8<--- cut here --- Unable to handle kernel paging request at virtual address df000000 when read [df000000] *pgd=80000080007003, *pmd=00000000 Internal error: Oops: 206 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 25727 Comm: syz-executor.1 Not tainted 6.4.0-rc6-syzkaller #0 Hardware name: ARM-Versatile Express PC is at csum_partial+0x40/0x130 arch/arm/lib/csumpartial.S:120 LR is at 0x0 pc : [<817acf08>] lr : [<00000000>] psr: 00000013 sp : e079db38 ip : a5c5e800 fp : e079db94 r10: 813145b0 r9 : 813145b0 r8 : 00000d02 r7 : fffff2fd r6 : 00000d02 r5 : 00000000 r4 : 00000000 r3 : 00000000 r2 : 494cad30 r1 : fffffef0 r0 : df000000 Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 98d1b500 DAC: fffffffd Register r0 information: non-paged memory Register r1 information: non-paged memory Register r2 information: non-paged memory Register r3 information: NULL pointer Register r4 information: NULL pointer Register r5 information: NULL pointer Register r6 information: non-paged memory Register r7 information: non-paged memory Register r8 information: non-paged memory Register r9 information: non-slab/vmalloc memory Register r10 information: non-slab/vmalloc memory Register r11 information: 2-page vmalloc region starting at 0xe079c000 allocated at kernel_clone+0x9c/0x3dc kernel/fork.c:2915 Register r12 information: non-slab/vmalloc memory Process syz-executor.1 (pid: 25727, stack limit = 0xe079c000) Stack: (0xe079db38 to 0xe079e000) db20: 8617e300 84c5e910 db40: 84c5e910 8150d530 e079db74 e079db58 8617ea80 8617e300 81fdf764 827e238d db60: 84c5b000 000008c0 e079dc1c 8617ea80 00006869 00000000 00000000 00000000 db80: 00000000 89f1c000 e079dbd4 e079db98 815f78f0 8150d358 00000001 05200000 dba0: 00c00000 9b0df705 98d89318 8617ea80 0000000e 00000000 00006869 00000000 dbc0: 00000000 89f1c000 e079dc1c e079dbd8 816312b0 815f7834 80277e38 802a6100 dbe0: 00000060 00000052 85c2de00 9b0df705 20001000 8617ea80 00000000 00006869 dc00: 0000dd86 81631820 e079dcf7 00000011 e079dc3c e079dc20 81631864 81631194 dc20: 8617ea80 00000000 00006869 0000dd86 e079dc6c e079dc40 813784a4 8163182c dc40: 0000000e 9b0df705 e079dcf7 8617ea80 00006869 00000001 00000000 85804000 dc60: e079dc8c e079dc70 8133361c 813783ec 8617ea80 00006869 00000000 e079dcf7 dc80: e079dcc4 e079dc90 8133b028 81333568 00000001 ffff0000 ffffdd86 00000000 dca0: 00000000 84cea800 85804000 00000000 e079dcf7 00000011 e079dcec e079dcc8 dcc0: 8133b240 8133ae98 84a73000 8617ea80 84cea800 85804000 00000000 00000001 dce0: e079dd24 e079dcf0 813aab3c 8133b20c 84a73000 00804000 00000010 9b0df705 dd00: 8617ea80 84a73000 00000000 00000001 a3ea38c0 84a730c4 e079dd84 e079dd28 dd20: 8133be20 813aa988 00000000 00000001 00000011 8260ee30 0079dda4 fffffff4 dd40: 00000000 8132ca8c 00000000 0000dd86 00000000 9b0df705 00000000 8617ea80 dd60: 00002378 85804000 0000000a 8617ea80 84c5b000 89f1ff00 e079dda4 e079dd88 dd80: 81634fac 8133b8c4 84c5b000 00002378 85804000 0000000a e079de5c e079dda8 dda0: 81638700 81634f1c e079de08 00000000 817faa24 80277f18 00002001 e079ddc8 ddc0: e079dea8 83205648 00002001 817fb30c 80200288 806b843c e079de1c e079dde8 dde0: 81a02a70 00000000 00000002 0000236e 00000060 00000300 00000000 0000000e de00: 00000000 0000000a 00000000 236e0500 07440205 0000030c 00000000 00000000 de20: 00000000 00000000 8216d67c 9b0df705 e079de5c 00000000 e079de98 85479400 de40: 04000002 80200288 85c2de00 00000122 e079de7c e079de60 8130da78 81637844 de60: 00000000 85479400 00000000 04000002 e079df8c e079de80 8130f8cc 8130da40 de80: e079dea8 85dc8dd0 fffffff7 00000001 85dc8bc0 00000000 00000000 00000000 dea0: e079ded4 e079deb0 01000006 00000001 00002378 20000080 00000000 00000000 dec0: 00000001 00000000 00000000 00000000 04000002 00000000 00000000 00000000 dee0: 00000000 ffffffff 00000000 00000000 00000001 9b0df705 00000005 00000000 df00: 00000080 0014c288 00000000 00000000 85c2de00 000000f0 e079df4c e079df28 df20: 80309a90 8030d210 ffffffff 80200288 85479400 8163abf0 85479400 00000000 df40: e079dfa4 e079df50 8030a054 803099ec e079df84 e079df60 80277e38 802a6100 df60: 00000000 00000000 85c2de00 9b0df705 00000000 000002ff 0014c2c4 00000122 df80: e079dfa4 e079df90 8130f934 8130f808 00000000 000002ff 00000000 e079dfa8 dfa0: 80200060 8130f924 00000000 000002ff 00000003 20000080 00002378 04000002 dfc0: 00000000 000002ff 0014c2c4 00000122 7e8403c2 76b706d0 7e840534 76b7020c dfe0: 76b70020 76b70010 00017004 0004df80 60000010 00000003 00000000 00000000 Backtrace: [<8150d34c>] (__udp_gso_segment) from [<815f78f0>] (udp6_ufo_fragment+0xc8/0x39c net/ipv6/udp_offload.c:47) r10:89f1c000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:00006869 r4:8617ea80 [<815f7828>] (udp6_ufo_fragment) from [<816312b0>] (ipv6_gso_segment.part.0+0x128/0x42c net/ipv6/ip6_offload.c:119) r10:89f1c000 r9:00000000 r8:00000000 r7:00006869 r6:00000000 r5:0000000e r4:8617ea80 [<81631188>] (ipv6_gso_segment.part.0) from [<81631864>] (ipv6_gso_segment+0x44/0x48 net/ipv6/ip6_offload.c:91) r10:00000011 r9:e079dcf7 r8:81631820 r7:0000dd86 r6:00006869 r5:00000000 r4:8617ea80 [<81631820>] (ipv6_gso_segment) from [<813784a4>] (skb_mac_gso_segment+0xc4/0x1a4 net/core/gro.c:141) r7:0000dd86 r6:00006869 r5:00000000 r4:8617ea80 [<813783e0>] (skb_mac_gso_segment) from [<8133361c>] (__skb_gso_segment+0xc0/0x16c net/core/dev.c:3401) r8:85804000 r7:00000000 r6:00000001 r5:00006869 r4:8617ea80 [<8133355c>] (__skb_gso_segment) from [<8133b028>] (skb_gso_segment include/linux/netdevice.h:4862 [inline]) [<8133355c>] (__skb_gso_segment) from [<8133b028>] (validate_xmit_skb+0x19c/0x374 net/core/dev.c:3659) r7:e079dcf7 r6:00000000 r5:00006869 r4:8617ea80 [<8133ae8c>] (validate_xmit_skb) from [<8133b240>] (validate_xmit_skb_list+0x40/0x74 net/core/dev.c:3709) r10:00000011 r9:e079dcf7 r8:00000000 r7:85804000 r6:84cea800 r5:00000000 r4:00000000 [<8133b200>] (validate_xmit_skb_list) from [<813aab3c>] (sch_direct_xmit+0x1c0/0x45c net/sched/sch_generic.c:327) r9:00000001 r8:00000000 r7:85804000 r6:84cea800 r5:8617ea80 r4:84a73000 [<813aa97c>] (sch_direct_xmit) from [<8133be20>] (__dev_xmit_skb net/core/dev.c:3805 [inline]) [<813aa97c>] (sch_direct_xmit) from [<8133be20>] (__dev_queue_xmit+0x568/0xdc8 net/core/dev.c:4210) r9:84a730c4 r8:a3ea38c0 r7:00000001 r6:00000000 r5:84a73000 r4:8617ea80 [<8133b8b8>] (__dev_queue_xmit) from [<81634fac>] (dev_queue_xmit include/linux/netdevice.h:3088 [inline]) [<8133b8b8>] (__dev_queue_xmit) from [<81634fac>] (packet_xmit net/packet/af_packet.c:276 [inline]) [<8133b8b8>] (__dev_queue_xmit) from [<81634fac>] (packet_xmit+0x9c/0x100 net/packet/af_packet.c:273) r10:89f1ff00 r9:84c5b000 r8:8617ea80 r7:0000000a r6:85804000 r5:00002378 r4:8617ea80 [<81634f10>] (packet_xmit) from [<81638700>] (packet_snd net/packet/af_packet.c:3081 [inline]) [<81634f10>] (packet_xmit) from [<81638700>] (packet_sendmsg+0xec8/0x1448 net/packet/af_packet.c:3113) r7:0000000a r6:85804000 r5:00002378 r4:84c5b000 [<81637838>] (packet_sendmsg) from [<8130da78>] (sock_sendmsg_nosec net/socket.c:724 [inline]) [<81637838>] (packet_sendmsg) from [<8130da78>] (sock_sendmsg+0x44/0x78 net/socket.c:747) r10:00000122 r9:85c2de00 r8:80200288 r7:04000002 r6:85479400 r5:e079de98 r4:00000000 [<8130da34>] (sock_sendmsg) from [<8130f8cc>] (__sys_sendto+0xd0/0x11c net/socket.c:2144) r7:04000002 r6:00000000 r5:85479400 r4:00000000 [<8130f7fc>] (__sys_sendto) from [<8130f934>] (__do_sys_sendto net/socket.c:2156 [inline]) [<8130f7fc>] (__sys_sendto) from [<8130f934>] (sys_sendto+0x1c/0x24 net/socket.c:2152) r7:00000122 r6:0014c2c4 r5:000002ff r4:00000000 [<8130f918>] (sys_sendto) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:66) Exception stack(0xe079dfa8 to 0xe079dff0) dfa0: 00000000 000002ff 00000003 20000080 00002378 04000002 dfc0: 00000000 000002ff 0014c2c4 00000122 7e8403c2 76b706d0 7e840534 76b7020c dfe0: 76b70020 76b70010 00017004 0004df80 Code: e0b22003 e0b22004 e0b22005 e0b2200e (e8b04038) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: e0b22003 adcs r2, r2, r3 4: e0b22004 adcs r2, r2, r4 8: e0b22005 adcs r2, r2, r5 c: e0b2200e adcs r2, r2, lr * 10: e8b04038 ldm r0!, {r3, r4, r5, lr} <-- trapping instruction