Oops: general protection fault, probably for non-canonical address 0xdffffc0000000083: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000418-0x000000000000041f]
CPU: 0 UID: 0 PID: 30067 Comm: syz.3.6063 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:270 [inline]
RIP: 0010:fib_lookup_good_nhc+0xaf/0x3f0 net/ipv4/fib_trie.c:1408
Code: df 48 c1 ea 03 80 3c 02 00 0f 85 1e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 2b 48 8d bd 18 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ef 02 00 00 4c 8b bd 18 04 00 00 e8 3b b9 7b 01
RSP: 0018:ffffc900000070f8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888029faa320 RCX: ffffffff8a15d697
RDX: 0000000000000083 RSI: ffffffff8a15d6b9 RDI: 0000000000000418
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900000074a8
R13: ffff888029faa337 R14: 0000000000000001 R15: ffff88806986da18
FS: 0000000000000000(0000) GS:ffff8880974ba000(0063) knlGS:00000000f546cb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000800eb018 CR3: 000000006c9f4000 CR4: 0000000000352ef0
Call Trace:
nexthop_get_nhc_lookup include/net/nexthop.h:437 [inline]
fib_table_lookup+0x158e/0x2300 net/ipv4/fib_trie.c:1584
fib_lookup.constprop.0+0x13e/0x530 include/net/ip_fib.h:390
ip_route_output_key_hash_rcu+0xde2/0x28e0 net/ipv4/route.c:2809
ip_route_output_key_hash+0x137/0x2e0 net/ipv4/route.c:2700
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x27/0x150 net/ipv4/route.c:2927
ip_route_output_key include/net/route.h:179 [inline]
ip_tunnel_xmit+0x1933/0x37b0 net/ipv4/ip_tunnel.c:795
__gre_xmit+0x8bb/0xc00 net/ipv4/ip_gre.c:488
ipgre_xmit+0x523/0xb10 net/ipv4/ip_gre.c:692
__netdev_start_xmit include/linux/netdevice.h:5222 [inline]
netdev_start_xmit include/linux/netdevice.h:5231 [inline]
xmit_one net/core/dev.c:3839 [inline]
dev_hard_start_xmit+0x97/0x740 net/core/dev.c:3855
__dev_queue_xmit+0xa46/0x4490 net/core/dev.c:4725
dev_queue_xmit include/linux/netdevice.h:3361 [inline]
neigh_connected_output+0x3da/0x620 net/core/neighbour.c:1624
neigh_output include/net/neighbour.h:547 [inline]
ip_finish_output2+0x7f5/0x21a0 net/ipv4/ip_output.c:235
__ip_finish_output.part.0+0x1b4/0x350 net/ipv4/ip_output.c:313
__ip_finish_output net/ipv4/ip_output.c:301 [inline]
ip_finish_output net/ipv4/ip_output.c:323 [inline]
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x35e/0xa10 net/ipv4/ip_output.c:436
dst_output include/net/dst.h:461 [inline]
ip_local_out+0x38d/0x4d0 net/ipv4/ip_output.c:129
igmpv3_send_cr net/ipv4/igmp.c:726 [inline]
igmp_ifc_timer_expire+0x781/0x1020 net/ipv4/igmp.c:816
call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7288
Code: df 55 65 48 8b 2d 0c 9a 43 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 8f 5b f5 f5 e8 7a 29 30 f6 fb bf 01 00 00 00 af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 8d e6 f4
RSP: 0018:ffffc90006617288 EFLAGS: 00000206
RAX: 00000000000012d7 RBX: ffffed10048ba910 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8de4f4d1 RDI: 0000000000000001
RBP: ffff8880245d4880 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90aba997 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x36/0x90 kernel/entry/common.c:197
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872
Code: fd 3e 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 a2 46 14 0f 0f 82 74 02 00 00 8b 35 3a 78 14 0f 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 f9 fc 3e 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc90006617350 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e5c1420 RCX: 000000007242d070
RDX: 0000000000000000 RSI: ffffffff8de29fdd RDI: ffffffff8c163700
RBP: 0000000000000002 R08: 5d47c700801c3d6c R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4376 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4388
kmalloc_noprof include/linux/slab.h:909 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
new_dir fs/proc/proc_sysctl.c:966 [inline]
get_subdir fs/proc/proc_sysctl.c:1010 [inline]
sysctl_mkdir_p fs/proc/proc_sysctl.c:1320 [inline]
__register_sysctl_table+0xea2/0x1900 fs/proc/proc_sysctl.c:1395
__addrconf_sysctl_register+0x1a2/0x360 net/ipv6/addrconf.c:7321
addrconf_sysctl_register net/ipv6/addrconf.c:7369 [inline]
addrconf_sysctl_register+0x15f/0x1f0 net/ipv6/addrconf.c:7358
ipv6_add_dev+0xb31/0x15f0 net/ipv6/addrconf.c:460
addrconf_notify+0x53e/0x19e0 net/ipv6/addrconf.c:3650
notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2229
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
register_netdevice+0x182e/0x2270 net/core/dev.c:11244
register_netdev+0x34/0x50 net/core/dev.c:11322
loopback_net_init+0x7a/0x170 drivers/net/loopback.c:218
ops_init+0x1e2/0x5f0 net/core/net_namespace.c:136
setup_net+0x10f/0x380 net/core/net_namespace.c:438
copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:570
create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218
ksys_unshare+0x45b/0xa40 kernel/fork.c:3127
__do_sys_unshare kernel/fork.c:3198 [inline]
__se_sys_unshare kernel/fork.c:3196 [inline]
__ia32_sys_unshare+0x30/0x40 kernel/fork.c:3196
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x7c/0x300 arch/x86/entry/syscall_32.c:306
do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf70be579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f546c55c EFLAGS: 00000296 ORIG_RAX: 0000000000000136
RAX: ffffffffffffffda RBX: 0000000046000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:270 [inline]
RIP: 0010:fib_lookup_good_nhc+0xaf/0x3f0 net/ipv4/fib_trie.c:1408
Code: df 48 c1 ea 03 80 3c 02 00 0f 85 1e 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 2b 48 8d bd 18 04 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ef 02 00 00 4c 8b bd 18 04 00 00 e8 3b b9 7b 01
RSP: 0018:ffffc900000070f8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888029faa320 RCX: ffffffff8a15d697
RDX: 0000000000000083 RSI: ffffffff8a15d6b9 RDI: 0000000000000418
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900000074a8
R13: ffff888029faa337 R14: 0000000000000001 R15: ffff88806986da18
FS: 0000000000000000(0000) GS:ffff8880974ba000(0063) knlGS:00000000f546cb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000800eb018 CR3: 000000006c9f4000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 1e 03 00 00 jne 0x32c
e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
15: fc ff df
18: 48 8b 2b mov (%rbx),%rbp
1b: 48 8d bd 18 04 00 00 lea 0x418(%rbp),%rdi
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2d: 0f 85 ef 02 00 00 jne 0x322
33: 4c 8b bd 18 04 00 00 mov 0x418(%rbp),%r15
3a: e8 3b b9 7b 01 call 0x17bb97a