kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 8143 Comm: syz-executor.4 Not tainted 4.19.193-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:131 [inline] RIP: 0010:____rb_erase_color lib/rbtree.c:375 [inline] RIP: 0010:rb_erase+0x669/0x1290 lib/rbtree.c:462 Code: ef 48 89 14 24 e8 37 0e aa f9 48 8b 14 24 e9 d5 fe ff ff 4c 89 e8 49 89 ee 4c 89 6d 10 48 c1 e8 03 49 89 6c 24 08 49 83 ce 01 <80> 3c 18 00 0f 85 70 0a 00 00 48 89 e8 4d 89 75 00 48 c1 e8 03 80 RSP: 0018:ffff88807535fa48 EFLAGS: 00010286 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81905e28 RDX: fffffbfff1a49c6c RSI: ffffffff8d24e360 RDI: ffff88800013e120 RBP: ffff8880a9eb1b98 R08: 0000000000000000 R09: ffffc90015b45000 R10: 0000000000000006 R11: 0000000000000000 R12: ffff88800013e118 R13: 0000000000000000 R14: ffff8880a9eb1b99 R15: ffffffff8d24e360 FS: 0000000002452400(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001d80708 CR3: 0000000075324000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __free_vmap_area+0x115/0x360 mm/vmalloc.c:577 __purge_vmap_area_lazy+0x17c/0x280 mm/vmalloc.c:687 try_purge_vmap_area_lazy mm/vmalloc.c:702 [inline] free_vmap_area_noflush+0xd4/0x100 mm/vmalloc.c:734 free_unmap_vmap_area mm/vmalloc.c:747 [inline] remove_vm_area+0x263/0x2f0 mm/vmalloc.c:1495 __vunmap+0x187/0x3f0 mm/vmalloc.c:1523 vfree+0x65/0x100 mm/vmalloc.c:1598 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:886 [inline] get_entries net/ipv6/netfilter/ip6_tables.c:1044 [inline] do_ip6t_get_ctl+0x719/0x910 net/ipv6/netfilter/ip6_tables.c:1714 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline] nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:122 ipv6_getsockopt+0x1b6/0x260 net/ipv6/ipv6_sockglue.c:1388 tcp_getsockopt+0x86/0xd0 net/ipv4/tcp.c:3629 __sys_getsockopt+0x135/0x210 net/socket.c:1938 __do_sys_getsockopt net/socket.c:1949 [inline] __se_sys_getsockopt net/socket.c:1946 [inline] __x64_sys_getsockopt+0xba/0x150 net/socket.c:1946 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x467bea Code: 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4936a2a8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 0000000000000029 RCX: 0000000000467bea RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 00007fff4936a2d0 R08: 00007fff4936a2cc R09: 0079746972756365 R10: 00007fff4936a330 R11: 0000000000000212 R12: 00007fff4936a330 R13: 0000000000000003 R14: 00007fff4936a2cc R15: 0000000000544640 Modules linked in: ---[ end trace 1db4f96302af5cc3 ]--- RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:131 [inline] RIP: 0010:____rb_erase_color lib/rbtree.c:375 [inline] RIP: 0010:rb_erase+0x669/0x1290 lib/rbtree.c:462 Code: ef 48 89 14 24 e8 37 0e aa f9 48 8b 14 24 e9 d5 fe ff ff 4c 89 e8 49 89 ee 4c 89 6d 10 48 c1 e8 03 49 89 6c 24 08 49 83 ce 01 <80> 3c 18 00 0f 85 70 0a 00 00 48 89 e8 4d 89 75 00 48 c1 e8 03 80 RSP: 0018:ffff88807535fa48 EFLAGS: 00010286 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81905e28 RDX: fffffbfff1a49c6c RSI: ffffffff8d24e360 RDI: ffff88800013e120 RBP: ffff8880a9eb1b98 R08: 0000000000000000 R09: ffffc90015b45000 R10: 0000000000000006 R11: 0000000000000000 R12: ffff88800013e118 R13: 0000000000000000 R14: ffff8880a9eb1b99 R15: ffffffff8d24e360 FS: 0000000002452400(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001d80708 CR3: 0000000075324000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400