Oops: general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
CPU: 2 UID: 0 PID: 9036 Comm: syz.1.894 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:skb_segment+0x188a/0x4100 net/core/skbuff.c:4853
Code: 01 00 00 e9 bc ed ff ff e8 23 90 ac f8 48 8b 84 24 c0 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 57 28 00 00 48 8b 84 24 c0 00
RSP: 0018:ffffc90000647898 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000001104a RCX: ffffffff895bebdd
RDX: 000000000000000e RSI: ffffffff895bfbbd RDI: 0000000000000070
RBP: ffffc900006479e0 R08: 0000000000000005 R09: 000000000000ffff
R10: 000000000000ffff R11: 0000000000000000 R12: ffff8880383a7240
R13: 0000000000011000 R14: 000000000000ffff R15: 000000000000004a
FS: 00007f43b38746c0(0000) GS:ffff8880d6576000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f43b3873ff8 CR3: 000000003b2d8000 CR4: 0000000000352ef0
Call Trace:
tcp_gso_segment+0x3fd/0x1a60 net/ipv4/tcp_offload.c:181
tcp6_gso_segment+0x1d4/0x10e0 net/ipv6/tcpv6_offload.c:191
ipv6_gso_segment+0x77a/0x1630 net/ipv6/ip6_offload.c:135
skb_mac_gso_segment+0x2a5/0x640 net/core/gso.c:53
__skb_gso_segment+0x3c9/0x770 net/core/gso.c:124
skb_gso_segment include/net/gso.h:83 [inline]
validate_xmit_skb+0x942/0x1590 net/core/dev.c:4039
__dev_queue_xmit+0x60e/0x4950 net/core/dev.c:4860
dev_queue_xmit include/linux/netdevice.h:3418 [inline]
neigh_hh_output include/net/neighbour.h:540 [inline]
neigh_output include/net/neighbour.h:554 [inline]
ip6_finish_output2+0xfd4/0x1ce0 net/ipv6/ip6_output.c:136
__ip6_finish_output+0x357/0xdf0 net/ipv6/ip6_output.c:208
ip6_finish_output net/ipv6/ip6_output.c:219 [inline]
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x2aa/0xa60 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:470 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip6_xmit+0x1006/0x24a0 net/ipv6/ip6_output.c:379
inet6_csk_xmit+0x387/0x760 net/ipv6/inet6_connection_sock.c:115
__tcp_transmit_skb+0x1fab/0x4f10 net/ipv4/tcp_output.c:1715
tcp_transmit_skb net/ipv4/tcp_output.c:1733 [inline]
tcp_write_xmit+0x112d/0x83d0 net/ipv4/tcp_output.c:3060
__tcp_push_pending_frames+0xaf/0x3b0 net/ipv4/tcp_output.c:3243
tcp_push_pending_frames include/net/tcp.h:2359 [inline]
tcp_data_snd_check net/ipv4/tcp_input.c:6075 [inline]
tcp_rcv_established+0xbe9/0x3910 net/ipv4/tcp_input.c:6658
tcp_v6_do_rcv+0x10bc/0x1f60 net/ipv6/tcp_ipv6.c:1608
tcp_v6_rcv+0x26a9/0x4280 net/ipv6/tcp_ipv6.c:1880
ip6_protocol_deliver_rcu+0x188/0x1500 net/ipv6/ip6_input.c:478
ip6_input_finish+0x1e4/0x4a0 net/ipv6/ip6_input.c:529
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:540
dst_input include/net/dst.h:480 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:119 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ipv6_rcv+0x263/0x3d0 net/ipv6/ip6_input.c:351
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6202
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6315
process_backlog+0x37a/0x1580 net/core/dev.c:6666
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7730
napi_poll net/core/dev.c:7793 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7950
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
sk_wait_data+0x1aa/0x510 net/core/sock.c:3267
tcp_recvmsg_locked+0xb72/0x2a20 net/ipv4/tcp.c:2798
tcp_recvmsg+0x141/0x630 net/ipv4/tcp.c:2948
inet6_recvmsg+0xd5/0x4c0 net/ipv6/af_inet6.c:657
sock_recvmsg_nosec net/socket.c:1137 [inline]
sock_recvmsg+0xfe/0x1f0 net/socket.c:1159
__sys_recvfrom+0x200/0x300 net/socket.c:2315
__do_sys_recvfrom net/socket.c:2330 [inline]
__se_sys_recvfrom net/socket.c:2326 [inline]
__x64_sys_recvfrom+0xe0/0x1c0 net/socket.c:2326
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f43b299cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f43b3874028 EFLAGS: 00000246 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 00007f43b2c16090 RCX: 00007f43b299cdd9
RDX: fffffffffffffd0b RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f43b2a32d69 R08: 0000000000000000 R09: fffffffffffffd25
R10: 00000000c9100120 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f43b2c16128 R14: 00007f43b2c16090 R15: 00007ffcbc812b38
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_segment+0x188a/0x4100 net/core/skbuff.c:4853
Code: 01 00 00 e9 bc ed ff ff e8 23 90 ac f8 48 8b 84 24 c0 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 57 28 00 00 48 8b 84 24 c0 00
RSP: 0018:ffffc90000647898 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 000000000001104a RCX: ffffffff895bebdd
RDX: 000000000000000e RSI: ffffffff895bfbbd RDI: 0000000000000070
RBP: ffffc900006479e0 R08: 0000000000000005 R09: 000000000000ffff
R10: 000000000000ffff R11: 0000000000000000 R12: ffff8880383a7240
R13: 0000000000011000 R14: 000000000000ffff R15: 000000000000004a
FS: 00007f43b38746c0(0000) GS:ffff8880d6576000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f43b3873ff8 CR3: 000000003b2d8000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 00 e9 add %ch,%cl
4: bc ed ff ff e8 mov $0xe8ffffed,%esp
9: 23 90 ac f8 48 8b and -0x74b70754(%rax),%edx
f: 84 24 c0 test %ah,(%rax,%rax,8)
12: 00 00 add %al,(%rax)
14: 00 48 8d add %cl,-0x73(%rax)
17: 78 70 js 0x89
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 74 08 je 0x3a
32: 3c 03 cmp $0x3,%al
34: 0f 8e 57 28 00 00 jle 0x2891
3a: 48 rex.W
3b: 8b .byte 0x8b
3c: 84 24 c0 test %ah,(%rax,%rax,8)