Oops: general protection fault, probably for non-canonical address 0xf81ffbf110054cc9: 0000 [#1] SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0xc0ffff88802a6648-0xc0ffff88802a664f]
CPU: 0 UID: 0 PID: 6606 Comm: kworker/u8:8 Not tainted 6.15.0-rc2-syzkaller-00042-g1a1d569a75f3 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:read_pnet include/net/net_namespace.h:409 [inline]
RIP: 0010:dev_net include/linux/netdevice.h:2708 [inline]
RIP: 0010:rt6_is_valid net/ipv6/route.c:1435 [inline]
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1445 [inline]
RIP: 0010:ip6_pol_route+0x540/0x15f0 net/ipv6/route.c:2298
Code: 08 00 74 08 4c 89 f7 e8 5e 5f 6a f7 bb 08 01 00 00 49 03 1e e8 41 4b 68 01 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 32 5f 6a f7 41 bc 0c 0f 00 00 4c 03
RSP: 0018:ffffc90000006700 EFLAGS: 00010a06
RAX: 181ffff110054cc9 RBX: c0ffff88802a6648 RCX: dffffc0000000000
RDX: ffff88801eb00000 RSI: 00000000ff000000 RDI: 0000000000000000
RBP: ffffc90000006850 R08: ffffffff8ac08d7a R09: ffff88807c6f3140
R10: dffffc0000000000 R11: fffffbfff20bd70f R12: ffffc900000067d0
R13: 1ffff92000000cfa R14: ffff888032b49c81 R15: 00000000ff000000
FS: 0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fab3f023440 CR3: 00000000606fe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x590/0x7a0 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2334 [inline]
ip6_route_input+0x85b/0xda0 net/ipv6/route.c:2630
ip6_rcv_finish+0x140/0x3d0 net/ipv6/ip6_input.c:77
ip_sabotage_in+0x203/0x290 net/bridge/br_netfilter_hooks.c:993
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc8/0x220 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:269 [inline]
NF_HOOK+0x29b/0x450 include/linux/netfilter.h:312
__netif_receive_skb_one_core net/core/dev.c:5885 [inline]
__netif_receive_skb+0x1ef/0x670 net/core/dev.c:5998
netif_receive_skb_internal net/core/dev.c:6084 [inline]
netif_receive_skb+0x1ea/0x890 net/core/dev.c:6143
NF_HOOK+0xa0/0x410 include/linux/netfilter.h:314
br_handle_frame_finish+0x188d/0x1f60 net/bridge/br_input.c:226
br_nf_hook_thresh+0x482/0x5a0 net/bridge/br_netfilter_hooks.c:1170
br_nf_pre_routing_finish_ipv6+0xaa3/0xdd0 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:314 [inline]
br_nf_pre_routing_ipv6+0x397/0x790 net/bridge/br_netfilter_ipv6.c:184
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:282 [inline]
br_handle_frame+0x9fa/0x1530 net/bridge/br_input.c:433
__netif_receive_skb_core+0x155a/0x4bb0 net/core/dev.c:5771
__netif_receive_skb_one_core net/core/dev.c:5883 [inline]
__netif_receive_skb+0x130/0x670 net/core/dev.c:5998
process_backlog+0x664/0x15c0 net/core/dev.c:6350
__napi_poll+0xcb/0x480 net/core/dev.c:7322
napi_poll net/core/dev.c:7386 [inline]
net_rx_action+0x89d/0x1240 net/core/dev.c:7508
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
do_softirq+0x11f/0x1e0 kernel/softirq.c:480
__local_bh_enable_ip+0x1be/0x200 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1780/0x3f60 net/core/dev.c:4654
dev_queue_xmit include/linux/netdevice.h:3350 [inline]
neigh_hh_output include/net/neighbour.h:523 [inline]
neigh_output include/net/neighbour.h:537 [inline]
ip6_finish_output2+0x125c/0x1750 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x421/0x840 net/ipv6/ip6_output.c:226
NF_HOOK+0xa0/0x440 include/linux/netfilter.h:314
mld_sendpack+0x84a/0xdc0 net/ipv6/mcast.c:1868
ipv6_mc_dad_complete+0x88/0x490 net/ipv6/mcast.c:2293
addrconf_dad_completed+0x714/0xcd0 net/ipv6/addrconf.c:4341
addrconf_dad_work+0xdbe/0x16a0 net/ipv6/addrconf.c:-1
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd50 kernel/workqueue.c:3400
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:read_pnet include/net/net_namespace.h:409 [inline]
RIP: 0010:dev_net include/linux/netdevice.h:2708 [inline]
RIP: 0010:rt6_is_valid net/ipv6/route.c:1435 [inline]
RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1445 [inline]
RIP: 0010:ip6_pol_route+0x540/0x15f0 net/ipv6/route.c:2298
Code: 08 00 74 08 4c 89 f7 e8 5e 5f 6a f7 bb 08 01 00 00 49 03 1e e8 41 4b 68 01 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 48 89 df e8 32 5f 6a f7 41 bc 0c 0f 00 00 4c 03
RSP: 0018:ffffc90000006700 EFLAGS: 00010a06
RAX: 181ffff110054cc9 RBX: c0ffff88802a6648 RCX: dffffc0000000000
RDX: ffff88801eb00000 RSI: 00000000ff000000 RDI: 0000000000000000
RBP: ffffc90000006850 R08: ffffffff8ac08d7a R09: ffff88807c6f3140
R10: dffffc0000000000 R11: fffffbfff20bd70f R12: ffffc900000067d0
R13: 1ffff92000000cfa R14: ffff888032b49c81 R15: 00000000ff000000
FS: 0000000000000000(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fab3f023440 CR3: 00000000606fe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 08 00 or %al,(%rax)
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 5e 5f 6a f7 call 0xf76a5f6a
c: bb 08 01 00 00 mov $0x108,%ebx
11: 49 03 1e add (%r14),%rbx
14: e8 41 4b 68 01 call 0x1684b5a
19: 48 89 d8 mov %rbx,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 48 89 df mov %rbx,%rdi
33: e8 32 5f 6a f7 call 0xf76a5f6a
38: 41 bc 0c 0f 00 00 mov $0xf0c,%r12d
3e: 4c rex.WR
3f: 03 .byte 0x3