Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000025: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead000000000128-0xdead00000000012f]
CPU: 3 UID: 0 PID: 5743 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__hlist_del include/linux/list.h:1031 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:891 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1782 [inline]
RIP: 0010:__run_timers+0x6ac/0xb00 kernel/time/timer.c:2374
Code: 22 00 0f 85 db 02 00 00 4c 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 b4 d2 14 00 49 8d 7f 08 48 8b 44 24 08 48 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 f8 02 00 00 49 89 47 08 e8 90 d2 14 00 48 8d
RSP: 0000:ffffc900005e8d48 EFLAGS: 00010802
RAX: ffffc900005e8e08 RBX: ffff88802b323440 RCX: ffffffff81f4dbe4
RDX: 1bd5a00000000025 RSI: ffffffff81f4d9ac RDI: dead00000000012a
RBP: ffffc900005e8e08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: fffff520000bd1c1 R14: ffff88802b5251c0 R15: dead000000000122
FS: 0000000000000000(0000) GS:ffff888096ee3000(0063) knlGS:0000000057a73480
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f74072f0 CR3: 0000000065ffa000 CR4: 0000000000352ef0
Call Trace:
__run_timer_base kernel/time/timer.c:2386 [inline]
__run_timer_base kernel/time/timer.c:2378 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2395
run_timer_softirq+0x10/0x50 kernel/time/timer.c:2403
handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:console_flush_one_record+0xac3/0xe50 kernel/printk/printk.c:3270
Code: 00 e8 b1 07 2a 00 9c 5d 81 e5 00 02 00 00 31 ff 48 89 ee e8 af b4 21 00 48 85 ed 0f 85 d7 01 00 00 e8 01 ba 21 00 fb 4c 89 e8 <48> c1 e8 03 42 80 3c 38 00 0f 85 64 03 00 00 48 8b 0c 24 48 8b 6b
RSP: 0000:ffffc9000451ed60 EFLAGS: 00000293
RAX: ffffffff8f9af798 RBX: ffffffff8f9af740 RCX: ffffffff81e7f251
RDX: ffff888029df2540 RSI: ffffffff81e7f25f RDI: ffff888029df2540
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000002cea
R13: ffffffff8f9af798 R14: ffffc9000451ede0 R15: dffffc0000000000
console_flush_all kernel/printk/printk.c:3343 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3413
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
_printk+0xcf/0x110 kernel/printk/printk.c:2504
warn_alloc.cold+0x7e/0xa8 mm/page_alloc.c:4016
__vmalloc_node_range_noprof+0xccd/0x1630 mm/vmalloc.c:4047
__vmalloc_node_noprof+0xad/0xf0 mm/vmalloc.c:4143
xt_compat_init_offsets+0xe2/0x1f0 net/netfilter/x_tables.c:779
ebt_compat_init_offsets net/bridge/netfilter/ebtables.c:1840 [inline]
compat_table_info+0x11b/0x870 net/bridge/netfilter/ebtables.c:1851
compat_copy_everything_to_user+0xf42/0x1100 net/bridge/netfilter/ebtables.c:1891
compat_do_ebt_get_ctl+0x9e8/0xbb0 net/bridge/netfilter/ebtables.c:2474
do_ebt_get_ctl+0x243/0x7a0 net/bridge/netfilter/ebtables.c:2504
nf_getsockopt+0x7c/0xe0 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x192/0x1e0 net/ipv4/ip_sockglue.c:1777
tcp_getsockopt+0xa1/0x110 net/ipv4/tcp.c:4864
do_sock_getsockopt+0x50a/0x6e0 net/socket.c:2474
__sys_getsockopt+0x133/0x1d0 net/socket.c:2505
__do_compat_sys_socketcall net/compat.c:493 [inline]
__se_compat_sys_socketcall net/compat.c:422 [inline]
__ia32_compat_sys_socketcall+0x6af/0x770 net/compat.c:422
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f75fec
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8
RSP: 002b:00000000fff30540 EFLAGS: 00000286 ORIG_RAX: 0000000000000066
RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000fff30578
RDX: 00000000f7406ff4 RSI: 00000000fff30600 RDI: 00000000fff305fc
RBP: 00000000fff30600 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__hlist_del include/linux/list.h:1031 [inline]
RIP: 0010:detach_timer kernel/time/timer.c:891 [inline]
RIP: 0010:expire_timers kernel/time/timer.c:1782 [inline]
RIP: 0010:__run_timers+0x6ac/0xb00 kernel/time/timer.c:2374
Code: 22 00 0f 85 db 02 00 00 4c 89 38 48 89 44 24 08 4d 85 ff 74 24 e8 b4 d2 14 00 49 8d 7f 08 48 8b 44 24 08 48 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 f8 02 00 00 49 89 47 08 e8 90 d2 14 00 48 8d
RSP: 0000:ffffc900005e8d48 EFLAGS: 00010802
RAX: ffffc900005e8e08 RBX: ffff88802b323440 RCX: ffffffff81f4dbe4
RDX: 1bd5a00000000025 RSI: ffffffff81f4d9ac RDI: dead00000000012a
RBP: ffffc900005e8e08 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: dffffc0000000000
R13: fffff520000bd1c1 R14: ffff88802b5251c0 R15: dead000000000122
FS: 0000000000000000(0000) GS:ffff888096ee3000(0063) knlGS:0000000057a73480
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f74072f0 CR3: 0000000065ffa000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 22 00 and (%rax),%al
2: 0f 85 db 02 00 00 jne 0x2e3
8: 4c 89 38 mov %r15,(%rax)
b: 48 89 44 24 08 mov %rax,0x8(%rsp)
10: 4d 85 ff test %r15,%r15
13: 74 24 je 0x39
15: e8 b4 d2 14 00 call 0x14d2ce
1a: 49 8d 7f 08 lea 0x8(%r15),%rdi
1e: 48 8b 44 24 08 mov 0x8(%rsp),%rax
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 42 80 3c 22 00 cmpb $0x0,(%rdx,%r12,1) <-- trapping instruction
2f: 0f 85 f8 02 00 00 jne 0x32d
35: 49 89 47 08 mov %rax,0x8(%r15)
39: e8 90 d2 14 00 call 0x14d2ce
3e: 48 rex.W
3f: 8d .byte 0x8d