general protection fault, probably for non-canonical address 0xdffffc00400000c8: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x0000000200000640-0x0000000200000647]
CPU: 1 PID: 5083 Comm: kworker/1:4 Not tainted 6.6.0-next-20231031-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:411 [inline]
RIP: 0010:find_match+0x18b/0xf50 net/ipv6/route.c:742
Code: 01 00 00 e8 d7 2b 50 f8 4d 85 ff 74 4c e8 cd 2b 50 f8 49 8d bf 44 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 e6
RSP: 0018:ffffc900001f03d8 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff8938d2cb
RDX: 00000000400000c8 RSI: ffffffff8938d0f3 RDI: 0000000200000645
RBP: ffffc900001f04b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffc900001f0ff8 R12: ffff88814cac78cf
R13: 1ffff9200003e085 R14: ffff88814cac78b8 R15: 0000000200000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000200000001 CR3: 000000001fb87000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__find_rr_leaf+0x141/0xe00 net/ipv6/route.c:830
find_rr_leaf net/ipv6/route.c:851 [inline]
rt6_select net/ipv6/route.c:895 [inline]
fib6_table_lookup+0x57e/0xa30 net/ipv6/route.c:2183
ip6_pol_route+0x1bf/0x10b0 net/ipv6/route.c:2219
pol_lookup_func include/net/ip6_fib.h:614 [inline]
fib6_rule_lookup+0x11e/0x5f0 net/ipv6/fib6_rules.c:116
ip6_route_input_lookup net/ipv6/route.c:2288 [inline]
ip6_route_input+0x656/0xbf0 net/ipv6/route.c:2584
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x4f9/0x720 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5527
__netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5641
process_backlog+0x101/0x6b0 net/core/dev.c:5969
__napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6531
napi_poll net/core/dev.c:6600 [inline]
net_rx_action+0x956/0xe90 net/core/dev.c:6733
__do_softirq+0x216/0x95f kernel/softirq.c:553
do_softirq kernel/softirq.c:454 [inline]
do_softirq+0xaa/0xe0 kernel/softirq.c:441
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:381
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:817 [inline]
__dev_queue_xmit+0xa77/0x3d20 net/core/dev.c:4371
dev_queue_xmit include/linux/netdevice.h:3112 [inline]
neigh_resolve_output net/core/neighbour.c:1556 [inline]
neigh_resolve_output+0x58c/0x900 net/core/neighbour.c:1536
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x679/0x1830 net/ipv6/ip6_output.c:137
__ip6_finish_output net/ipv6/ip6_output.c:211 [inline]
ip6_finish_output+0x3c7/0xf70 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x1e2/0x530 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:451 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0xa0c/0x18e0 net/ipv6/ndisc.c:509
ndisc_send_ns+0xc7/0x140 net/ipv6/ndisc.c:667
addrconf_dad_work+0xc82/0x14b0 net/ipv6/addrconf.c:4225
process_one_work+0x8a2/0x15e0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b6/0x1280 kernel/workqueue.c:2784
kthread+0x337/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:411 [inline]
RIP: 0010:find_match+0x18b/0xf50 net/ipv6/route.c:742
Code: 01 00 00 e8 d7 2b 50 f8 4d 85 ff 74 4c e8 cd 2b 50 f8 49 8d bf 44 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 e6
RSP: 0018:ffffc900001f03d8 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff8938d2cb
RDX: 00000000400000c8 RSI: ffffffff8938d0f3 RDI: 0000000200000645
RBP: ffffc900001f04b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffc900001f0ff8 R12: ffff88814cac78cf
R13: 1ffff9200003e085 R14: ffff88814cac78b8 R15: 0000000200000001
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000200000001 CR3: 000000001fb87000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 00 e8 add %ch,%al
4: d7 xlat %ds:(%rbx)
5: 2b 50 f8 sub -0x8(%rax),%edx
8: 4d 85 ff test %r15,%r15
b: 74 4c je 0x59
d: e8 cd 2b 50 f8 call 0xf8502bdf
12: 49 8d bf 44 06 00 00 lea 0x644(%r15),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 08 jl 0x43
3b: 84 d2 test %dl,%dl
3d: 0f .byte 0xf
3e: 85 e6 test %esp,%esi