kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 29387 Comm: syz-executor3 Not tainted 4.9.80-g20c8a00 #38 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801b4ea9800 task.stack: ffff8801d0768000 RIP: 0010:[] [] addrconf_rt_table+0x127/0x290 net/ipv6/addrconf.c:2220 RSP: 0018:ffff8801d076ece8 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000200 RCX: ffffffff83442d36 RDX: 0000000000000056 RSI: 0000000000000001 RDI: 00000000000002b0 RBP: ffff8801d076ed18 R08: 1ffff100369d541a R09: 0000000000000001 R10: 0000000000000000 R11: ffff8801b4ea9800 R12: 0000000000000000 R13: 00000000000000fe R14: ffff8801d6efc000 R15: 0000000000000080 FS: 0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f6f83b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000008340008 CR3: 00000001cba48000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff83442c40 ffff8801d6efc000 0000000000000000 ffff8801be6d7310 ffff8801d9831b00 0000000000000080 ffff8801d076ed60 ffffffff83443684 0000000000000000 ffff8801be6d7310 ffff8801be6d7180 ffff8801b1071a40 Call Trace: [] addrconf_get_prefix_route+0x34/0x270 net/ipv6/addrconf.c:2274 [] __ipv6_ifa_notify+0x5bd/0x820 net/ipv6/addrconf.c:5493 [] addrconf_ifdown+0x923/0x10f0 net/ipv6/addrconf.c:3686 [] addrconf_notify+0x948/0x2230 net/ipv6/addrconf.c:3490 [] notifier_call_chain+0x90/0x1a0 kernel/notifier.c:93 [] __raw_notifier_call_chain kernel/notifier.c:394 [inline] [] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 [] call_netdevice_notifiers_info+0x51/0x90 net/core/dev.c:1647 [] call_netdevice_notifiers net/core/dev.c:1663 [inline] [] dev_set_mtu+0x216/0x3b0 net/core/dev.c:6577 [] do_setlink+0x5b9/0x2f80 net/core/rtnetlink.c:1986 [] rtnl_newlink+0xd6d/0x1550 net/core/rtnetlink.c:2557 [] rtnetlink_rcv_msg+0x4c3/0x640 net/core/rtnetlink.c:4059 [] netlink_rcv_skb+0x13e/0x370 net/netlink/af_netlink.c:2351 [] rtnetlink_rcv+0x2a/0x40 net/core/rtnetlink.c:4065 [] netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline] [] netlink_unicast+0x511/0x750 net/netlink/af_netlink.c:1301 [] netlink_sendmsg+0x8e8/0xc50 net/netlink/af_netlink.c:1847 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2003 [] C_SYSC_sendmsg net/compat.c:734 [inline] [] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:732 [] do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline] [] do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384 [] entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127 Code: 83 be 01 00 00 00 48 c7 c7 60 e1 4d 84 e8 92 d4 df fd 49 8d bc 24 b0 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 32 01 00 00 45 8b bc 24 b0 RIP [] addrconf_rt_table+0x127/0x290 net/ipv6/addrconf.c:2220 RSP audit_printk_skb: 1503 callbacks suppressed audit: type=1400 audit(1518127246.762:12763): avc: denied { net_admin } for pid=3887 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1518127246.772:12764): avc: denied { net_admin } for pid=3896 comm="syz-executor2" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---[ end trace cff94161ac6ab4e7 ]---