Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote

[syzbot <syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com>]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in ip6mr_rule_action

Unable to handle kernel paging request at virtual address dfff800000000005
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000005] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: mld mld_ifc_work
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __ip6mr_get_table net/ipv6/ip6mr.c:135 [inline]
pc : ip6mr_rule_action+0x13c/0x240 net/ipv6/ip6mr.c:182
lr : __ip6mr_get_table net/ipv6/ip6mr.c:135 [inline]
lr : ip6mr_rule_action+0x154/0x240 net/ipv6/ip6mr.c:182
sp : ffff80008fb37320
x29: ffff80008fb37320 x28: 0000000000000001 x27: dfff800000000000
x26: ffff80008fb375d3 x25: 1ffff00011f66eb9 x24: ffff0000cef72030
x23: dfff800000000000 x22: 00000000000000fe x21: ffff0000d8361170
x20: 0000000000000000 x19: ffff80008fb37480 x18: ffff80012364b000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000001afe83 x13: 0000000000000009 x12: 0000000000000009
x11: 000000009b598062 x10: 000000000000000f x9 : 0000000000000005
x8 : 0000000000000028 x7 : ffff800084e20308 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000858e5e60
x2 : 0000000000000000 x1 : ffff0000c1b79d80 x0 : 0000000000000000
Call trace:
 __ip6mr_get_table net/ipv6/ip6mr.c:135 [inline] (P)
 ip6mr_rule_action+0x13c/0x240 net/ipv6/ip6mr.c:182 (P)
 fib_rules_lookup+0x624/0xc14 net/core/fib_rules.c:337
 ip6mr_fib_lookup+0x11c/0x1c4 net/ipv6/ip6mr.c:154
 mroute6_is_socket+0x128/0x234 net/ipv6/ip6mr.c:1705
 ip6_finish_output2+0xbe0/0x132c net/ipv6/ip6_output.c:85
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x230/0x618 net/ipv6/ip6_output.c:221
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip6_output+0x2d0/0x528 net/ipv6/ip6_output.c:248
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x14c/0x464 include/linux/netfilter.h:325
 mld_sendpack+0x72c/0xd34 net/ipv6/mcast.c:1890
 mld_send_cr net/ipv6/mcast.c:2191 [inline]
 mld_ifc_work+0x76c/0x9e4 net/ipv6/mcast.c:2739
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3578
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3659
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: eb15029f 540002a0 9100a288 d343fd09 (38f76929) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	eb15029f 	cmp	x20, x21
   4:	540002a0 	b.eq	0x58  // b.none
   8:	9100a288 	add	x8, x20, #0x28
   c:	d343fd09 	lsr	x9, x8, #3
* 10:	38f76929 	ldrsb	w9, [x9, x23] <-- trapping instruction


Tested on:

commit:         58c1eb84 arm64: sdei: Preserve the interrupted context..
git tree:       https://github.com/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15ce04ad580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a58b6b4d667e7a61
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=173b3f7f980000