program: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) socket$igmp(0x2, 0x3, 0x2) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/raw\x00') preadv(r1, &(0x7f00000013c0)=[{&(0x7f0000000240)=""/4082, 0xff2}], 0x1, 0x15f, 0x0) accept4$inet(r1, &(0x7f0000000180)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10, 0x80000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000d80)=@newtaction={0x18, 0x30, 0x1, 0xfffffffe, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x24008090}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000001400)=@raw={'raw\x00', 0x9, 0x3, 0x368, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x2d0, 0xffffffff, 0xffffffff, 0x2d0, 0xffffffff, 0x3, &(0x7f0000000100), {[{{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0xffffffff, 0xff, 'netdevsim0\x00', 'wg1\x00', {0xff}, {}, 0x5c, 0x2, 0x10}, 0x0, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x7}}, @inet=@rpfilter={{0x28}, {0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x3, 0x1, 0x1, 0x0, 0x1, 0x1], 0x6, 0x7}, {0x4, [0x6, 0x2, 0x2, 0x4, 0x0, 0x7], 0x1, 0x3}}}}, {{@uncond, 0x0, 0x150, 0x1b0, 0x0, {}, [@common=@unspec=@conntrack1={{0xb8}, {{@ipv4=@loopback, [0x0, 0xffffffff, 0xffffff00, 0xff], @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xffffff00, 0xffffffff, 0xff00007f], @ipv6=@empty, [0xffffffff, 0x0, 0xffffffff, 0xff], @ipv4=@multicast2, [0xff000000, 0x0, 0xff000000, 0xffffffff], 0xf2f, 0x0, 0x3b, 0x4e23, 0x4e24, 0x4e20, 0x4e24, 0x0, 0x210}, 0xc1, 0x20}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x0, 0xa, [0x35, 0x29, 0xa, 0x29, 0x3, 0x20, 0x31, 0x30, 0x0, 0x10, 0x21, 0x1d, 0x40, 0x15, 0xc, 0x15], 0x0, 0x0, 0x43}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r3, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x24}}, 0x0) sendmsg$xdp(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x40) [ 77.244297][ T5321] ------------[ cut here ]------------ [ 77.246975][ T5321] len > ((int)(~0U >> 1)) [ 77.246986][ T5321] WARNING: ./include/linux/skbuff.h:2864 at ipgre_xmit+0x958/0xcd0, CPU#0: syz.0.0/5321 [ 77.253101][ T5321] Modules linked in: [ 77.254852][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.258806][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.263048][ T5321] RIP: 0010:ipgre_xmit+0x958/0xcd0 [ 77.265284][ T5321] Code: 48 3b 84 24 80 00 00 00 0f 85 3b 01 00 00 31 c0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4f 3c 78 01 cc e8 69 17 69 f7 90 <0f> 0b 90 e9 08 f8 ff ff 44 89 ff 44 89 e6 e8 15 19 69 f7 45 39 e7 [ 77.274141][ T5321] RSP: 0018:ffffc9000e1b75e0 EFLAGS: 00010283 [ 77.276813][ T5321] RAX: ffffffff8a5e0b57 RBX: 0000000000000000 RCX: 0000000000100000 [ 77.281627][ T5321] RDX: ffffc9000ec4a000 RSI: 00000000000000bb RDI: 00000000000000bc [ 77.291860][ T5321] RBP: ffffc9000e1b76b0 R08: ffff88801fb9a540 R09: 0000000000000002 [ 77.295149][ T5321] R10: 0000000000004888 R11: ffffffff8a5e0200 R12: ffff888012c34000 [ 77.298552][ T5321] R13: dffffc0000000000 R14: ffff8880128fbc80 R15: 00000000ffffff40 [ 77.302017][ T5321] FS: 00007fef42c2a6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 77.305977][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.308679][ T5321] CR2: 00007fef41d89180 CR3: 000000001fd8d000 CR4: 0000000000352ef0 [ 77.312011][ T5321] Call Trace: [ 77.313471][ T5321] [ 77.314887][ T5321] ? __pfx_ipgre_xmit+0x10/0x10 [ 77.317240][ T5321] ? validate_xmit_xfrm+0x5d/0x1120 [ 77.319551][ T5321] ? __dev_direct_xmit+0x33c/0x730 [ 77.321825][ T5321] __dev_direct_xmit+0x4b6/0x730 [ 77.323992][ T5321] ? __pfx___dev_direct_xmit+0x10/0x10 [ 77.326431][ T5321] ? do_raw_spin_unlock+0x4d/0x210 [ 77.328903][ T5321] ? skb_put+0x112/0x210 [ 77.331164][ T5321] xsk_generic_xmit+0x2759/0x47b0 [ 77.333960][ T5321] ? __lock_acquire+0x683/0x2cf0 [ 77.336845][ T5321] ? xsk_generic_xmit+0x107/0x47b0 [ 77.339568][ T5321] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 77.342356][ T5321] ? xsk_sendmsg+0x29/0x810 [ 77.344482][ T5321] xsk_sendmsg+0x482/0x810 [ 77.346498][ T5321] ? xsk_sendmsg+0x29/0x810 [ 77.348365][ T5321] ? __pfx_xsk_sendmsg+0x10/0x10 [ 77.350312][ T5321] sock_sendmsg_nosec+0x13a/0x180 [ 77.352201][ T5321] ____sys_sendmsg+0x54e/0x850 [ 77.353961][ T5321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.356073][ T5321] ? import_iovec+0x73/0xa0 [ 77.357734][ T5321] ___sys_sendmsg+0x2a5/0x360 [ 77.359467][ T5321] ? __lock_acquire+0x683/0x2cf0 [ 77.361354][ T5321] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.363217][ T5321] ? futex_wait+0x2a2/0x390 [ 77.364814][ T5321] ? __fget_files+0x2a/0x420 [ 77.366560][ T5321] ? __fget_files+0x3a2/0x420 [ 77.368505][ T5321] __x64_sys_sendmsg+0x1b1/0x290 [ 77.370617][ T5321] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 77.372989][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.375574][ T5321] do_syscall_64+0x174/0x580 [ 77.377655][ T5321] ? trace_irq_disable+0x3b/0x140 [ 77.379769][ T5321] ? clear_bhb_loop+0x40/0x90 [ 77.381689][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.384243][ T5321] RIP: 0033:0x7fef41d9e019 [ 77.386228][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.394086][ T5321] RSP: 002b:00007fef42c29fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.397494][ T5321] RAX: ffffffffffffffda RBX: 00007fef42025fa0 RCX: 00007fef41d9e019 [ 77.400828][ T5321] RDX: 0000000000000040 RSI: 0000200000000700 RDI: 0000000000000003 [ 77.404078][ T5321] RBP: 00007fef41e3500c R08: 0000000000000000 R09: 0000000000000000 [ 77.407465][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.410735][ T5321] R13: 00007fef42026038 R14: 00007fef42025fa0 R15: 00007ffe4bdbf548 [ 77.414068][ T5321] [ 77.415382][ T5321] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 77.418392][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 77.421810][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 77.426129][ T5321] Call Trace: [ 77.427440][ T5321] [ 77.428617][ T5321] vpanic+0x56c/0xa60 [ 77.430173][ T5321] ? __pfx__printk+0x10/0x10 [ 77.432055][ T5321] ? __pfx_vpanic+0x10/0x10 [ 77.434036][ T5321] ? is_bpf_text_address+0x292/0x2b0 [ 77.436344][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 77.438593][ T5321] panic+0xc5/0xd0 [ 77.440153][ T5321] ? __pfx_panic+0x10/0x10 [ 77.441932][ T5321] __warn+0x315/0x4c0 [ 77.443488][ T5321] ? ipgre_xmit+0x958/0xcd0 [ 77.445418][ T5321] ? ipgre_xmit+0x958/0xcd0 [ 77.447234][ T5321] __report_bug+0x276/0x570 [ 77.449212][ T5321] ? ipgre_xmit+0x958/0xcd0 [ 77.451041][ T5321] ? __pfx___report_bug+0x10/0x10 [ 77.453134][ T5321] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 77.455767][ T5321] ? rcu_is_watching+0x15/0xb0 [ 77.457814][ T5321] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 77.460469][ T5321] ? trace_kmem_cache_alloc+0x29/0xe0 [ 77.462759][ T5321] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 77.465367][ T5321] ? ipgre_xmit+0x958/0xcd0 [ 77.467378][ T5321] report_bug+0x16a/0x220 [ 77.469282][ T5321] ? ipgre_xmit+0x958/0xcd0 [ 77.471255][ T5321] ? ipgre_xmit+0x95a/0xcd0 [ 77.473278][ T5321] handle_bug+0x9c/0x200 [ 77.475135][ T5321] exc_invalid_op+0x1a/0x50 [ 77.477133][ T5321] asm_exc_invalid_op+0x1a/0x20 [ 77.479213][ T5321] RIP: 0010:ipgre_xmit+0x958/0xcd0 [ 77.481456][ T5321] Code: 48 3b 84 24 80 00 00 00 0f 85 3b 01 00 00 31 c0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 4f 3c 78 01 cc e8 69 17 69 f7 90 <0f> 0b 90 e9 08 f8 ff ff 44 89 ff 44 89 e6 e8 15 19 69 f7 45 39 e7 [ 77.489139][ T5321] RSP: 0018:ffffc9000e1b75e0 EFLAGS: 00010283 [ 77.491100][ T5321] RAX: ffffffff8a5e0b57 RBX: 0000000000000000 RCX: 0000000000100000 [ 77.493579][ T5321] RDX: ffffc9000ec4a000 RSI: 00000000000000bb RDI: 00000000000000bc [ 77.496069][ T5321] RBP: ffffc9000e1b76b0 R08: ffff88801fb9a540 R09: 0000000000000002 [ 77.498982][ T5321] R10: 0000000000004888 R11: ffffffff8a5e0200 R12: ffff888012c34000 [ 77.501866][ T5321] R13: dffffc0000000000 R14: ffff8880128fbc80 R15: 00000000ffffff40 [ 77.504647][ T5321] ? __pfx_ipgre_xmit+0x10/0x10 [ 77.506397][ T5321] ? ipgre_xmit+0x957/0xcd0 [ 77.508019][ T5321] ? __pfx_ipgre_xmit+0x10/0x10 [ 77.509766][ T5321] ? validate_xmit_xfrm+0x5d/0x1120 [ 77.511587][ T5321] ? __dev_direct_xmit+0x33c/0x730 [ 77.513415][ T5321] __dev_direct_xmit+0x4b6/0x730 [ 77.515393][ T5321] ? __pfx___dev_direct_xmit+0x10/0x10 [ 77.517720][ T5321] ? do_raw_spin_unlock+0x4d/0x210 [ 77.519750][ T5321] ? skb_put+0x112/0x210 [ 77.521497][ T5321] xsk_generic_xmit+0x2759/0x47b0 [ 77.523513][ T5321] ? __lock_acquire+0x683/0x2cf0 [ 77.525606][ T5321] ? xsk_generic_xmit+0x107/0x47b0 [ 77.527666][ T5321] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 77.529976][ T5321] ? xsk_sendmsg+0x29/0x810 [ 77.531957][ T5321] xsk_sendmsg+0x482/0x810 [ 77.533917][ T5321] ? xsk_sendmsg+0x29/0x810 [ 77.535908][ T5321] ? __pfx_xsk_sendmsg+0x10/0x10 [ 77.538093][ T5321] sock_sendmsg_nosec+0x13a/0x180 [ 77.540024][ T5321] ____sys_sendmsg+0x54e/0x850 [ 77.541907][ T5321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 77.543993][ T5321] ? import_iovec+0x73/0xa0 [ 77.545799][ T5321] ___sys_sendmsg+0x2a5/0x360 [ 77.547700][ T5321] ? __lock_acquire+0x683/0x2cf0 [ 77.549698][ T5321] ? __pfx____sys_sendmsg+0x10/0x10 [ 77.551795][ T5321] ? futex_wait+0x2a2/0x390 [ 77.553661][ T5321] ? __fget_files+0x2a/0x420 [ 77.555625][ T5321] ? __fget_files+0x3a2/0x420 [ 77.557576][ T5321] __x64_sys_sendmsg+0x1b1/0x290 [ 77.559609][ T5321] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 77.561871][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.564020][ T5321] do_syscall_64+0x174/0x580 [ 77.565622][ T5321] ? trace_irq_disable+0x3b/0x140 [ 77.567665][ T5321] ? clear_bhb_loop+0x40/0x90 [ 77.569490][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.571792][ T5321] RIP: 0033:0x7fef41d9e019 [ 77.573846][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.583697][ T5321] RSP: 002b:00007fef42c29fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 77.587347][ T5321] RAX: ffffffffffffffda RBX: 00007fef42025fa0 RCX: 00007fef41d9e019 [ 77.590709][ T5321] RDX: 0000000000000040 RSI: 0000200000000700 RDI: 0000000000000003 [ 77.594351][ T5321] RBP: 00007fef41e3500c R08: 0000000000000000 R09: 0000000000000000 [ 77.597710][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.601113][ T5321] R13: 00007fef42026038 R14: 00007fef42025fa0 R15: 00007ffe4bdbf548 [ 77.604415][ T5321] [ 77.606320][ T5321] Kernel Offset: disabled [ 77.608160][ T5321] Rebooting in 86400 seconds..