8 EFLAGS: 00010a03 RAX: 1bd5a00000000007 RBX: dead000000000122 RCX: ffff88808c40b900 RDX: 0000000000000000 RSI: 0000000000000040 RDI: 0000000000000000 RBP: dead00000000003c R08: ffffffff88cf0e7f R09: ffffed1029067de6 R10: ffffed1029067de6 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff88808b251008 R14: ffffc90016c27a60 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8bb69e4718 CR3: 0000000070271000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 20 00 and %al,(%rax) 2: 74 08 je 0xc 4: 48 89 df mov %rbx,%rdi 7: e8 b0 d1 fe f8 callq 0xf8fed1bc c: 48 8b 1b mov (%rbx),%rbx f: 49 39 dd cmp %rbx,%r13 12: 0f 84 ea 00 00 00 je 0x102 18: 0f 1f 40 00 nopl 0x0(%rax) 1c: 48 8d ab 1a ff ff ff lea -0xe6(%rbx),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 96 00 00 00 jne 0xcd 37: 0f b7 6d 00 movzwl 0x0(%rbp),%ebp 3b: bf 20 00 00 00 mov $0x20,%edi