BUG: unable to handle page fault for address: ffff8881d8ff71c8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
PGD 7401067 P4D 7401067 PUD 1e1ba6063 PMD 1d8ebf063 PTE 80000001d8ff7161
Oops: 0003 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4222 Comm: syz.6.1059 Not tainted 5.4.290-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:__hlist_del include/linux/list.h:791 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:824 [inline]
RIP: 0010:detach_if_pending+0x1c6/0x3d0 kernel/time/timer.c:841
Code: 74 58 e8 7d c2 0f 00 48 83 c3 08 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 6a 63 40 00 <4c> 89 3b 80 7d cc 00 74 32 e8 4c c2 0f 00 48 b8 00 00 00 00 00 fc
RSP: 0018:ffff8881e00b7aa8 EFLAGS: 00010046
RAX: 1ffff1103b1fee39 RBX: ffff8881d8ff71c8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000013c00000 RDI: 0000000080400000
RBP: ffff8881e00b7af0 R08: ffffffff8155d736 R09: 0000000000000003
R10: ffffed103c016f40 R11: dffffc0000000001 R12: 1ffff1103aa8c639
R13: ffff8881d54631c0 R14: ffff8881d54631c8 R15: ffff8881f6e497e0
FS:  0000555560193500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8881d8ff71c8 CR3: 00000001d97d6000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 try_to_del_timer_sync kernel/time/timer.c:1267 [inline]
 del_timer_sync+0x13c/0x230 kernel/time/timer.c:1410
 tun_flow_uninit+0x2f/0x290 drivers/net/tun.c:1452
 tun_free_netdev+0x7a/0x1b0 drivers/net/tun.c:2404
 netdev_run_todo+0xb7f/0xdf0 net/core/dev.c:9477
 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:112
 tun_detach drivers/net/tun.c:766 [inline]
 tun_chr_close+0xc4/0x140 drivers/net/tun.c:3563
 __fput+0x289/0x6c0 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x146/0x170 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x194/0x1b0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode+0x19c/0x200 arch/x86/entry/common.c:194
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x144/0x170 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f974b376dca
Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 43 91 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 a3 91 02 00 8b 44 24
RSP: 002b:00007ffce332c9c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 00007f974b376dca
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007
RBP: 00007f974b5a1ba0 R08: 0000000000000001 R09: 0000001ee332cccf
R10: 00007f974b1ea000 R11: 0000000000000293 R12: 00007f974b59ffac
R13: 00007f974b59ffa0 R14: ffffffffffffffff R15: 00007ffce332caf0
Modules linked in:
CR2: ffff8881d8ff71c8
---[ end trace 115bca72093f1df4 ]---
RIP: 0010:__hlist_del include/linux/list.h:791 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:824 [inline]
RIP: 0010:detach_if_pending+0x1c6/0x3d0 kernel/time/timer.c:841
Code: 74 58 e8 7d c2 0f 00 48 83 c3 08 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 df e8 6a 63 40 00 <4c> 89 3b 80 7d cc 00 74 32 e8 4c c2 0f 00 48 b8 00 00 00 00 00 fc
RSP: 0018:ffff8881e00b7aa8 EFLAGS: 00010046
RAX: 1ffff1103b1fee39 RBX: ffff8881d8ff71c8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000013c00000 RDI: 0000000080400000
RBP: ffff8881e00b7af0 R08: ffffffff8155d736 R09: 0000000000000003
R10: ffffed103c016f40 R11: dffffc0000000001 R12: 1ffff1103aa8c639
R13: ffff8881d54631c0 R14: ffff8881d54631c8 R15: ffff8881f6e497e0
FS:  0000555560193500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8881d8ff71c8 CR3: 00000001d97d6000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	74 58                	je     0x5a
   2:	e8 7d c2 0f 00       	call   0xfc284
   7:	48 83 c3 08          	add    $0x8,%rbx
   b:	48 89 d8             	mov    %rbx,%rax
   e:	48 c1 e8 03          	shr    $0x3,%rax
  12:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  19:	fc ff df
  1c:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1)
  20:	74 08                	je     0x2a
  22:	48 89 df             	mov    %rbx,%rdi
  25:	e8 6a 63 40 00       	call   0x406394
* 2a:	4c 89 3b             	mov    %r15,(%rbx) <-- trapping instruction
  2d:	80 7d cc 00          	cmpb   $0x0,-0x34(%rbp)
  31:	74 32                	je     0x65
  33:	e8 4c c2 0f 00       	call   0xfc284
  38:	48                   	rex.W
  39:	b8 00 00 00 00       	mov    $0x0,%eax
  3e:	00 fc                	add    %bh,%ah