Extracting prog: 2m34.933726146s Minimizing prog: 23m19.386805852s Simplifying prog options: 0s Extracting C: 35.583884109s Simplifying C: 10m57.578807076s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program crashed: general protection fault in smc_diag_dump_proto single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r1) socket$netlink(0x10, 0x3, 0x4) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r1) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r1, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r0) socket$netlink(0x10, 0x3, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) socket$inet6(0xa, 0x1, 0x100) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r0) socket$netlink(0x10, 0x3, 0x4) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, 0x0, 0x0) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{0x0}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) socket$inet6(0xa, 0x1, 0x100) (rerun: 64) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash testing program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice detailed listing: executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400adfd8a987e40da2e6a262b", 0x11}], 0x1) (rerun: 64) socket$inet6(0xa, 0x1, 0x100) close(r2) socket$netlink(0x10, 0x3, 0x4) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto simplifying C reproducer testing compiled C program (duration=1m4.416156777s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program did not crash testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program did not crash testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto testing compiled C program (duration=1m4.416156777s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): pipe-socket$inet_udp-writev-socket$inet6-close-socket$netlink-splice program crashed: general protection fault in smc_diag_dump_proto reproducing took 37m27.483241437s repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc00000a2403: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000000512018-0x000000000051201f] CPU: 0 UID: 0 PID: 5866 Comm: syz-executor308 Not tainted 6.13.0-rc5-syzkaller-00152-gdb78475ba0d3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump net/smc/smc_diag.c:89 [inline] RIP: 0010:smc_diag_dump_proto+0x6d9/0x3270 net/smc/smc_diag.c:217 Code: 80 3c 2c 00 74 08 48 89 df e8 c3 7a 92 f6 48 89 5c 24 30 48 8b 1b 48 85 db 0f 84 2d 02 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 98 7a 92 f6 48 8b 44 24 28 4c 8d RSP: 0018:ffffc9000412eb20 EFLAGS: 00010206 RAX: 00000000000a2403 RBX: 0000000000512018 RCX: ffff8880352bbc00 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: ffffc9000412efb0 R08: ffffffff89a476e2 R09: 1ffff1100fc17d8b R10: dffffc0000000000 R11: ffffed100fc17d8c R12: 1ffff1100fc17e2b R13: dffffc0000000000 R14: ffff88807e0bec00 R15: ffff88802f400268 FS: 00007fa7957826c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa795787b30 CR3: 0000000076d9c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: smc_diag_dump+0x59/0xa0 net/smc/smc_diag.c:236 netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2317 __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] smc_diag_handler_dump+0x1ab/0x250 net/smc/smc_diag.c:251 sock_diag_rcv_msg+0x3dc/0x5f0 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_sendmsg+0x134/0x200 net/socket.c:749 splice_to_socket+0xa10/0x10b0 fs/splice.c:889 do_splice_from fs/splice.c:941 [inline] do_splice+0xd68/0x18e0 fs/splice.c:1354 __do_splice fs/splice.c:1436 [inline] __do_sys_splice fs/splice.c:1639 [inline] __se_sys_splice+0x2e0/0x450 fs/splice.c:1621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa7957c74d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa795782218 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa7957c74d9 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fa795851328 R08: 0000000080000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa795851320 R13: 00007fa79581e074 R14: 00007ffd57195890 R15: 00007ffd57195978 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump net/smc/smc_diag.c:89 [inline] RIP: 0010:smc_diag_dump_proto+0x6d9/0x3270 net/smc/smc_diag.c:217 Code: 80 3c 2c 00 74 08 48 89 df e8 c3 7a 92 f6 48 89 5c 24 30 48 8b 1b 48 85 db 0f 84 2d 02 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 98 7a 92 f6 48 8b 44 24 28 4c 8d RSP: 0018:ffffc9000412eb20 EFLAGS: 00010206 RAX: 00000000000a2403 RBX: 0000000000512018 RCX: ffff8880352bbc00 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: ffffc9000412efb0 R08: ffffffff89a476e2 R09: 1ffff1100fc17d8b R10: dffffc0000000000 R11: ffffed100fc17d8c R12: 1ffff1100fc17e2b R13: dffffc0000000000 R14: ffff88807e0bec00 R15: ffff88802f400268 FS: 00007fa7957826c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa795787b30 CR3: 0000000076d9c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 2c 00 cmpb $0x0,(%rsp,%rbp,1) 4: 74 08 je 0xe 6: 48 89 df mov %rbx,%rdi 9: e8 c3 7a 92 f6 call 0xf6927ad1 e: 48 89 5c 24 30 mov %rbx,0x30(%rsp) 13: 48 8b 1b mov (%rbx),%rbx 16: 48 85 db test %rbx,%rbx 19: 0f 84 2d 02 00 00 je 0x24c 1f: 48 83 c3 18 add $0x18,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 98 7a 92 f6 call 0xf6927ad1 39: 48 8b 44 24 28 mov 0x28(%rsp),%rax 3e: 4c rex.WR 3f: 8d .byte 0x8d final repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc00000a2403: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000000512018-0x000000000051201f] CPU: 0 UID: 0 PID: 5866 Comm: syz-executor308 Not tainted 6.13.0-rc5-syzkaller-00152-gdb78475ba0d3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump net/smc/smc_diag.c:89 [inline] RIP: 0010:smc_diag_dump_proto+0x6d9/0x3270 net/smc/smc_diag.c:217 Code: 80 3c 2c 00 74 08 48 89 df e8 c3 7a 92 f6 48 89 5c 24 30 48 8b 1b 48 85 db 0f 84 2d 02 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 98 7a 92 f6 48 8b 44 24 28 4c 8d RSP: 0018:ffffc9000412eb20 EFLAGS: 00010206 RAX: 00000000000a2403 RBX: 0000000000512018 RCX: ffff8880352bbc00 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: ffffc9000412efb0 R08: ffffffff89a476e2 R09: 1ffff1100fc17d8b R10: dffffc0000000000 R11: ffffed100fc17d8c R12: 1ffff1100fc17e2b R13: dffffc0000000000 R14: ffff88807e0bec00 R15: ffff88802f400268 FS: 00007fa7957826c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa795787b30 CR3: 0000000076d9c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: smc_diag_dump+0x59/0xa0 net/smc/smc_diag.c:236 netlink_dump+0x64d/0xe10 net/netlink/af_netlink.c:2317 __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] smc_diag_handler_dump+0x1ab/0x250 net/smc/smc_diag.c:251 sock_diag_rcv_msg+0x3dc/0x5f0 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_sendmsg+0x134/0x200 net/socket.c:749 splice_to_socket+0xa10/0x10b0 fs/splice.c:889 do_splice_from fs/splice.c:941 [inline] do_splice+0xd68/0x18e0 fs/splice.c:1354 __do_splice fs/splice.c:1436 [inline] __do_sys_splice fs/splice.c:1639 [inline] __se_sys_splice+0x2e0/0x450 fs/splice.c:1621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa7957c74d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa795782218 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa7957c74d9 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fa795851328 R08: 0000000080000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa795851320 R13: 00007fa79581e074 R14: 00007ffd57195890 R15: 00007ffd57195978 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump net/smc/smc_diag.c:89 [inline] RIP: 0010:smc_diag_dump_proto+0x6d9/0x3270 net/smc/smc_diag.c:217 Code: 80 3c 2c 00 74 08 48 89 df e8 c3 7a 92 f6 48 89 5c 24 30 48 8b 1b 48 85 db 0f 84 2d 02 00 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 98 7a 92 f6 48 8b 44 24 28 4c 8d RSP: 0018:ffffc9000412eb20 EFLAGS: 00010206 RAX: 00000000000a2403 RBX: 0000000000512018 RCX: ffff8880352bbc00 RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000 RBP: ffffc9000412efb0 R08: ffffffff89a476e2 R09: 1ffff1100fc17d8b R10: dffffc0000000000 R11: ffffed100fc17d8c R12: 1ffff1100fc17e2b R13: dffffc0000000000 R14: ffff88807e0bec00 R15: ffff88802f400268 FS: 00007fa7957826c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa795787b30 CR3: 0000000076d9c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 2c 00 cmpb $0x0,(%rsp,%rbp,1) 4: 74 08 je 0xe 6: 48 89 df mov %rbx,%rdi 9: e8 c3 7a 92 f6 call 0xf6927ad1 e: 48 89 5c 24 30 mov %rbx,0x30(%rsp) 13: 48 8b 1b mov (%rbx),%rbx 16: 48 85 db test %rbx,%rbx 19: 0f 84 2d 02 00 00 je 0x24c 1f: 48 83 c3 18 add $0x18,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 98 7a 92 f6 call 0xf6927ad1 39: 48 8b 44 24 28 mov 0x28(%rsp),%rax 3e: 4c rex.WR 3f: 8d .byte 0x8d