general protection fault, probably for non-canonical address 0xdffffc00000000c9: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000648-0x000000000000064f]
CPU: 3 PID: 8769 Comm: syz-executor.2 Not tainted 6.0.0-rc3-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:rt6_probe net/ipv6/route.c:653 [inline]
RIP: 0010:find_match.part.0+0x7d4/0xd00 net/ipv6/route.c:755
Code: 92 ab 22 01 e9 1e fd ff ff e8 c8 0a 64 f9 48 8b 45 a8 48 8d b8 48 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 61 04 00 00 48 8b 45 a8 48 c7
RSP: 0018:ffffc900005d7b28 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888066f49220 RCX: 0000000000000100
RDX: 00000000000000c9 RSI: ffffffff8817ff68 RDI: 0000000000000648
RBP: ffffc900005d7b98 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: 000000000000000a R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cb00000(0063) knlGS:00000000f7fceb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020001000 CR3: 0000000048679000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
find_match net/ipv6/route.c:781 [inline]
rt6_nh_find_match+0x15c/0x210 net/ipv6/route.c:781
nexthop_for_each_fib6_nh+0x261/0x430 net/ipv4/nexthop.c:1248
__find_rr_leaf+0x68b/0xd20 net/ipv6/route.c:822
find_rr_leaf net/ipv6/route.c:850 [inline]
rt6_select net/ipv6/route.c:894 [inline]
fib6_table_lookup+0x5ee/0x9c0 net/ipv6/route.c:2182
ip6_pol_route+0x1c5/0x1190 net/ipv6/route.c:2218
pol_lookup_func include/net/ip6_fib.h:582 [inline]
fib6_rule_lookup+0x52a/0x6f0 net/ipv6/fib6_rules.c:121
ip6_route_output_flags_noref+0x2e2/0x380 net/ipv6/route.c:2625
ip6_route_output_flags+0x72/0x320 net/ipv6/route.c:2638
ip6_route_output include/net/ip6_route.h:98 [inline]
ip6_dst_lookup_tail+0x5a3/0x1610 net/ipv6/ip6_output.c:1092
ip6_dst_lookup_flow+0x8c/0x1d0 net/ipv6/ip6_output.c:1222
geneve_get_v6_dst+0x4ad/0xd20 drivers/net/geneve.c:889
geneve6_xmit_skb drivers/net/geneve.c:1024 [inline]
geneve_xmit+0x537/0x4910 drivers/net/geneve.c:1108
__netdev_start_xmit include/linux/netdevice.h:4819 [inline]
netdev_start_xmit include/linux/netdevice.h:4833 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x183/0x880 net/core/dev.c:3606
__dev_queue_xmit+0x2c31/0x3ad0 net/core/dev.c:4256
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_resolve_output net/core/neighbour.c:1552 [inline]
neigh_resolve_output+0x517/0x840 net/core/neighbour.c:1532
neigh_output include/net/neighbour.h:551 [inline]
ip6_finish_output2+0x564/0x1520 net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x690/0x1160 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x1ed/0x540 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:451 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xa5f/0x1730 net/ipv6/ndisc.c:508
ndisc_send_rs+0x12e/0x6f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x3ed/0x820 net/ipv6/addrconf.c:3927
call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x1d3/0x9c6 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__sanitizer_cov_trace_pc+0x4c/0x60 kernel/kcov.c:205
Code: 0e 85 c9 74 35 8b 82 bc 15 00 00 85 c0 74 2b 8b 82 98 15 00 00 83 f8 02 75 20 48 8b 8a a0 15 00 00 8b 92 9c 15 00 00 48 8b 01 <48> 83 c0 01 48 39 c2 76 07 48 89 01 48 89 34 c1 c3 0f 1f 00 41 55
RSP: 0018:ffffc90004b57690 EFLAGS: 00000246
RAX: 0000000000003b8e RBX: 0000000000000001 RCX: ffffc90003d34000
RDX: 0000000000040000 RSI: ffffffff81f38b3a RDI: 0000000000000001
RBP: ffff88801cecaae0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000008c07c R12: 1ffff9200096aeea
R13: dffffc0000000000 R14: ffff88801cecaaf8 R15: ffffc90004b576c8
get_cached_acl+0xca/0x520 fs/posix_acl.c:47
get_acl fs/posix_acl.c:120 [inline]
posix_acl_chmod fs/posix_acl.c:601 [inline]
posix_acl_chmod+0x130/0x3e0 fs/posix_acl.c:590
ext4_setattr+0x3ab/0x2c50 fs/ext4/inode.c:5543
notify_change+0xcd0/0x1440 fs/attr.c:420
ovl_do_notify_change fs/overlayfs/overlayfs.h:142 [inline]
ovl_workdir_create+0x69c/0x930 fs/overlayfs/super.c:827
ovl_make_workdir fs/overlayfs/super.c:1369 [inline]
ovl_get_workdir fs/overlayfs/super.c:1519 [inline]
ovl_fill_super+0x1950/0x62b0 fs/overlayfs/super.c:2075
mount_nodev+0x60/0x110 fs/super.c:1446
legacy_get_tree+0x105/0x220 fs/fs_context.c:610
vfs_get_tree+0x89/0x2f0 fs/super.c:1530
do_new_mount fs/namespace.c:3040 [inline]
path_mount+0x1326/0x1e20 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__ia32_sys_mount+0x27e/0x300 fs/namespace.c:3568
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7fd3549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7fce5cc EFLAGS: 00000296 ORIG_RAX: 0000000000000015
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000020000040
RDX: 0000000020000080 RSI: 0000000000000000 RDI: 0000000020000280
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_probe net/ipv6/route.c:653 [inline]
RIP: 0010:find_match.part.0+0x7d4/0xd00 net/ipv6/route.c:755
Code: 92 ab 22 01 e9 1e fd ff ff e8 c8 0a 64 f9 48 8b 45 a8 48 8d b8 48 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 61 04 00 00 48 8b 45 a8 48 c7
RSP: 0018:ffffc900005d7b28 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff888066f49220 RCX: 0000000000000100
RDX: 00000000000000c9 RSI: ffffffff8817ff68 RDI: 0000000000000648
RBP: ffffc900005d7b98 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: 000000000000000a R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88802cb00000(0063) knlGS:00000000f7fceb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020001000 CR3: 0000000048679000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 92 xchg %eax,%edx
1: ab stos %eax,%es:(%rdi)
2: 22 01 and (%rcx),%al
4: e9 1e fd ff ff jmpq 0xfffffd27
9: e8 c8 0a 64 f9 callq 0xf9640ad6
e: 48 8b 45 a8 mov -0x58(%rbp),%rax
12: 48 8d b8 48 06 00 00 lea 0x648(%rax),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 61 04 00 00 jle 0x49b
3a: 48 8b 45 a8 mov -0x58(%rbp),%rax
3e: 48 rex.W
3f: c7 .byte 0xc7