BUG: unable to handle page fault for address: ffffff05e9c58959 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1342f067 P4D 1342f067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.14.0-rc5-syzkaller-00025-gcfced12f5100 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events nsim_fib_event_work RIP: 0010:find_stack lib/stackdepot.c:553 [inline] RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618 Code: 00 31 f6 48 89 d5 4c 89 cb e8 f8 ba c7 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7 RSP: 0018:ffffc900001a7330 EFLAGS: 00010202 RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 0000000000ed5c20 RDX: ffff88805f0d5c20 RSI: 0000000000000002 RDI: 000000000106f8ae RBP: 00000000a9dd7c52 R08: ffffc900001a73a0 R09: 000000000000000a R10: ffffc900001a7270 R11: ffffffff81ad5ae0 R12: ffff88801b041280 R13: 000000000000000a R14: 0000000001aed5c2 R15: ffffff05e9c58949 FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffff05e9c58959 CR3: 0000000011cec000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kasan_save_stack mm/kasan/common.c:48 [inline] kasan_save_track+0x51/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4609 [inline] kfree+0x196/0x430 mm/slub.c:4757 nsim_fib_event_work+0x2466/0x3f00 drivers/net/netdevsim/fib.c:1495 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319 worker_thread+0x870/0xd30 kernel/workqueue.c:3400 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: CR2: ffffff05e9c58959 ---[ end trace 0000000000000000 ]--- RIP: 0010:find_stack lib/stackdepot.c:553 [inline] RIP: 0010:stack_depot_save_flags+0x1b4/0x940 lib/stackdepot.c:618 Code: 00 31 f6 48 89 d5 4c 89 cb e8 f8 ba c7 ff 49 89 d9 8b 5c 24 04 48 89 ea 4c 8b 44 24 08 45 85 e4 75 67 4d 8b 3f 49 39 d7 74 5c <45> 39 77 10 75 f2 45 39 4f 14 75 ec 31 c0 49 8b 0c c0 49 3b 4c c7 RSP: 0018:ffffc900001a7330 EFLAGS: 00010202 RAX: ffff88805e200000 RBX: 0000000000000001 RCX: 0000000000ed5c20 RDX: ffff88805f0d5c20 RSI: 0000000000000002 RDI: 000000000106f8ae RBP: 00000000a9dd7c52 R08: ffffc900001a73a0 R09: 000000000000000a R10: ffffc900001a7270 R11: ffffffff81ad5ae0 R12: ffff88801b041280 R13: 000000000000000a R14: 0000000001aed5c2 R15: ffffff05e9c58949 FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffff05e9c58959 CR3: 0000000011cec000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 00 31 add %dh,(%rcx) 2: f6 48 89 d5 testb $0xd5,-0x77(%rax) 6: 4c 89 cb mov %r9,%rbx 9: e8 f8 ba c7 ff call 0xffc7bb06 e: 49 89 d9 mov %rbx,%r9 11: 8b 5c 24 04 mov 0x4(%rsp),%ebx 15: 48 89 ea mov %rbp,%rdx 18: 4c 8b 44 24 08 mov 0x8(%rsp),%r8 1d: 45 85 e4 test %r12d,%r12d 20: 75 67 jne 0x89 22: 4d 8b 3f mov (%r15),%r15 25: 49 39 d7 cmp %rdx,%r15 28: 74 5c je 0x86 * 2a: 45 39 77 10 cmp %r14d,0x10(%r15) <-- trapping instruction 2e: 75 f2 jne 0x22 30: 45 39 4f 14 cmp %r9d,0x14(%r15) 34: 75 ec jne 0x22 36: 31 c0 xor %eax,%eax 38: 49 8b 0c c0 mov (%r8,%rax,8),%rcx 3c: 49 rex.WB 3d: 3b .byte 0x3b 3e: 4c rex.WR 3f: c7 .byte 0xc7