general protection fault, probably for non-canonical address 0xdffffc00000020a8: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000000010540-0x0000000000010547]
CPU: 1 PID: 923 Comm: kworker/1:2 Not tainted 6.6.0-rc7-next-20231026-syzkaller-15220-g2ef7141596ee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:411 [inline]
RIP: 0010:find_match+0x18b/0xf50 net/ipv6/route.c:742
Code: 01 00 00 e8 c7 f0 51 f8 4d 85 ff 74 4c e8 bd f0 51 f8 49 8d bf 44 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 e6
RSP: 0018:ffffc900001f03d8 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff89370d1b
RDX: 00000000000020a8 RSI: ffffffff89370b43 RDI: 0000000000010545
RBP: ffffc900001f04b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffc900001f0ff8 R12: ffff88801fb5d8cf
R13: 1ffff9200003e085 R14: ffff88801fb5d8b8 R15: 000000000000ff01
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000ff01 CR3: 000000002089f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__find_rr_leaf+0x141/0xe00 net/ipv6/route.c:830
find_rr_leaf net/ipv6/route.c:851 [inline]
rt6_select net/ipv6/route.c:895 [inline]
fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2183
ip6_pol_route+0x1bf/0x10b0 net/ipv6/route.c:2219
pol_lookup_func include/net/ip6_fib.h:614 [inline]
fib6_rule_lookup+0x11e/0x5f0 net/ipv6/fib6_rules.c:116
ip6_route_input_lookup net/ipv6/route.c:2288 [inline]
ip6_route_input+0x656/0xbf0 net/ipv6/route.c:2584
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x4f9/0x720 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5527
__netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5641
process_backlog+0x101/0x6b0 net/core/dev.c:5969
__napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6531
napi_poll net/core/dev.c:6600 [inline]
net_rx_action+0x956/0xe90 net/core/dev.c:6733
__do_softirq+0x216/0x95f kernel/softirq.c:553
do_softirq kernel/softirq.c:454 [inline]
do_softirq+0xaa/0xe0 kernel/softirq.c:441
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:381
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:817 [inline]
__dev_queue_xmit+0xa77/0x3d20 net/core/dev.c:4371
dev_queue_xmit include/linux/netdevice.h:3108 [inline]
neigh_resolve_output net/core/neighbour.c:1556 [inline]
neigh_resolve_output+0x58c/0x900 net/core/neighbour.c:1536
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x679/0x1830 net/ipv6/ip6_output.c:137
__ip6_finish_output net/ipv6/ip6_output.c:198 [inline]
ip6_finish_output+0x485/0x1250 net/ipv6/ip6_output.c:209
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x1e2/0x530 net/ipv6/ip6_output.c:230
dst_output include/net/dst.h:458 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xa0c/0x18e0 net/ipv6/ndisc.c:509
ndisc_send_rs+0x133/0x6a0 net/ipv6/ndisc.c:719
addrconf_dad_completed+0x486/0x1030 net/ipv6/addrconf.c:4294
addrconf_dad_work+0x7f6/0x14b0 net/ipv6/addrconf.c:4202
process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784
kthread+0x337/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
Modules linked in:
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: e8 c7 f0 51 f8 call 0xf851f0ce
7: 4d 85 ff test %r15,%r15
a: 74 4c je 0x58
c: e8 bd f0 51 f8 call 0xf851f0ce
11: 49 8d bf 44 06 00 00 lea 0x644(%r15),%rdi
18: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1f: fc ff df
22: 48 89 fa mov %rdi,%rdx
25: 48 c1 ea 03 shr $0x3,%rdx
* 29: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2d: 48 89 f8 mov %rdi,%rax
30: 83 e0 07 and $0x7,%eax
33: 83 c0 03 add $0x3,%eax
36: 38 d0 cmp %dl,%al
38: 7c 08 jl 0x42
3a: 84 d2 test %dl,%dl
3c: 0f .byte 0xf
3d: 85 e6 test %esp,%esi