BUG: unable to handle page fault for address: ffffde20226e48d3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 25190 Comm: syz-executor.3 Not tainted 5.1.0+ #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline] RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94 Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6f 88 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00 RSP: 0018:ffff8880ae809878 EFLAGS: 00010a02 RAX: dffffc0000000000 RBX: ffff110113724680 RCX: 1ffffffff10dee0c RDX: 1fffe220226e48d3 RSI: ffffffff8334ff3c RDI: ffff110113724698 RBP: ffff8880ae8098d8 R08: ffff88808857c1c0 R09: ffffed1015d06be0 R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc R13: ffff888099c5ecc0 R14: ffff88808f47ee14 R15: ffff88808f2c5440 FS: 0000000001dea940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffde20226e48d3 CR3: 000000009eb1b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: udp_tunnel_xmit_skb+0x236/0x310 net/ipv4/udp_tunnel.c:191 tipc_udp_xmit.isra.0+0x805/0xcc0 net/tipc/udp_media.c:181 tipc_udp_send_msg+0x295/0x4a0 net/tipc/udp_media.c:247 tipc_bearer_xmit_skb+0x172/0x360 net/tipc/bearer.c:503 tipc_disc_timeout+0x933/0xd60 net/tipc/discover.c:332 call_timer_fn+0x196/0x720 kernel/time/timer.c:1322 expire_timers kernel/time/timer.c:1366 [inline] __run_timers kernel/time/timer.c:1685 [inline] __run_timers kernel/time/timer.c:1653 [inline] run_timer_softirq+0x66f/0x1740 kernel/time/timer.c:1698 __do_softirq+0x266/0x95a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1067 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:767 [inline] RIP: 0010:seqcount_lockdep_reader_access include/linux/seqlock.h:83 [inline] RIP: 0010:read_seqcount_begin include/linux/seqlock.h:164 [inline] RIP: 0010:get_counters net/ipv6/netfilter/ip6_tables.c:778 [inline] RIP: 0010:alloc_counters.isra.0+0x485/0x690 net/ipv6/netfilter/ip6_tables.c:824 Code: 6b 92 88 48 c1 e8 03 42 80 3c 38 00 0f 85 ce 01 00 00 48 83 3d ab 51 60 02 00 0f 84 e5 00 00 00 e8 90 bf 3e fb 48 89 df 57 9d <0f> 1f 44 00 00 e9 1c fe ff ff e8 7c bf 3e fb 49 8d be 98 00 00 00 RSP: 0018:ffff88806f3dfaa8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff88808857c1c0 RBX: 0000000000000293 RCX: 1ffff110110af94c RDX: 0000000000000000 RSI: ffffffff86321a50 RDI: 0000000000000293 RBP: ffff88806f3dfb40 R08: ffff88808857c1c0 R09: ffff88808857ca60 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000200 R13: ffffe8ffffb2f020 R14: ffff8880ae934300 R15: dffffc0000000000 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:841 [inline] get_entries net/ipv6/netfilter/ip6_tables.c:1044 [inline] do_ip6t_get_ctl+0x4fc/0x960 net/ipv6/netfilter/ip6_tables.c:1712 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline] nf_getsockopt+0x80/0xe0 net/netfilter/nf_sockopt.c:122 ipv6_getsockopt net/ipv6/ipv6_sockglue.c:1402 [inline] ipv6_getsockopt+0x20b/0x290 net/ipv6/ipv6_sockglue.c:1382 tcp_getsockopt net/ipv4/tcp.c:3623 [inline] tcp_getsockopt+0x95/0xf0 net/ipv4/tcp.c:3617 sock_common_getsockopt+0x9a/0xe0 net/core/sock.c:3089 __sys_getsockopt+0x168/0x250 net/socket.c:2115 __do_sys_getsockopt net/socket.c:2126 [inline] __se_sys_getsockopt net/socket.c:2123 [inline] __x64_sys_getsockopt+0xbe/0x150 net/socket.c:2123 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45b8da Code: b8 34 01 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 6d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 4a 8d fb ff c3 66 0f 1f 84 00 00 00 00 00 RSP: 002b:00007fff947adff8 EFLAGS: 00000212 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00007fff947ae020 RCX: 000000000045b8da RDX: 0000000000000041 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 0000000000710cc0 R08: 00007fff947ae01c R09: 0000000000004000 R10: 00007fff947ae120 R11: 0000000000000212 R12: 0000000000000003 R13: 0000000000000000 R14: 0000000000000029 R15: 000000000070ff40 Modules linked in: CR2: ffffde20226e48d3 ---[ end trace 62e72cea78d67bea ]--- RIP: 0010:iptunnel_xmit_stats include/net/ip_tunnels.h:444 [inline] RIP: 0010:iptunnel_xmit+0x6e5/0x970 net/ipv4/ip_tunnel_core.c:94 Code: c1 e9 03 80 3c 11 00 0f 85 72 02 00 00 48 03 1c c5 60 70 6f 88 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5d 02 00 00 48 8d 7b 10 4d 63 e4 48 b8 00 00 00 RSP: 0018:ffff8880ae809878 EFLAGS: 00010a02 RAX: dffffc0000000000 RBX: ffff110113724680 RCX: 1ffffffff10dee0c RDX: 1fffe220226e48d3 RSI: ffffffff8334ff3c RDI: ffff110113724698 RBP: ffff8880ae8098d8 R08: ffff88808857c1c0 R09: ffffed1015d06be0 R10: ffffed1015d06bdf R11: ffff8880ae835efb R12: 00000000000000fc R13: ffff888099c5ecc0 R14: ffff88808f47ee14 R15: ffff88808f2c5440 FS: 0000000001dea940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffde20226e48d3 CR3: 000000009eb1b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400