program: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) socket$igmp(0x2, 0x3, 0x2) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/raw\x00') preadv(r1, &(0x7f00000013c0)=[{&(0x7f0000000240)=""/4082, 0xff2}], 0x1, 0x15f, 0x0) accept4$inet(r1, &(0x7f0000000180)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)=@newtaction={0x18, 0x30, 0x1, 0xfffffffe, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24008090}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001400)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x2d0, 0xffffffff, 0xffffffff, 0x2d0, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0xffffffff, 0xff, 'netdevsim0\x00', 'wg1\x00', {0xff}, {}, 0x5c, 0x2, 0x10}, 0x0, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x7}}, @inet=@rpfilter={{0x28}, {0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x3, 0x1, 0x1, 0x0, 0x1, 0x1], 0x6, 0x7}, {0x4, [0x6, 0x2, 0x2, 0x4, 0x0, 0x7], 0x1, 0x3}}}}, {{@uncond, 0x0, 0x150, 0x1b0, 0x0, {}, [@common=@unspec=@conntrack1={{0xb8}, {{@ipv4=@loopback, [0x0, 0xffffffff, 0xffffff00, 0xff], @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xffffff00, 0xffffffff, 0xff00007f], @ipv6=@empty, [0xffffffff, 0x0, 0xffffffff, 0xff], @ipv4=@multicast2, [0xff000000, 0x0, 0xff000000, 0xffffffff], 0xf2f, 0x0, 0x3b, 0x4e23, 0x4e24, 0x4e20, 0x4e24, 0x0, 0x210}, 0xc1, 0x20}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x0, 0xa, [0x35, 0x29, 0xa, 0x29, 0x3, 0x20, 0x31, 0x30, 0x0, 0x10, 0x21, 0x1d, 0x40, 0x15, 0xc, 0x15], 0x0, 0x0, 0x43}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r3, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x24}}, 0x0) sendmsg$xdp(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x40) [ 116.874910][ T5326] ------------[ cut here ]------------ [ 116.877740][ T5326] len > ((int)(~0U >> 1)) [ 116.877751][ T5326] WARNING: ./include/linux/skbuff.h:2864 at ipgre_xmit+0x958/0xcd0, CPU#0: syz.0.0/5326 [ 116.883569][ T5326] Modules linked in: [ 116.885817][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 116.889600][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 116.893805][ T5326] RIP: 0010:ipgre_xmit+0x958/0xcd0 [ 116.895910][ T5326] Code: 48 3b 84 24 80 00 00 00 0f 85 3b 01 00 00 31 c0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4f 3c 78 01 cc e8 69 17 69 f7 90 <0f> 0b 90 e9 08 f8 ff ff 44 89 ff 44 89 e6 e8 15 19 69 f7 45 39 e7 [ 116.904159][ T5326] RSP: 0018:ffffc9000f1b75e0 EFLAGS: 00010283 [ 116.906846][ T5326] RAX: ffffffff8a5e0b57 RBX: 0000000000000000 RCX: 0000000000100000 [ 116.910210][ T5326] RDX: ffffc90020001000 RSI: 00000000000000bb RDI: 00000000000000bc [ 116.913694][ T5326] RBP: ffffc9000f1b76b0 R08: ffff88803de28000 R09: 0000000000000002 [ 116.917051][ T5326] R10: 0000000000004888 R11: ffffffff8a5e0200 R12: ffff888012084000 [ 116.920061][ T5326] R13: dffffc0000000000 R14: ffff888044411500 R15: 00000000ffffff40 [ 116.923116][ T5326] FS: 00007f2698fd56c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 116.926862][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 116.929597][ T5326] CR2: 00007f2698189180 CR3: 0000000043868000 CR4: 0000000000352ef0 [ 116.932853][ T5326] Call Trace: [ 116.934174][ T5326] [ 116.935408][ T5326] ? __pfx_ipgre_xmit+0x10/0x10 [ 116.937324][ T5326] ? validate_xmit_xfrm+0x5d/0x1120 [ 116.939461][ T5326] ? __dev_direct_xmit+0x33c/0x730 [ 116.941654][ T5326] __dev_direct_xmit+0x4b6/0x730 [ 116.943849][ T5326] ? __pfx___dev_direct_xmit+0x10/0x10 [ 116.946196][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 116.948341][ T5326] ? skb_put+0x112/0x210 [ 116.950043][ T5326] xsk_generic_xmit+0x2759/0x47b0 [ 116.952229][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 116.954510][ T5326] ? xsk_generic_xmit+0x107/0x47b0 [ 116.956779][ T5326] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 116.958989][ T5326] ? xsk_sendmsg+0x29/0x810 [ 116.960972][ T5326] xsk_sendmsg+0x482/0x810 [ 116.963067][ T5326] ? xsk_sendmsg+0x29/0x810 [ 116.965192][ T5326] ? __pfx_xsk_sendmsg+0x10/0x10 [ 116.967352][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 116.969476][ T5326] ____sys_sendmsg+0x54e/0x850 [ 116.971502][ T5326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 116.973602][ T5326] ? import_iovec+0x73/0xa0 [ 116.975495][ T5326] ___sys_sendmsg+0x2a5/0x360 [ 116.977364][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 116.979522][ T5326] ? __pfx____sys_sendmsg+0x10/0x10 [ 116.981793][ T5326] ? futex_wait+0x2a2/0x390 [ 116.983839][ T5326] ? __fget_files+0x2a/0x420 [ 116.985845][ T5326] ? __fget_files+0x3a2/0x420 [ 116.987974][ T5326] __x64_sys_sendmsg+0x1b1/0x290 [ 116.990099][ T5326] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 116.992513][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 116.995174][ T5326] do_syscall_64+0x174/0x580 [ 116.997194][ T5326] ? trace_irq_disable+0x3b/0x140 [ 116.999393][ T5326] ? clear_bhb_loop+0x40/0x90 [ 117.001532][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.004104][ T5326] RIP: 0033:0x7f269819e019 [ 117.005992][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.014349][ T5326] RSP: 002b:00007f2698fd4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.017921][ T5326] RAX: ffffffffffffffda RBX: 00007f2698425fa0 RCX: 00007f269819e019 [ 117.021413][ T5326] RDX: 0000000000000040 RSI: 0000200000000700 RDI: 0000000000000003 [ 117.024895][ T5326] RBP: 00007f269823500c R08: 0000000000000000 R09: 0000000000000000 [ 117.028309][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.031805][ T5326] R13: 00007f2698426038 R14: 00007f2698425fa0 R15: 00007ffd7f1751b8 [ 117.035295][ T5326] [ 117.036738][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 117.039847][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 117.043699][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.048024][ T5326] Call Trace: [ 117.049492][ T5326] [ 117.050792][ T5326] vpanic+0x56c/0xa60 [ 117.052534][ T5326] ? __pfx__printk+0x10/0x10 [ 117.054567][ T5326] ? __pfx_vpanic+0x10/0x10 [ 117.056543][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 117.058875][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 117.061204][ T5326] panic+0xc5/0xd0 [ 117.062812][ T5326] ? __pfx_panic+0x10/0x10 [ 117.064418][ T5326] __warn+0x315/0x4c0 [ 117.066041][ T5326] ? ipgre_xmit+0x958/0xcd0 [ 117.067969][ T5326] ? ipgre_xmit+0x958/0xcd0 [ 117.069993][ T5326] __report_bug+0x276/0x570 [ 117.072353][ T5326] ? ipgre_xmit+0x958/0xcd0 [ 117.074707][ T5326] ? __pfx___report_bug+0x10/0x10 [ 117.077348][ T5326] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 117.079825][ T5326] ? rcu_is_watching+0x15/0xb0 [ 117.081818][ T5326] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 117.084408][ T5326] ? trace_kmem_cache_alloc+0x29/0xe0 [ 117.086595][ T5326] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 117.088858][ T5326] ? ipgre_xmit+0x958/0xcd0 [ 117.090469][ T5326] report_bug+0x16a/0x220 [ 117.092138][ T5326] ? ipgre_xmit+0x958/0xcd0 [ 117.093905][ T5326] ? ipgre_xmit+0x95a/0xcd0 [ 117.095748][ T5326] handle_bug+0x9c/0x200 [ 117.097445][ T5326] exc_invalid_op+0x1a/0x50 [ 117.099397][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 117.101384][ T5326] RIP: 0010:ipgre_xmit+0x958/0xcd0 [ 117.103604][ T5326] Code: 48 3b 84 24 80 00 00 00 0f 85 3b 01 00 00 31 c0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4f 3c 78 01 cc e8 69 17 69 f7 90 <0f> 0b 90 e9 08 f8 ff ff 44 89 ff 44 89 e6 e8 15 19 69 f7 45 39 e7 [ 117.111166][ T5326] RSP: 0018:ffffc9000f1b75e0 EFLAGS: 00010283 [ 117.113691][ T5326] RAX: ffffffff8a5e0b57 RBX: 0000000000000000 RCX: 0000000000100000 [ 117.116956][ T5326] RDX: ffffc90020001000 RSI: 00000000000000bb RDI: 00000000000000bc [ 117.120287][ T5326] RBP: ffffc9000f1b76b0 R08: ffff88803de28000 R09: 0000000000000002 [ 117.123733][ T5326] R10: 0000000000004888 R11: ffffffff8a5e0200 R12: ffff888012084000 [ 117.127078][ T5326] R13: dffffc0000000000 R14: ffff888044411500 R15: 00000000ffffff40 [ 117.130424][ T5326] ? __pfx_ipgre_xmit+0x10/0x10 [ 117.132551][ T5326] ? ipgre_xmit+0x957/0xcd0 [ 117.134449][ T5326] ? __pfx_ipgre_xmit+0x10/0x10 [ 117.136461][ T5326] ? validate_xmit_xfrm+0x5d/0x1120 [ 117.138719][ T5326] ? __dev_direct_xmit+0x33c/0x730 [ 117.140911][ T5326] __dev_direct_xmit+0x4b6/0x730 [ 117.142823][ T5326] ? __pfx___dev_direct_xmit+0x10/0x10 [ 117.145185][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 117.147412][ T5326] ? skb_put+0x112/0x210 [ 117.149270][ T5326] xsk_generic_xmit+0x2759/0x47b0 [ 117.151446][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 117.153542][ T5326] ? xsk_generic_xmit+0x107/0x47b0 [ 117.155757][ T5326] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 117.157995][ T5326] ? xsk_sendmsg+0x29/0x810 [ 117.159896][ T5326] xsk_sendmsg+0x482/0x810 [ 117.161679][ T5326] ? xsk_sendmsg+0x29/0x810 [ 117.163532][ T5326] ? __pfx_xsk_sendmsg+0x10/0x10 [ 117.165658][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 117.167849][ T5326] ____sys_sendmsg+0x54e/0x850 [ 117.169881][ T5326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 117.172102][ T5326] ? import_iovec+0x73/0xa0 [ 117.173945][ T5326] ___sys_sendmsg+0x2a5/0x360 [ 117.175744][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 117.177608][ T5326] ? __pfx____sys_sendmsg+0x10/0x10 [ 117.179800][ T5326] ? futex_wait+0x2a2/0x390 [ 117.181729][ T5326] ? __fget_files+0x2a/0x420 [ 117.183671][ T5326] ? __fget_files+0x3a2/0x420 [ 117.185713][ T5326] __x64_sys_sendmsg+0x1b1/0x290 [ 117.187816][ T5326] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 117.190142][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.192708][ T5326] do_syscall_64+0x174/0x580 [ 117.194740][ T5326] ? trace_irq_disable+0x3b/0x140 [ 117.196782][ T5326] ? clear_bhb_loop+0x40/0x90 [ 117.198882][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.201871][ T5326] RIP: 0033:0x7f269819e019 [ 117.204281][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 117.212594][ T5326] RSP: 002b:00007f2698fd4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.216084][ T5326] RAX: ffffffffffffffda RBX: 00007f2698425fa0 RCX: 00007f269819e019 [ 117.219290][ T5326] RDX: 0000000000000040 RSI: 0000200000000700 RDI: 0000000000000003 [ 117.222441][ T5326] RBP: 00007f269823500c R08: 0000000000000000 R09: 0000000000000000 [ 117.225620][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 117.228709][ T5326] R13: 00007f2698426038 R14: 00007f2698425fa0 R15: 00007ffd7f1751b8 [ 117.231996][ T5326] [ 117.233716][ T5326] Kernel Offset: disabled [ 117.235447][ T5326] Rebooting in 86400 seconds..