Oops: general protection fault, probably for non-canonical address 0xdffffc0000000143: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000a18-0x0000000000000a1f] CPU: 0 UID: 0 PID: 7071 Comm: syz.0.697 Not tainted 6.11.0-syzkaller-07462-g1868f9d0260e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__lock_acquire+0x69/0x2050 kernel/locking/lockdep.c:5062 Code: b6 04 30 84 c0 0f 85 9b 16 00 00 45 31 f6 83 3d d8 59 ac 0e 00 0f 84 b6 13 00 00 89 54 24 54 89 5c 24 68 4c 89 f8 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 ff e8 19 1e 8c 00 48 be 00 00 00 00 00 fc RSP: 0018:ffffc9000384ec50 EFLAGS: 00010012 RAX: 0000000000000143 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000a18 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 R10: dffffc0000000000 R11: fffffbfff2038b06 R12: ffff888025b21e00 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000a18 FS: 00007f39eb1f06c0(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f39eb1eff98 CR3: 000000007bc52000 CR4: 0000000000350ef0 Call Trace: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5822 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xb0/0x1480 kernel/sched/core.c:4123 rxrpc_wake_up_io_thread net/rxrpc/ar-internal.h:1059 [inline] rxrpc_encap_rcv+0x158/0x200 net/rxrpc/io_thread.c:50 udp_queue_rcv_one_skb+0x161b/0x1820 net/ipv4/udp.c:2133 udp_unicast_rcv_skb+0x253/0x3d0 net/ipv4/udp.c:2371 __udp4_lib_rcv+0x1812/0x2710 net/ipv4/udp.c:2435 ip_protocol_deliver_rcu+0x290/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 NF_HOOK+0x3a6/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a6/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5662 [inline] __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5775 netif_receive_skb_internal net/core/dev.c:5861 [inline] netif_receive_skb+0x1e8/0x890 net/core/dev.c:5920 tun_rx_batched+0x1b7/0x8f0 drivers/net/tun.c:1550 tun_get_user+0x3056/0x47e0 drivers/net/tun.c:2007 tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2053 new_sync_write fs/read_write.c:590 [inline] vfs_write+0xa6f/0xc90 fs/read_write.c:683 ksys_write+0x1a0/0x2c0 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f39ea37c9df Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48 RSP: 002b:00007f39eb1f0000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f39ea536058 RCX: 00007f39ea37c9df RDX: 000000000000003a RSI: 0000000020000200 RDI: 00000000000000c8 RBP: 00007f39ea3f0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000003a R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f39ea536058 R15: 00007fff02200508 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__lock_acquire+0x69/0x2050 kernel/locking/lockdep.c:5062 Code: b6 04 30 84 c0 0f 85 9b 16 00 00 45 31 f6 83 3d d8 59 ac 0e 00 0f 84 b6 13 00 00 89 54 24 54 89 5c 24 68 4c 89 f8 48 c1 e8 03 <80> 3c 30 00 74 12 4c 89 ff e8 19 1e 8c 00 48 be 00 00 00 00 00 fc RSP: 0018:ffffc9000384ec50 EFLAGS: 00010012 RAX: 0000000000000143 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000a18 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 R10: dffffc0000000000 R11: fffffbfff2038b06 R12: ffff888025b21e00 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000a18 FS: 00007f39eb1f06c0(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f39eb1eff98 CR3: 000000007bc52000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: b6 04 mov $0x4,%dh 2: 30 84 c0 0f 85 9b 16 xor %al,0x169b850f(%rax,%rax,8) 9: 00 00 add %al,(%rax) b: 45 31 f6 xor %r14d,%r14d e: 83 3d d8 59 ac 0e 00 cmpl $0x0,0xeac59d8(%rip) # 0xeac59ed 15: 0f 84 b6 13 00 00 je 0x13d1 1b: 89 54 24 54 mov %edx,0x54(%rsp) 1f: 89 5c 24 68 mov %ebx,0x68(%rsp) 23: 4c 89 f8 mov %r15,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 30 00 cmpb $0x0,(%rax,%rsi,1) <-- trapping instruction 2e: 74 12 je 0x42 30: 4c 89 ff mov %r15,%rdi 33: e8 19 1e 8c 00 call 0x8c1e51 38: 48 rex.W 39: be 00 00 00 00 mov $0x0,%esi 3e: 00 fc add %bh,%ah