BUG: unable to handle page fault for address: ffffed1012e6a200 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 7ffd5067 P4D 7ffd5067 PUD 3fffa067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 2 UID: 0 PID: 16307 Comm: syz.2.2728 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mkroute_output net/ipv4/route.c:2649 [inline] RIP: 0010:ip_route_output_key_hash_rcu+0x6c0/0x2870 net/ipv4/route.c:2875 Code: 24 30 48 85 ed 0f 84 91 14 00 00 e8 9a 58 1d f8 48 83 c5 30 e8 91 58 1d f8 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 06 1e 00 00 48 8b 6d 00 e8 dd 1c a2 01 31 ff 41 RSP: 0000:ffffc9000771efa8 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffc9000771f228 RCX: ffffc9000d849000 RDX: 1ffff11012e6a200 RSI: ffffffff89eaa26f RDI: ffff88802a72c658 RBP: ffff888097351000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802a72c620 R13: ffff88801355b800 R14: ffffc9000771f058 R15: ffff8880726de000 FS: 0000000000000000(0000) GS:ffff888097351000(0063) knlGS:00000000f53e6b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffffed1012e6a200 CR3: 000000007501f000 CR4: 0000000000352ef0 Call Trace: ip_route_output_key_hash+0x118/0x2b0 net/ipv4/route.c:2705 __ip_route_output_key include/net/route.h:169 [inline] ip_route_output_flow+0x27/0x150 net/ipv4/route.c:2932 ip_send_unicast_reply+0x5ab/0x1610 net/ipv4/ip_output.c:1646 tcp_v4_send_reset+0x1229/0x2f30 net/ipv4/tcp_ipv4.c:910 tcp_v4_rcv+0x1a30/0x4680 net/ipv4/tcp_ipv4.c:2343 ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3f2/0x6e0 net/ipv4/ip_input.c:241 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip_local_deliver+0x19a/0x1f0 net/ipv4/ip_input.c:262 dst_input include/net/dst.h:480 [inline] ip_rcv_finish net/ipv4/ip_input.c:453 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ip_rcv+0x2d9/0x5d0 net/ipv4/ip_input.c:573 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6149 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6262 netif_receive_skb_internal net/core/dev.c:6348 [inline] netif_receive_skb+0x139/0x820 net/core/dev.c:6407 tun_rx_batched.isra.0+0x3f6/0x750 drivers/net/tun.c:1509 tun_get_user+0x1e2e/0x3e10 drivers/net/tun.c:1953 tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] do_int80_emulation+0x141/0x6b0 arch/x86/entry/syscall_32.c:172 asm_int80_emulation+0x1a/0x20 arch/x86/include/asm/idtentry.h:621 RIP: 0023:0xf7125b6b Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 RSP: 002b:00000000f53e644c EFLAGS: 00000246 ORIG_RAX: 0000000000000004 RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000280 RDX: 0000000000000036 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: ffffed1012e6a200 ---[ end trace 0000000000000000 ]--- RIP: 0010:__mkroute_output net/ipv4/route.c:2649 [inline] RIP: 0010:ip_route_output_key_hash_rcu+0x6c0/0x2870 net/ipv4/route.c:2875 Code: 24 30 48 85 ed 0f 84 91 14 00 00 e8 9a 58 1d f8 48 83 c5 30 e8 91 58 1d f8 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 06 1e 00 00 48 8b 6d 00 e8 dd 1c a2 01 31 ff 41 RSP: 0000:ffffc9000771efa8 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffc9000771f228 RCX: ffffc9000d849000 RDX: 1ffff11012e6a200 RSI: ffffffff89eaa26f RDI: ffff88802a72c658 RBP: ffff888097351000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88802a72c620 R13: ffff88801355b800 R14: ffffc9000771f058 R15: ffff8880726de000 FS: 0000000000000000(0000) GS:ffff888097351000(0063) knlGS:00000000f53e6b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffffed1012e6a200 CR3: 000000007501f000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: 24 30 and $0x30,%al 2: 48 85 ed test %rbp,%rbp 5: 0f 84 91 14 00 00 je 0x149c b: e8 9a 58 1d f8 call 0xf81d58aa 10: 48 83 c5 30 add $0x30,%rbp 14: e8 91 58 1d f8 call 0xf81d58aa 19: 48 89 ea mov %rbp,%rdx 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 06 1e 00 00 jne 0x1e3a 34: 48 8b 6d 00 mov 0x0(%rbp),%rbp 38: e8 dd 1c a2 01 call 0x1a21d1a 3d: 31 ff xor %edi,%edi 3f: 41 rex.B