------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/ipv6/route.c:1095:9
index 203 is out of range for type 'const int[12]'
CPU: 1 UID: 0 PID: 5948 Comm: udevd Not tainted 6.15.0-rc3-syzkaller-00584-gcc17b4b9c332 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
ubsan_epilogue+0xa/0x40 lib/ubsan.c:231
__ubsan_handle_out_of_bounds+0xe9/0xf0 lib/ubsan.c:453
ip6_rt_type_to_error net/ipv6/route.c:1095 [inline]
ip6_rt_init_dst_reject net/ipv6/route.c:1112 [inline]
ip6_rt_init_dst net/ipv6/route.c:1137 [inline]
ip6_rt_copy_init+0x8e7/0x970 net/ipv6/route.c:1175
ip6_rt_pcpu_alloc net/ipv6/route.c:1424 [inline]
rt6_make_pcpu_route net/ipv6/route.c:1467 [inline]
ip6_pol_route+0xbac/0x1180 net/ipv6/route.c:2302
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x348/0x6f0 net/ipv6/fib6_rules.c:125
ip6_route_output_flags_noref net/ipv6/route.c:2674 [inline]
ip6_route_output_flags+0x364/0x5d0 net/ipv6/route.c:2686
ip6_route_output include/net/ip6_route.h:93 [inline]
ip6_dst_lookup_tail+0x1ae/0x1510 net/ipv6/ip6_output.c:1128
ip6_dst_lookup_flow+0x47/0xe0 net/ipv6/ip6_output.c:1259
udp_tunnel6_dst_lookup+0x231/0x3c0 net/ipv6/ip6_udp_tunnel.c:165
geneve6_xmit_skb drivers/net/geneve.c:957 [inline]
geneve_xmit+0xd2e/0x2b70 drivers/net/geneve.c:1043
__netdev_start_xmit include/linux/netdevice.h:5203 [inline]
netdev_start_xmit include/linux/netdevice.h:5212 [inline]
xmit_one net/core/dev.c:3828 [inline]
dev_hard_start_xmit+0x2d4/0x830 net/core/dev.c:3844
__dev_queue_xmit+0x1adf/0x3a70 net/core/dev.c:4681
dev_queue_xmit include/linux/netdevice.h:3349 [inline]
neigh_hh_output include/net/neighbour.h:523 [inline]
neigh_output include/net/neighbour.h:537 [inline]
ip6_finish_output2+0x11bc/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xb47/0x1400 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4038
call_timer_fn+0x17b/0x5f0 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2445
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa8/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 3b 70 6e f6 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4f f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 53 f3 37 f6 65 8b 05 5c f5 1c 07 85 c0 74 40 48 c7 04 24 0e 36
RSP: 0018:ffffc900045f7660 EFLAGS: 00000206
RAX: 0ef35e795f9e8000 RBX: 0000000000000a06 RCX: 0ef35e795f9e8000
RDX: 0000000000000006 RSI: ffffffff8d74d674 RDI: 0000000000000001
RBP: ffffc900045f76f8 R08: ffffffff8f7f1877 R09: 1ffffffff1efe30e
R10: dffffc0000000000 R11: fffffbfff1efe30f R12: dffffc0000000000
R13: 1ffff11017127ee0 R14: ffff88813fffc180 R15: 1ffff920008beecc
free_frozen_page_commit+0x4ba/0xff0 mm/page_alloc.c:2695
__free_frozen_pages+0x688/0xce0 mm/page_alloc.c:2749
discard_slab mm/slub.c:2730 [inline]
__put_partials+0x161/0x1c0 mm/slub.c:3199
put_cpu_partial+0x17c/0x250 mm/slub.c:3274
__slab_free+0x2f7/0x400 mm/slub.c:4526
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4161 [inline]
slab_alloc_node mm/slub.c:4210 [inline]
__do_kmalloc_node mm/slub.c:4340 [inline]
__kmalloc_noprof+0x224/0x4f0 mm/slub.c:4353
kmalloc_noprof include/linux/slab.h:909 [inline]
tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x213/0x4b0 security/tomoyo/file.c:822
security_inode_getattr+0x12f/0x330 security/security.c:2377
vfs_getattr fs/stat.c:256 [inline]
vfs_fstat fs/stat.c:278 [inline]
vfs_fstatat+0xad/0x160 fs/stat.c:370
__do_sys_newfstatat fs/stat.c:536 [inline]
__se_sys_newfstatat fs/stat.c:530 [inline]
__x64_sys_newfstatat+0x11c/0x1a0 fs/stat.c:530
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7ff0b165f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007fff0318ed98 EFLAGS: 00000206 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007f7ff0bee460 RCX: 00007f7ff0b165f4
RDX: 00007fff0318eda0 RSI: 00007f7ff0bb3130 RDI: 0000000000000009
RBP: 000055c35ad565d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000003fff R14: 00007fff0318f338 R15: 000000000000000a
---[ end trace ]---
----------------
Code disassembly (best guess):
0: 74 05 je 0x7
2: e8 3b 70 6e f6 call 0xf66e7042
7: 48 c7 44 24 20 00 00 movq $0x0,0x20(%rsp)
e: 00 00
10: 9c pushf
11: 8f 44 24 20 pop 0x20(%rsp)
15: f6 44 24 21 02 testb $0x2,0x21(%rsp)
1a: 75 4f jne 0x6b
1c: f7 c3 00 02 00 00 test $0x200,%ebx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 53 f3 37 f6 call 0xf637f382 <-- trapping instruction
2f: 65 8b 05 5c f5 1c 07 mov %gs:0x71cf55c(%rip),%eax # 0x71cf592
36: 85 c0 test %eax,%eax
38: 74 40 je 0x7a
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss