------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/ipv6/route.c:1095:9
index 255 is out of range for type 'const int[12]'
CPU: 0 UID: 0 PID: 10648 Comm: syz.0.1273 Not tainted 6.15.0-rc3-syzkaller-00584-gcc17b4b9c332 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ip6_rt_type_to_error net/ipv6/route.c:1095 [inline]
ip6_rt_init_dst_reject net/ipv6/route.c:1112 [inline]
ip6_rt_init_dst net/ipv6/route.c:1137 [inline]
ip6_rt_copy_init+0x8e7/0x970 net/ipv6/route.c:1175
ip6_rt_pcpu_alloc net/ipv6/route.c:1424 [inline]
rt6_make_pcpu_route net/ipv6/route.c:1467 [inline]
ip6_pol_route+0xbac/0x1180 net/ipv6/route.c:2302
pol_lookup_func include/net/ip6_fib.h:617 [inline]
__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]
fib6_rule_action+0x206/0x7d0 net/ipv6/fib6_rules.c:275
fib_rules_lookup+0x767/0xe90 net/core/fib_rules.c:339
fib6_rule_lookup+0x18e/0x6f0 net/ipv6/fib6_rules.c:112
ip6_route_output_flags_noref net/ipv6/route.c:2674 [inline]
ip6_route_output_flags+0x364/0x5d0 net/ipv6/route.c:2686
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_tnl_xmit+0x584/0x2b00 net/ipv6/ip6_tunnel.c:1165
__gre6_xmit+0xa47/0xd40 net/ipv6/ip6_gre.c:816
ip6gre_xmit_ipv6 net/ipv6/ip6_gre.c:874 [inline]
ip6gre_tunnel_xmit+0xd6e/0x10e0 net/ipv6/ip6_gre.c:926
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
sch_direct_xmit+0x241/0x4b0 net/sched/sch_generic.c:344
__dev_xmit_skb net/core/dev.c:4070 [inline]
__dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4647
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb47/0x1400 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4038
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2445
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:406 [inline]
RIP: 0010:unwind_next_frame+0xc34/0x2390 arch/x86/kernel/unwind_orc.c:585
Code: 49 39 dc 0f 97 c0 20 c8 3c 01 0f 85 f9 0c 00 00 48 8d 43 08 4c 39 f8 0f 97 c1 4c 39 e0 0f 96 c0 20 c8 3c 01 0f 85 df 0c 00 00 <48> 89 df e8 84 23 00 00 48 89 c3 48 bd 00 00 00 00 00 fc ff df 48
RSP: 0018:ffffc90003416238 EFLAGS: 00000202
RAX: ffffc90003416a01 RBX: ffffc90003416aa0 RCX: 1ffff92000682c01
RDX: ffffffff901fb26c RSI: 0000000000000002 RDI: ffffffff8bc1ca00
RBP: 1ffff92000682c62 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff817199f5 R12: ffffc90003418000
R13: 1ffff92000682c63 R14: ffffc90003416308 R15: ffffc90003410000
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4161 [inline]
slab_alloc_node mm/slub.c:4210 [inline]
kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4217
__kernfs_new_node+0xd7/0x7f0 fs/kernfs/dir.c:637
kernfs_new_node+0x102/0x210 fs/kernfs/dir.c:713
__kernfs_create_file+0x4b/0x2e0 fs/kernfs/file.c:1038
sysfs_add_file_mode_ns+0x238/0x300 fs/sysfs/file.c:319
create_files fs/sysfs/group.c:76 [inline]
internal_create_group+0x66d/0x1110 fs/sysfs/group.c:183
internal_create_groups fs/sysfs/group.c:223 [inline]
sysfs_create_groups+0x59/0x120 fs/sysfs/group.c:249
device_add_groups drivers/base/core.c:2813 [inline]
device_add_attrs+0x1c4/0x5a0 drivers/base/core.c:2888
device_add+0x496/0xb50 drivers/base/core.c:3620
netdev_register_kobject+0x156/0x2f0 net/core/net-sysfs.c:2336
register_netdevice+0x126c/0x1ae0 net/core/dev.c:11064
ip6_tnl_create2+0x78/0x150 net/ipv6/ip6_tunnel.c:261
ip6_tnl_newlink+0x311/0x620 net/ipv6/ip6_tunnel.c:2039
rtnl_newlink_create+0x30d/0xb00 net/core/rtnetlink.c:3834
__rtnl_newlink net/core/rtnetlink.c:3951 [inline]
rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4066
rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6955
netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:727
____sys_sendmsg+0x505/0x830 net/socket.c:2566
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2620
__sys_sendmsg net/socket.c:2652 [inline]
__do_sys_sendmsg net/socket.c:2657 [inline]
__se_sys_sendmsg net/socket.c:2655 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2655
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb7d5b8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb7d69d7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb7d5db6080 RCX: 00007fb7d5b8e969
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004
RBP: 00007fb7d5c10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fb7d5db6080 R15: 00007ffdb1dd9c88
---[ end trace ]---
----------------
Code disassembly (best guess):
0: 49 39 dc cmp %rbx,%r12
3: 0f 97 c0 seta %al
6: 20 c8 and %cl,%al
8: 3c 01 cmp $0x1,%al
a: 0f 85 f9 0c 00 00 jne 0xd09
10: 48 8d 43 08 lea 0x8(%rbx),%rax
14: 4c 39 f8 cmp %r15,%rax
17: 0f 97 c1 seta %cl
1a: 4c 39 e0 cmp %r12,%rax
1d: 0f 96 c0 setbe %al
20: 20 c8 and %cl,%al
22: 3c 01 cmp $0x1,%al
24: 0f 85 df 0c 00 00 jne 0xd09
* 2a: 48 89 df mov %rbx,%rdi <-- trapping instruction
2d: e8 84 23 00 00 call 0x23b6
32: 48 89 c3 mov %rax,%rbx
35: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp
3c: fc ff df
3f: 48 rex.W