[v5.15] general protection fault in netlink_broadcast_filtered

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e45d5d41c134 Linux 5.15.200
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16998ffa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=353ae28c40b35af5
dashboard link: https://syzkaller.appspot.com/bug?extid=62c8d3ce54a953bb88e2
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0d95f464a0a2/disk-e45d5d41.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8baa73f9938d/vmlinux-e45d5d41.xz
kernel image: https://storage.googleapis.com/syzbot-assets/952963e4f9e5/bzImage-e45d5d41.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+62c8d3...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 PID: 14347 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:read_pnet include/net/net_namespace.h:334 [inline]
RIP: 0010:sock_net include/net/sock.h:2798 [inline]
RIP: 0010:netlink_broadcast_filtered+0x50/0x1170 net/netlink/af_netlink.c:1507
Code: 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 b8 19 5d f9 4c 89 b4 24 88 00 00 00 49 83 c6 30 e8 e7 15 a0 01 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 71 25 a2 f9 4c 8b ac 24 88 00 00
RSP: 0018:ffffc90003e9f888 EFLAGS: 00010206
RAX: 0000000000000006 RBX: ffff88805ff37a00 RCX: ffff88801d2c5940
RDX: 0000000000000000 RSI: ffff88805ff37a00 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000cc0 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100fac1819 R12: dffffc0000000000
R13: ffff888079426068 R14: 0000000000000030 R15: 0000000000000004
FS: 000055558f2a4500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bb36182660 CR3: 0000000029403000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netlink_broadcast+0x33/0x40 net/netlink/af_netlink.c:1556
devlink_unregister+0x142/0x1d0 net/core/devlink.c:8987
nsim_dev_remove+0xdf/0x100 drivers/net/netdevsim/dev.c:1583
__device_release_driver drivers/base/dd.c:1227 [inline]
device_release_driver_internal+0x475/0x750 drivers/base/dd.c:1262
bus_remove_device+0x2e2/0x400 drivers/base/bus.c:531
device_del+0x6af/0xaf0 drivers/base/core.c:3600
device_unregister+0x1c/0xc0 drivers/base/core.c:3633
nsim_bus_dev_del drivers/net/netdevsim/bus.c:454 [inline]
del_device_store+0x296/0x3a0 drivers/net/netdevsim/bus.c:354
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x745/0xd60 fs/read_write.c:594
ksys_write+0x152/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f53b316884e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffedab64c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055558f2a4500 RCX: 00007f53b316884e
RDX: 0000000000000001 RSI: 00007ffedab64cd0 RDI: 0000000000000005
RBP: 00007f53b323f0e6 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffedab64cd0 R14: 00007f53b3f50620 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace dbfb30af6090f2ac ]---
RIP: 0010:read_pnet include/net/net_namespace.h:334 [inline]
RIP: 0010:sock_net include/net/sock.h:2798 [inline]
RIP: 0010:netlink_broadcast_filtered+0x50/0x1170 net/netlink/af_netlink.c:1507
Code: 49 89 fe 49 bc 00 00 00 00 00 fc ff df e8 b8 19 5d f9 4c 89 b4 24 88 00 00 00 49 83 c6 30 e8 e7 15 a0 01 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 74 08 4c 89 f7 e8 71 25 a2 f9 4c 8b ac 24 88 00 00
RSP: 0018:ffffc90003e9f888 EFLAGS: 00010206
RAX: 0000000000000006 RBX: ffff88805ff37a00 RCX: ffff88801d2c5940
RDX: 0000000000000000 RSI: ffff88805ff37a00 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000cc0 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100fac1819 R12: dffffc0000000000
R13: ffff888079426068 R14: 0000000000000030 R15: 0000000000000004
FS: 000055558f2a4500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bb7303e168 CR3: 0000000029403000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000009000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 49 89 fe mov %rdi,%r14
3: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
a: fc ff df
d: e8 b8 19 5d f9 call 0xf95d19ca
12: 4c 89 b4 24 88 00 00 mov %r14,0x88(%rsp)
19: 00
1a: 49 83 c6 30 add $0x30,%r14
1e: e8 e7 15 a0 01 call 0x1a0160a
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 71 25 a2 f9 call 0xf9a225aa
39: 4c rex.WR
3a: 8b .byte 0x8b
3b: ac lods %ds:(%rsi),%al
3c: 24 88 and $0x88,%al


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup