------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/ipv6/route.c:1095:9
index 255 is out of range for type 'const int[12]'
CPU: 1 UID: 0 PID: 9848 Comm: syz.0.911 Not tainted 6.15.0-rc3-syzkaller-00584-gcc17b4b9c332 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ip6_rt_type_to_error net/ipv6/route.c:1095 [inline]
ip6_rt_init_dst_reject net/ipv6/route.c:1112 [inline]
ip6_rt_init_dst net/ipv6/route.c:1137 [inline]
ip6_rt_copy_init+0x8e7/0x970 net/ipv6/route.c:1175
ip6_rt_pcpu_alloc net/ipv6/route.c:1424 [inline]
rt6_make_pcpu_route net/ipv6/route.c:1467 [inline]
ip6_pol_route+0xbac/0x1180 net/ipv6/route.c:2302
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x348/0x6f0 net/ipv6/fib6_rules.c:125
ip6_route_output_flags_noref net/ipv6/route.c:2674 [inline]
ip6_route_output_flags+0x364/0x5d0 net/ipv6/route.c:2686
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_dst_lookup_tail+0x1ae/0x1510 net/ipv6/ip6_output.c:1128
icmpv6_route_lookup+0xcb/0x590 net/ipv6/icmp.c:363
icmp6_send+0x1001/0x1940 net/ipv6/icmp.c:604
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_pkt_drop+0x4dc/0x640 net/ipv6/route.c:4587
ip6_pkt_discard_out+0xf2/0x120 net/ipv6/route.c:4600
ip6tunnel_xmit include/net/ip6_tunnel.h:161 [inline]
udp_tunnel6_xmit_skb+0x5da/0xa60 net/ipv6/ip6_udp_tunnel.c:111
vxlan_xmit_one+0x2b2e/0x37e0 drivers/net/vxlan/vxlan_core.c:2587
vxlan_xmit+0x173c/0x29d0 drivers/net/vxlan/vxlan_core.c:2799
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
__dev_queue_xmit+0x1adf/0x3a70 net/core/dev.c:4681
dev_queue_xmit include/linux/netdevice.h:3349 [inline]
neigh_hh_output include/net/neighbour.h:523 [inline]
neigh_output include/net/neighbour.h:537 [inline]
ip6_finish_output2+0x11bc/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb47/0x1400 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4038
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2445
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x3a/0xb0 kernel/rcu/tree.c:736
Code: e8 ab 7b af 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd 10 0c 97 8d 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 3c cd 7a 00 48 c7 c3 58 eb 76 92 49 03 1e 48 89
RSP: 0018:ffffc900046e7310 EFLAGS: 00000246
RAX: 1ffffffff1b2e183 RBX: 0000000000000001 RCX: 8aeae6f909744200
RDX: 0000000000000000 RSI: ffffffff8bc1ca40 RDI: ffffffff8bc1ca00
RBP: ffffffff822c9ef5 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff822cb6ed R12: 0000000000000002
R13: ffffffff8df3b860 R14: ffffffff8d970c18 R15: dffffc0000000000
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0x5f/0x360 kernel/locking/lockdep.c:5829
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
page_table_check_clear+0x182/0x6e0 mm/page_table_check.c:77
ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
get_and_clear_full_ptes include/linux/pgtable.h:714 [inline]
zap_present_folio_ptes mm/memory.c:1501 [inline]
zap_present_ptes mm/memory.c:1586 [inline]
do_zap_pte_range mm/memory.c:1687 [inline]
zap_pte_range mm/memory.c:1731 [inline]
zap_pmd_range mm/memory.c:1823 [inline]
zap_pud_range mm/memory.c:1852 [inline]
zap_p4d_range mm/memory.c:1873 [inline]
unmap_page_range+0x30be/0x4210 mm/memory.c:1894
unmap_vmas+0x25d/0x3c0 mm/memory.c:1984
exit_mmap+0x245/0xba0 mm/mmap.c:1284
__mmput+0x118/0x420 kernel/fork.c:1379
exit_mm+0x1da/0x2c0 kernel/exit.c:589
do_exit+0x859/0x2550 kernel/exit.c:940
do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
get_signal+0x125e/0x1310 kernel/signal.c:3034
arch_do_signal_or_restart+0x95/0x780 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x8b/0x120 kernel/entry/common.c:218
do_syscall_64+0x103/0x210 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1fa598e969
Code: Unable to access opcode bytes at 0x7f1fa598e93f.
RSP: 002b:00007f1fa680d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f1fa5bb5fa0 RCX: 00007f1fa598e969
RDX: 0000200000001f00 RSI: 00000000c004743e RDI: 0000000000000007
RBP: 00007f1fa5a10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f1fa5bb5fa0 R15: 00007ffee906eb78
---[ end trace ]---
----------------
Code disassembly (best guess):
0: e8 ab 7b af 09 call 0x9af7bb0
5: 89 c3 mov %eax,%ebx
7: 83 f8 08 cmp $0x8,%eax
a: 73 65 jae 0x71
c: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
13: fc ff df
16: 4c 8d 34 dd 10 0c 97 lea -0x7268f3f0(,%rbx,8),%r14
1d: 8d
1e: 4c 89 f0 mov %r14,%rax
21: 48 c1 e8 03 shr $0x3,%rax
25: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 f7 mov %r14,%rdi
2f: e8 3c cd 7a 00 call 0x7acd70
34: 48 c7 c3 58 eb 76 92 mov $0xffffffff9276eb58,%rbx
3b: 49 03 1e add (%r14),%rbx
3e: 48 rex.W
3f: 89 .byte 0x89