Oops: general protection fault, probably for non-canonical address 0xdffffc0000000013: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000098-0x000000000000009f] CPU: 1 UID: 0 PID: 7012 Comm: syz.6.324 Not tainted 6.14.0-rc5-syzkaller-00013-g99fa936e8e4f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1411 [inline] RIP: 0010:ip6_pol_route+0x4d1/0x15d0 net/ipv6/route.c:2264 Code: 84 f7 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 96 4d 1d f7 4d 85 f6 0f 84 da 00 00 00 49 8d 9e 98 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 12 0f 00 00 44 8b 3b 31 ff 44 89 fe e8 RSP: 0018:ffffc90003ace6e0 EFLAGS: 00010212 RAX: 0000000000000013 RBX: 000000000000009a RCX: ffff88802bab1e00 RDX: ffffc9001d1dc000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc90003ace830 R08: ffffffff8aa4766a R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff2079e2f R12: ffffc90003ace7b0 R13: 1ffff92000759cf6 R14: 0000000000000002 R15: dffffc0000000000 FS: 00007f55905bf6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3041cff8 CR3: 000000002a4bc000 CR4: 0000000000350ef0 Call Trace: pol_lookup_func include/net/ip6_fib.h:616 [inline] fib6_rule_lookup+0x286/0x790 net/ipv6/fib6_rules.c:119 ip6_route_output_flags_noref net/ipv6/route.c:2639 [inline] ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2651 ip6_route_output include/net/ip6_route.h:93 [inline] ip6_dst_lookup_tail+0x1b3/0x1500 net/ipv6/ip6_output.c:1128 ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1259 sctp_v6_get_dst+0x7a6/0x1e30 net/sctp/ipv6.c:326 sctp_transport_route+0x12e/0x2e0 net/sctp/transport.c:455 sctp_assoc_add_peer+0x611/0x1360 net/sctp/associola.c:663 sctp_process_param net/sctp/sm_make_chunk.c:2576 [inline] sctp_process_init+0xe40/0x2b20 net/sctp/sm_make_chunk.c:2396 sctp_sf_do_unexpected_init+0xb5f/0x11d0 net/sctp/sm_statefuns.c:1612 sctp_do_sm+0x1f3/0x60c0 net/sctp/sm_sideeffect.c:1166 sctp_assoc_bh_rcv+0x3f1/0x640 net/sctp/associola.c:1052 sctp_backlog_rcv+0x177/0x3f0 net/sctp/input.c:331 sk_backlog_rcv include/net/sock.h:1122 [inline] __release_sock+0x245/0x350 net/core/sock.c:3123 release_sock+0x61/0x1f0 net/core/sock.c:3677 sctp_wait_for_connect+0x3ce/0x6e0 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1404/0x1800 net/sctp/socket.c:1885 sctp_sendmsg+0x242e/0x35d0 net/sctp/socket.c:2031 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:733 __sys_sendto+0x363/0x4c0 net/socket.c:2187 __do_sys_sendto net/socket.c:2194 [inline] __se_sys_sendto net/socket.c:2190 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2190 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f558f78d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f55905bf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f558f9a5fa0 RCX: 00007f558f78d169 RDX: 0000000000034000 RSI: 0000400000847fff RDI: 0000000000000003 RBP: 00007f558f80e2a0 R08: 000040000005ffe4 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f558f9a5fa0 R15: 00007ffcb1e294b8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:rt6_get_pcpu_route net/ipv6/route.c:1411 [inline] RIP: 0010:ip6_pol_route+0x4d1/0x15d0 net/ipv6/route.c:2264 Code: 84 f7 48 8b 03 65 4c 8b 30 31 ff 4c 89 f6 e8 96 4d 1d f7 4d 85 f6 0f 84 da 00 00 00 49 8d 9e 98 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 38 84 c0 0f 85 12 0f 00 00 44 8b 3b 31 ff 44 89 fe e8 RSP: 0018:ffffc90003ace6e0 EFLAGS: 00010212 RAX: 0000000000000013 RBX: 000000000000009a RCX: ffff88802bab1e00 RDX: ffffc9001d1dc000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc90003ace830 R08: ffffffff8aa4766a R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff2079e2f R12: ffffc90003ace7b0 R13: 1ffff92000759cf6 R14: 0000000000000002 R15: dffffc0000000000 FS: 00007f55905bf6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3041cff8 CR3: 000000002a4bc000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 84 f7 test %dh,%bh 2: 48 8b 03 mov (%rbx),%rax 5: 65 4c 8b 30 mov %gs:(%rax),%r14 9: 31 ff xor %edi,%edi b: 4c 89 f6 mov %r14,%rsi e: e8 96 4d 1d f7 call 0xf71d4da9 13: 4d 85 f6 test %r14,%r14 16: 0f 84 da 00 00 00 je 0xf6 1c: 49 8d 9e 98 00 00 00 lea 0x98(%r14),%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 12 0f 00 00 jne 0xf49 37: 44 8b 3b mov (%rbx),%r15d 3a: 31 ff xor %edi,%edi 3c: 44 89 fe mov %r15d,%esi 3f: e8 .byte 0xe8