Oops: general protection fault, probably for non-canonical address 0xdffffc0000000016: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]
CPU: 3 PID: 9439 Comm: syz-executor.3 Not tainted 6.10.0-rc1-syzkaller-00027-g4a4be1ad3a6e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1407 [inline]
RIP: 0010:ip6_pol_route+0x3bc/0x1150 net/ipv6/route.c:2262
Code: f8 48 85 ed 0f 84 52 03 00 00 e8 ef 42 05 f8 48 8d bd 98 00 00 00 49 89 ec 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a3 08 00 00 8b 85 98 00 00 00
RSP: 0018:ffffc900005efba8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880568cb980 RCX: ffffffff89893c73
RDX: 0000000000000016 RSI: ffffffff89893c81 RDI: 00000000000000b2
RBP: 000000000000001a R08: 0000000000000007 R09: 0000000000000000
R10: 000000000000001a R11: 0000000000000007 R12: 000000000000001a
R13: 1ffff920000bdf79 R14: 0000000000000080 R15: ffffc900005efc28
FS: 0000000000000000(0000) GS:ffff88802c300000(0063) knlGS:00000000f5e4ab40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000ff923d70 CR3: 0000000021e7e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x24c/0x720 net/ipv6/fib6_rules.c:116
ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]
ip6_route_output_flags+0x1d0/0x640 net/ipv6/route.c:2649
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_dst_lookup_tail.constprop.0+0x573/0x1760 net/ipv6/ip6_output.c:1120
ip6_dst_lookup_flow+0x99/0x1d0 net/ipv6/ip6_output.c:1250
sctp_v6_get_dst+0x6a7/0x2070 net/sctp/ipv6.c:326
sctp_transport_route+0x12e/0x350 net/sctp/transport.c:455
sctp_assoc_add_peer+0x743/0x14b0 net/sctp/associola.c:662
sctp_process_param net/sctp/sm_make_chunk.c:2576 [inline]
sctp_process_init+0x2733/0x2d60 net/sctp/sm_make_chunk.c:2396
sctp_sf_do_5_1D_ce+0x77f/0x1710 net/sctp/sm_statefuns.c:799
sctp_do_sm+0x17f/0x5c90 net/sctp/sm_sideeffect.c:1166
sctp_endpoint_bh_rcv+0x440/0x880 net/sctp/endpointola.c:407
sctp_inq_push+0x1d8/0x270 net/sctp/inqueue.c:88
sctp_rcv+0x1563/0x3d00 net/sctp/input.c:243
sctp6_rcv+0x3c/0x60 net/sctp/ipv6.c:1119
ip6_protocol_deliver_rcu+0xf96/0x1530 net/ipv6/ip6_input.c:438
ip6_input_finish+0x14f/0x2f0 net/ipv6/ip6_input.c:483
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip6_input+0xa1/0xd0 net/ipv6/ip6_input.c:492
dst_input include/net/dst.h:460 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x265/0x680 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5624
__netif_receive_skb+0x1d/0x160 net/core/dev.c:5738
process_backlog+0x133/0x760 net/core/dev.c:6067
__napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6721
napi_poll net/core/dev.c:6790 [inline]
net_rx_action+0x9b6/0xf10 net/core/dev.c:6906
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
do_softirq kernel/softirq.c:455 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:442
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:851 [inline]
__dev_queue_xmit+0x872/0x4130 net/core/dev.c:4420
dev_queue_xmit include/linux/netdevice.h:3095 [inline]
neigh_hh_output include/net/neighbour.h:526 [inline]
neigh_output include/net/neighbour.h:540 [inline]
ip6_finish_output2+0x10eb/0x1880 net/ipv6/ip6_output.c:137
__ip6_finish_output net/ipv6/ip6_output.c:211 [inline]
ip6_finish_output+0x3f9/0x1300 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ip6_xmit+0x125f/0x2030 net/ipv6/ip6_output.c:358
sctp_v6_xmit+0xc1f/0x1110 net/sctp/ipv6.c:248
sctp_packet_transmit+0x1cbe/0x3030 net/sctp/output.c:653
sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline]
sctp_outq_flush+0xb74/0x3380 net/sctp/outqueue.c:1221
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1818 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]
sctp_do_sm+0x179c/0x5c90 net/sctp/sm_sideeffect.c:1169
sctp_assoc_bh_rcv+0x392/0x6f0 net/sctp/associola.c:1051
sctp_inq_push+0x1d8/0x270 net/sctp/inqueue.c:88
sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:331
sk_backlog_rcv include/net/sock.h:1106 [inline]
__release_sock+0x35f/0x400 net/core/sock.c:2983
release_sock+0x5a/0x220 net/core/sock.c:3549
sctp_wait_for_connect+0x1c6/0x5c0 net/sctp/socket.c:9345
__sctp_connect+0x9c9/0xc60 net/sctp/socket.c:1247
__sctp_setsockopt_connectx+0x102/0x170 net/sctp/socket.c:1336
sctp_getsockopt_connectx3 net/sctp/socket.c:1421 [inline]
sctp_getsockopt+0x2e9f/0x7ae0 net/sctp/socket.c:8128
do_sock_getsockopt+0x2e5/0x7c0 net/socket.c:2374
__sys_getsockopt+0x1a1/0x270 net/socket.c:2403
__do_sys_getsockopt net/socket.c:2413 [inline]
__se_sys_getsockopt net/socket.c:2410 [inline]
__ia32_sys_getsockopt+0xbc/0x160 net/socket.c:2410
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7258579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f5e4a5ac EFLAGS: 00000292 ORIG_RAX: 000000000000016d
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000000084
RDX: 000000000000006f RSI: 0000000020000280 RDI: 00000000200002c0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1407 [inline]
RIP: 0010:ip6_pol_route+0x3bc/0x1150 net/ipv6/route.c:2262
Code: f8 48 85 ed 0f 84 52 03 00 00 e8 ef 42 05 f8 48 8d bd 98 00 00 00 49 89 ec 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e a3 08 00 00 8b 85 98 00 00 00
RSP: 0018:ffffc900005efba8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8880568cb980 RCX: ffffffff89893c73
RDX: 0000000000000016 RSI: ffffffff89893c81 RDI: 00000000000000b2
RBP: 000000000000001a R08: 0000000000000007 R09: 0000000000000000
R10: 000000000000001a R11: 0000000000000007 R12: 000000000000001a
R13: 1ffff920000bdf79 R14: 0000000000000080 R15: ffffc900005efc28
FS: 0000000000000000(0000) GS:ffff88802c300000(0063) knlGS:00000000f5e4ab40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000ff923d70 CR3: 0000000021e7e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: f8 clc
1: 48 85 ed test %rbp,%rbp
4: 0f 84 52 03 00 00 je 0x35c
a: e8 ef 42 05 f8 call 0xf80542fe
f: 48 8d bd 98 00 00 00 lea 0x98(%rbp),%rdi
16: 49 89 ec mov %rbp,%r12
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e a3 08 00 00 jle 0x8dd
3a: 8b 85 98 00 00 00 mov 0x98(%rbp),%eax