netlink: 12 bytes leftover after parsing attributes in process `syz.2.714'.
Unable to handle kernel paging request at virtual address dfff80000000006c
Mem abort info:
  ESR = 0x0000000096000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
[dfff80000000006c] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 7329 Comm: syz.2.714 Not tainted 5.15.179-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __in6_dev_get include/net/addrconf.h:321 [inline]
pc : ip6_ignore_linkdown include/net/addrconf.h:412 [inline]
pc : find_match+0x9c/0xb1c net/ipv6/route.c:741
lr : find_match+0x74/0xb1c net/ipv6/route.c:738
sp : ffff8000212a5cd0
x29: ffff8000212a5d00 x28: dfff800000000000 x27: 1fffe0001c72dc04
x26: 0000000000000360 x25: ffff0000e396e02f x24: ffff0000e396e020
x23: 0000000000000002 x22: 0000000000000201 x21: 0000000000000000
x20: 1fffe0001c72dc05 x19: 0000000000000000 x18: 0000000000000400
x17: 0000000000000002 x16: ffff8000084c5698 x15: 000000000000c0fe
x14: 1ffff0000296e06c x13: dfff800000000000 x12: 0000000000080000
x11: 0000000000000400 x10: 0000000000000002 x9 : ffff0000d5acd1c0
x8 : 000000000000006c x7 : ffff8000212a6130 x6 : 0000000000000002
x5 : ffff8000212a6130 x4 : ffff8000212a6120 x3 : 0000000000000002
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __in6_dev_get include/net/addrconf.h:321 [inline]
 ip6_ignore_linkdown include/net/addrconf.h:412 [inline]
 find_match+0x9c/0xb1c net/ipv6/route.c:741
 rt6_nh_find_match+0xcc/0x138 net/ipv6/route.c:781
 nexthop_for_each_fib6_nh+0x1ac/0x3e4 net/ipv4/nexthop.c:1242
 __find_rr_leaf+0x488/0x724 net/ipv6/route.c:822
 find_rr_leaf net/ipv6/route.c:850 [inline]
 rt6_select net/ipv6/route.c:894 [inline]
 fib6_table_lookup+0x36c/0x9c0 net/ipv6/route.c:2183
 ip6_pol_route+0x224/0x1400 net/ipv6/route.c:2219
 ip6_pol_route_output+0x70/0x94 net/ipv6/route.c:2595
 pol_lookup_func include/net/ip6_fib.h:582 [inline]
 fib6_rule_lookup+0x2dc/0x570 net/ipv6/fib6_rules.c:120
 ip6_route_output_flags_noref+0x254/0x324 net/ipv6/route.c:2627
 ip6_route_output_flags+0xe8/0x39c net/ipv6/route.c:2640
 ip6_dst_lookup_tail+0x204/0x10d4 net/ipv6/ip6_output.c:1128
 ip6_dst_lookup_flow+0xb8/0x174 net/ipv6/ip6_output.c:1231
 inet6_csk_route_req+0x420/0x60c net/ipv6/inet6_connection_sock.c:51
 tcp_v6_route_req+0x2d8/0x434 net/ipv6/tcp_ipv6.c:861
 tcp_conn_request+0xb2c/0x2580 net/ipv4/tcp_input.c:6995
 tcp_v6_conn_request+0x268/0x390 net/ipv6/tcp_ipv6.c:1218
 tcp_rcv_state_process+0x117c/0x3dac net/ipv4/tcp_input.c:6512
 tcp_v6_do_rcv+0x73c/0x13a0 net/ipv6/tcp_ipv6.c:1549
 tcp_v6_rcv+0x1bb0/0x236c net/ipv6/tcp_ipv6.c:1753
 ip6_protocol_deliver_rcu+0x8f0/0x1134 net/ipv6/ip6_input.c:425
 ip6_input_finish+0xc8/0x174 net/ipv6/ip6_input.c:466
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip6_input+0x90/0xa8 net/ipv6/ip6_input.c:475
 dst_input include/net/dst.h:462 [inline]
 ip6_rcv_finish+0x1fc/0x234 net/ipv6/ip6_input.c:79
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:300
 __netif_receive_skb_one_core net/core/dev.c:5524 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5638
 netif_receive_skb_internal net/core/dev.c:5724 [inline]
 netif_receive_skb+0x1e0/0x8c4 net/core/dev.c:5783
 tun_rx_batched+0x568/0x6e4 drivers/net/tun.c:-1
 tun_get_user+0x2320/0x3774 drivers/net/tun.c:1989
 tun_chr_write_iter+0xfc/0x20c drivers/net/tun.c:2019
 call_write_iter include/linux/fs.h:2172 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x884/0xb44 fs/read_write.c:594
 ksys_write+0x15c/0x26c fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:656
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 97d168c0 f9400308 910d811a d343ff48 (387c6908) 
---[ end trace 8094f796f22b4115 ]---
----------------
Code disassembly (best guess):
   0:	97d168c0 	bl	0xffffffffff45a300
   4:	f9400308 	ldr	x8, [x24]
   8:	910d811a 	add	x26, x8, #0x360
   c:	d343ff48 	lsr	x8, x26, #3
* 10:	387c6908 	ldrb	w8, [x8, x28] <-- trapping instruction