general protection fault, probably for non-canonical address 0xdffffc0000000066: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000330-0x0000000000000337] CPU: 0 PID: 4260 Comm: syz-executor.4 Not tainted 5.7.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ax25_send_frame+0xe1/0x660 net/ax25/ax25_out.c:56 Code: c6 00 00 48 85 c0 0f 85 0c 04 00 00 e8 f8 6f 76 fa 49 8d bc 24 30 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 d2 04 00 00 49 8b 84 24 30 03 00 00 48 85 c0 48 RSP: 0018:ffffc90000007ab8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8880a6220408 RCX: 1ffffffff187130f RDX: 0000000000000066 RSI: ffffffff86fcc488 RDI: 0000000000000330 RBP: ffffffff8d22c740 R08: 0000000000000001 R09: fffffbfff185dd62 R10: ffffffff8c2eeb0f R11: fffffbfff185dd61 R12: 0000000000000000 R13: 0000000000000104 R14: 0000000000000000 R15: ffff88809ee8d340 FS: 00007ff332c44700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff39fcb288 CR3: 0000000094efb000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rose_send_frame+0xcc/0x2f0 net/rose/rose_link.c:106 rose_transmit_clear_request+0x1de/0x290 net/rose/rose_link.c:255 rose_rx_call_request+0x488/0x1960 net/rose/af_rose.c:976 rose_loopback_timer+0x15d/0x470 net/rose/rose_loopback.c:100 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1405 expire_timers kernel/time/timer.c:1450 [inline] __run_timers kernel/time/timer.c:1774 [inline] __run_timers kernel/time/timer.c:1741 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1787 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1140 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:92 [inline] RIP: 0010:memory_is_nonzero mm/kasan/generic.c:109 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline] RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline] RIP: 0010:check_memory_region_inline mm/kasan/generic.c:184 [inline] RIP: 0010:check_memory_region+0xdf/0x190 mm/kasan/generic.c:193 Code: 74 f2 49 89 c0 b8 01 00 00 00 4d 85 c0 75 61 5b 5d 41 5c c3 4d 85 c9 74 4d 49 01 d9 eb 09 48 83 c0 01 4c 39 c8 74 3f 80 38 00 <74> f2 eb d4 41 bc 08 00 00 00 45 29 c4 49 89 d8 4d 8d 0c 1c eb 0c RSP: 0018:ffffc90005367288 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: fffff52000a6ce7a RBX: fffff52000a6ce70 RCX: ffffffff81327e73 RDX: 0000000000000001 RSI: 0000000000000060 RDI: ffffc90005367380 RBP: fffff52000a6ce7c R08: 0000000000000001 R09: fffff52000a6ce7c R10: ffffc900053673df R11: fffff52000a6ce7b R12: 0000000000000060 R13: 0000000000000000 R14: dffffc0000000000 R15: ffffc90005367380 memset+0x20/0x40 mm/kasan/common.c:85 memset include/linux/string.h:366 [inline] __unwind_start+0x83/0x870 arch/x86/kernel/unwind_orc.c:623 unwind_start arch/x86/include/asm/unwind.h:60 [inline] arch_stack_walk+0x5e/0xf0 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123 save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc_node mm/slab.c:3263 [inline] kmem_cache_alloc_node_trace+0x14b/0x790 mm/slab.c:3593 __do_kmalloc_node mm/slab.c:3615 [inline] __kmalloc_node_track_caller+0x38/0x60 mm/slab.c:3630 __kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:142 __alloc_skb+0xef/0x5a0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1083 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:289 uevent_net_broadcast_tagged lib/kobject_uevent.c:350 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:411 [inline] kobject_uevent_env+0xee5/0x11f0 lib/kobject_uevent.c:592 netdev_queue_add_kobject net/core/net-sysfs.c:1523 [inline] netdev_queue_update_kobjects+0x2ee/0x3c0 net/core/net-sysfs.c:1557 register_queue_kobjects net/core/net-sysfs.c:1618 [inline] netdev_register_kobject+0x297/0x3b0 net/core/net-sysfs.c:1861 register_netdevice+0xa80/0x10b0 net/core/dev.c:9404 __ip_tunnel_create+0x349/0x510 net/ipv4/ip_tunnel.c:265 ip_tunnel_init_net+0x370/0x9e0 net/ipv4/ip_tunnel.c:1056 ops_init+0xaf/0x420 net/core/net_namespace.c:151 setup_net+0x2de/0x860 net/core/net_namespace.c:341 copy_net_ns+0x293/0x590 net/core/net_namespace.c:482 create_new_namespaces+0x3fb/0xb30 kernel/nsproxy.c:108 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:229 ksys_unshare+0x43d/0x8e0 kernel/fork.c:2970 __do_sys_unshare kernel/fork.c:3038 [inline] __se_sys_unshare kernel/fork.c:3036 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3036 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45ca29 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff332c43c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 000000000050a1c0 RCX: 000000000045ca29 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000c4e R14: 00000000004ce9bd R15: 00007ff332c446d4 Modules linked in: ---[ end trace bf59b4a64f9420bb ]--- RIP: 0010:ax25_send_frame+0xe1/0x660 net/ax25/ax25_out.c:56 Code: c6 00 00 48 85 c0 0f 85 0c 04 00 00 e8 f8 6f 76 fa 49 8d bc 24 30 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 d2 04 00 00 49 8b 84 24 30 03 00 00 48 85 c0 48 RSP: 0018:ffffc90000007ab8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8880a6220408 RCX: 1ffffffff187130f RDX: 0000000000000066 RSI: ffffffff86fcc488 RDI: 0000000000000330 RBP: ffffffff8d22c740 R08: 0000000000000001 R09: fffffbfff185dd62 R10: ffffffff8c2eeb0f R11: fffffbfff185dd61 R12: 0000000000000000 R13: 0000000000000104 R14: 0000000000000000 R15: ffff88809ee8d340 FS: 00007ff332c44700(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff39fcb288 CR3: 0000000094efb000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400