Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 405 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1775 [inline]
RIP: 0010:bpf_get_local_storage+0xbc/0x180 kernel/bpf/cgroup.c:1757
Code: f8 49 83 c6 08 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 d3 8b 28 00 4d 8b 36 83 fb 15 75 5e 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 b5 8b 28 00 49 8b 1e e8 fd 5b a0
RSP: 0018:ffffc90000007338 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000015 RCX: 0000000000000100
RDX: ffff888117789100 RSI: 0000000000000015 RDI: 0000000000000015
RBP: ffffc90000007358 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffffa0205df8 R12: dffffc0000000000
R13: ffff888122022140 R14: 0000000000000000 R15: 0000000000000001
FS: 000055556f7c5500(0000) GS:ffff88826e6ff000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001c40 CR3: 0000000122672000 CR4: 00000000003526b0
Call Trace:
bpf_prog_3647604f6c8667e9+0x26/0x3d
bpf_dispatcher_nop_func include/linux/bpf.h:1332 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
__bpf_prog_run_save_cb+0x120/0x360 include/linux/filter.h:955
bpf_prog_run_array_cg kernel/bpf/cgroup.c:81 [inline]
__cgroup_bpf_run_filter_skb+0x56a/0x9a0 kernel/bpf/cgroup.c:1613
sk_filter_trim_cap+0x7c7/0x9c0 net/core/filter.c:150
tcp_filter net/ipv4/tcp_ipv4.c:2160 [inline]
tcp_v4_rcv+0x1af6/0x2c30 net/ipv4/tcp_ipv4.c:2348
ip_protocol_deliver_rcu+0x1e0/0x3f0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x36c/0x660 net/ipv4/ip_input.c:239
NF_HOOK include/linux/netfilter.h:318 [inline]
ip_local_deliver+0x1da/0x330 net/ipv4/ip_input.c:260
dst_input include/net/dst.h:471 [inline]
ip_rcv_finish net/ipv4/ip_input.c:454 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
ip_rcv+0x1cd/0x2e0 net/ipv4/ip_input.c:574
__netif_receive_skb_one_core net/core/dev.c:5991 [inline]
__netif_receive_skb+0x145/0x3a0 net/core/dev.c:6104
process_backlog+0x3be/0x820 net/core/dev.c:6456
__napi_poll+0xd8/0x4a0 net/core/dev.c:7506
napi_poll net/core/dev.c:7569 [inline]
net_rx_action+0x5af/0xe00 net/core/dev.c:7696
handle_softirqs+0x18c/0x530 kernel/softirq.c:579
__do_softirq+0xb/0x12 kernel/softirq.c:613
do_softirq+0xc5/0x130 kernel/softirq.c:480
__local_bh_enable_ip+0x7f/0x90 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1151/0x3730 net/core/dev.c:4752
dev_queue_xmit include/linux/netdevice.h:3361 [inline]
neigh_hh_output include/net/neighbour.h:531 [inline]
neigh_output include/net/neighbour.h:545 [inline]
ip_finish_output2+0xb57/0xf30 net/ipv4/ip_output.c:235
__ip_finish_output+0x17e/0x400 net/ipv4/ip_output.c:-1
ip_finish_output+0x31/0x380 net/ipv4/ip_output.c:323
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x198/0x300 net/ipv4/ip_output.c:436
dst_output include/net/dst.h:461 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
__ip_queue_xmit+0x1219/0x1cc0 net/ipv4/ip_output.c:532
ip_queue_xmit+0x4d/0x70 net/ipv4/ip_output.c:546
__tcp_transmit_skb+0x2351/0x36d0 net/ipv4/tcp_output.c:1479
__tcp_send_ack+0x2f5/0x720 net/ipv4/tcp_output.c:4285
tcp_send_ack+0x3d/0x60 net/ipv4/tcp_output.c:4291
__tcp_cleanup_rbuf+0x120/0x550 net/ipv4/tcp.c:1541
tcp_cleanup_rbuf net/ipv4/tcp.c:1552 [inline]
tcp_recvmsg_locked+0x2b22/0x33a0 net/ipv4/tcp.c:2875
tcp_recvmsg+0x20e/0x820 net/ipv4/tcp.c:2905
inet_recvmsg+0x134/0x4d0 net/ipv4/af_inet.c:883
sock_recvmsg_nosec net/socket.c:1065 [inline]
sock_recvmsg+0x18c/0x260 net/socket.c:1087
sock_read_iter+0x22d/0x2e0 net/socket.c:1157
new_sync_read fs/read_write.c:491 [inline]
vfs_read+0x600/0xc50 fs/read_write.c:572
ksys_read+0x13e/0x250 fs/read_write.c:715
__do_sys_read fs/read_write.c:724 [inline]
__se_sys_read fs/read_write.c:722 [inline]
__x64_sys_read+0x7b/0x90 fs/read_write.c:722
x64_sys_call+0x2709/0x2fd0 arch/x86/include/generated/asm/syscalls_64.h:1
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x5e/0x160 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7feae3d8d89d
Code: a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb bd e8 a8 48 00 00 0f 1f 84 00 00 00 00 00 80 3d c1 ac 22 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec
RSP: 002b:00007fff9ffac618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fff9ffac720 RCX: 00007feae3d8d89d
RDX: 0000000000000004 RSI: 00007fff9ffac62c RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000007ae2457 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9ffaca40
R13: 0000000000000004 R14: 00007fff9ffac62c R15: 00007fff9ffac6c0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:____bpf_get_local_storage kernel/bpf/cgroup.c:1775 [inline]
RIP: 0010:bpf_get_local_storage+0xbc/0x180 kernel/bpf/cgroup.c:1757
Code: f8 49 83 c6 08 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 d3 8b 28 00 4d 8b 36 83 fb 15 75 5e 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 b5 8b 28 00 49 8b 1e e8 fd 5b a0
RSP: 0018:ffffc90000007338 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000015 RCX: 0000000000000100
RDX: ffff888117789100 RSI: 0000000000000015 RDI: 0000000000000015
RBP: ffffc90000007358 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffffa0205df8 R12: dffffc0000000000
R13: ffff888122022140 R14: 0000000000000000 R15: 0000000000000001
FS: 000055556f7c5500(0000) GS:ffff88826e6ff000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001c40 CR3: 0000000122672000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
0: f8 clc
1: 49 83 c6 08 add $0x8,%r14
5: 4c 89 f0 mov %r14,%rax
8: 48 c1 e8 03 shr $0x3,%rax
c: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
11: 74 08 je 0x1b
13: 4c 89 f7 mov %r14,%rdi
16: e8 d3 8b 28 00 call 0x288bee
1b: 4d 8b 36 mov (%r14),%r14
1e: 83 fb 15 cmp $0x15,%ebx
21: 75 5e jne 0x81
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 b5 8b 28 00 call 0x288bee
39: 49 8b 1e mov (%r14),%rbx
3c: e8 .byte 0xe8
3d: fd std
3e: 5b pop %rbx
3f: a0 .byte 0xa0