------------[ cut here ]------------ WARNING: CPU: 0 PID: 13563 at net/core/stream.c:207 sk_stream_kill_queues+0x403/0x570 net/core/stream.c:207 Modules linked in: CPU: 0 PID: 13563 Comm: syz-executor854 Not tainted 5.15.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:sk_stream_kill_queues+0x403/0x570 net/core/stream.c:207 Code: c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f e9 76 82 5a fa e8 71 82 5a fa 89 ee 48 89 df e8 27 a0 fb ff e9 64 ff ff ff e8 5d 82 5a fa <0f> 0b eb 9b e8 54 82 5a fa 0f 0b eb c7 e8 4b 82 5a fa 0f 0b e9 65 RSP: 0018:ffffc900000076f8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88806fa83fc0 RCX: 0000000000000100 RDX: ffff88807a468000 RSI: ffffffff871b86f3 RDI: 0000000000000003 RBP: 00000000fffffe80 R08: 0000000000000000 R09: ffff88806fa84ba7 R10: ffffffff871b868e R11: 000000000000001f R12: ffff88806fa841d8 R13: ffff88806fa84110 R14: ffff88806fa83fe8 R15: ffff88806fa83fc0 FS: 00007f5af156a700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff90af11c8 CR3: 0000000073995000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: inet_csk_destroy_sock+0x1a5/0x490 net/ipv4/inet_connection_sock.c:1012 tcp_done+0x233/0x330 net/ipv4/tcp.c:4395 tcp_reset+0x16f/0x4a0 net/ipv4/tcp_input.c:4312 tcp_validate_incoming+0xfc1/0x1c40 net/ipv4/tcp_input.c:5720 tcp_rcv_state_process+0xa9a/0x4bd0 net/ipv4/tcp_input.c:6448 tcp_v4_do_rcv+0x323/0x880 net/ipv4/tcp_ipv4.c:1716 tcp_v4_rcv+0x27e2/0x3090 net/ipv4/tcp_ipv4.c:2084 ip_protocol_deliver_rcu+0xa7/0xee0 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x20a/0x370 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:460 [inline] ip_rcv_finish+0x1da/0x2f0 net/ipv4/ip_input.c:429 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:540 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5438 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5552 process_backlog+0x2a5/0x6c0 net/core/dev.c:6428 __napi_poll+0xaf/0x440 net/core/dev.c:6993 napi_poll net/core/dev.c:7060 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7147 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:in_task_stack+0x4/0x40 arch/x86/kernel/dumpstack.c:36 Code: 00 00 00 4c 89 ee 48 c7 c7 60 86 79 8b e8 24 10 bd fa e9 5c ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 46 20 <48> 8d 88 00 80 00 00 48 39 f8 77 21 48 39 f9 76 1c 48 89 42 08 b8 RSP: 0018:ffffc9000c49e380 EFLAGS: 00000286 RAX: ffffc9000c498000 RBX: ffff88807a468000 RCX: ffffc9000c49e448 RDX: ffffc9000c49e428 RSI: ffff88807a468000 RDI: ffffc9000c49e3d8 RBP: ffffc9000c49e428 R08: 0000000000000001 R09: ffffc9000c49e428 R10: fffff52001893c90 R11: 0000000000000000 R12: ffffc9000c49e3d8 R13: ffffc9000c49e428 R14: ffffc9000c49e460 R15: ffffc9000c49e428 get_stack_info_noinstr+0x14/0x120 arch/x86/kernel/dumpstack_64.c:167 get_stack_info+0x2d/0x90 arch/x86/kernel/dumpstack_64.c:193 __unwind_start+0x4ae/0x800 arch/x86/kernel/unwind_orc.c:668 unwind_start arch/x86/include/asm/unwind.h:60 [inline] arch_stack_walk+0x5c/0xe0 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] ____kasan_kmalloc mm/kasan/common.c:472 [inline] __kasan_kmalloc+0xa4/0xd0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:591 [inline] kzalloc include/linux/slab.h:721 [inline] fib6_info_alloc+0xc1/0x210 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x33e/0x1aa0 net/ipv6/route.c:3754 ip6_route_add+0x24/0x150 net/ipv6/route.c:3848 addrconf_prefix_route+0x30a/0x4e0 net/ipv6/addrconf.c:2422 addrconf_add_linklocal+0x24d/0x590 net/ipv6/addrconf.c:3194 addrconf_addr_gen+0x3a4/0x3e0 net/ipv6/addrconf.c:3323 addrconf_dev_config+0x255/0x420 net/ipv6/addrconf.c:3368 addrconf_notify+0xdc2/0x1bb0 net/ipv6/addrconf.c:3608 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] dev_open net/core/dev.c:1525 [inline] dev_open+0x132/0x150 net/core/dev.c:1513 team_port_add drivers/net/team/team.c:1210 [inline] team_add_slave+0xaa4/0x1cc0 drivers/net/team/team.c:1967 do_set_master+0x1c8/0x220 net/core/rtnetlink.c:2521 do_setlink+0x9f3/0x3970 net/core/rtnetlink.c:2726 __rtnl_newlink+0xde6/0x1750 net/core/rtnetlink.c:3391 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3506 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2485 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xda0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f5af15c53b9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5af156a278 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f5af164a4a0 RCX: 00007f5af15c53b9 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00007f5af16168dc R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000007110 R13: 00007f5af16148d0 R14: 00000010000a000e R15: 00007f5af164a4a8 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 4c 89 ee add %cl,-0x12(%rcx,%rcx,4) 6: 48 c7 c7 60 86 79 8b mov $0xffffffff8b798660,%rdi d: e8 24 10 bd fa callq 0xfabd1036 12: e9 5c ff ff ff jmpq 0xffffff73 17: cc int3 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: cc int3 1d: cc int3 1e: cc int3 1f: cc int3 20: cc int3 21: cc int3 22: cc int3 23: cc int3 24: cc int3 25: cc int3 26: 48 8b 46 20 mov 0x20(%rsi),%rax * 2a: 48 8d 88 00 80 00 00 lea 0x8000(%rax),%rcx <-- trapping instruction 31: 48 39 f8 cmp %rdi,%rax 34: 77 21 ja 0x57 36: 48 39 f9 cmp %rdi,%rcx 39: 76 1c jbe 0x57 3b: 48 89 42 08 mov %rax,0x8(%rdx) 3f: b8 .byte 0xb8