BUG: unable to handle page fault for address: ffffffffffffffdb #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 384d067 P4D 384d067 PUD 384f067 PMD 0 Oops: Oops: 0002 [#1] SMP PTI CPU: 0 UID: 0 PID: 4335 Comm: syz.3.336 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline] RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline] RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline] RIP: 0010:rcuref_put include/linux/rcuref.h:173 [inline] RIP: 0010:dst_release+0x21/0xc0 net/core/dst.c:167 Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 48 85 ff 0f 84 a1 00 00 00 48 89 fb bf 01 00 00 00 e8 a4 f7 d9 fe be ff ff ff ff 0f c1 73 40 ff ce 78 6f 31 ed bf 01 00 00 00 e8 4a f8 d9 fe 65 RSP: 0018:ffffc90002b27cf0 EFLAGS: 00010202 RAX: 0000000000000203 RBX: ffffffffffffff9b RCX: b18b3c2384fc0b00 RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000001 RBP: 000000000001010a R08: 0000000000000000 R09: 000000000a010100 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88810c06b800 R13: ffff88810d823500 R14: ffffc90002b27d20 R15: ffffffffffffff9b FS: 00007fe2236166c0(0000) GS:ffff8881b71e9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffdb CR3: 000000010e928000 CR4: 00000000003506f0 Call Trace: ip_rt_put include/net/route.h:285 [inline] pptp_xmit+0x4ff/0x560 drivers/net/ppp/pptp.c:267 __ppp_channel_push+0x4b/0xa0 drivers/net/ppp/ppp_generic.c:2166 ppp_channel_push+0x117/0x1a0 drivers/net/ppp/ppp_generic.c:2198 ppp_write+0x106/0x160 drivers/net/ppp/ppp_generic.c:544 vfs_write+0x169/0x4c0 fs/read_write.c:684 ksys_write+0x74/0xf0 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0x2f0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe22278eb69 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe223616038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fe2229b5fa0 RCX: 00007fe22278eb69 RDX: 0000000000000013 RSI: 00002000000002c0 RDI: 0000000000000004 RBP: 00007fe222811df1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fe2229b5fa0 R15: 00007fff87f8dc48 Modules linked in: CR2: ffffffffffffffdb ---[ end trace 0000000000000000 ]--- RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline] RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline] RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline] RIP: 0010:rcuref_put include/linux/rcuref.h:173 [inline] RIP: 0010:dst_release+0x21/0xc0 net/core/dst.c:167 Code: 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 48 85 ff 0f 84 a1 00 00 00 48 89 fb bf 01 00 00 00 e8 a4 f7 d9 fe be ff ff ff ff 0f c1 73 40 ff ce 78 6f 31 ed bf 01 00 00 00 e8 4a f8 d9 fe 65 RSP: 0018:ffffc90002b27cf0 EFLAGS: 00010202 RAX: 0000000000000203 RBX: ffffffffffffff9b RCX: b18b3c2384fc0b00 RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000001 RBP: 000000000001010a R08: 0000000000000000 R09: 000000000a010100 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88810c06b800 R13: ffff88810d823500 R14: ffffc90002b27d20 R15: ffffffffffffff9b FS: 00007fe2236166c0(0000) GS:ffff8881b71e9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffdb CR3: 000000010e928000 CR4: 00000000003506f0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: f3 0f 1e fa endbr64 d: 55 push %rbp e: 53 push %rbx f: 48 85 ff test %rdi,%rdi 12: 0f 84 a1 00 00 00 je 0xb9 18: 48 89 fb mov %rdi,%rbx 1b: bf 01 00 00 00 mov $0x1,%edi 20: e8 a4 f7 d9 fe call 0xfed9f7c9 25: be ff ff ff ff mov $0xffffffff,%esi * 2a: f0 0f c1 73 40 lock xadd %esi,0x40(%rbx) <-- trapping instruction 2f: ff ce dec %esi 31: 78 6f js 0xa2 33: 31 ed xor %ebp,%ebp 35: bf 01 00 00 00 mov $0x1,%edi 3a: e8 4a f8 d9 fe call 0xfed9f889 3f: 65 gs