program: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'bond0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="350d0000000000003000128008000100687372002400028008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r1], 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000000000aaff020000000000000000000000000001042088be120000030c000800050086dd88a888be000000021609660501000000000088a8080022eb000200002009f008020000008343290b496432290800655800000002"], 0xfdef) [ 108.631513][ T5290] Bluetooth: hci0: command tx timeout [ 108.695399][ T5332] netlink: 'syz.0.0': attribute type 8 has an invalid length. [ 108.717028][ T5332] netlink: 4 bytes leftover after parsing attributes in process `syz.0.0'. [ 108.757647][ T5332] bond0: entered promiscuous mode [ 108.759966][ T5332] bond_slave_0: entered promiscuous mode [ 108.773489][ T5332] bond_slave_1: entered promiscuous mode [ 108.782899][ T5332] gretap0: entered promiscuous mode [ 108.786966][ T5332] ip6gretap0: entered promiscuous mode [ 108.794300][ T5332] hsr1: entered promiscuous mode [ 108.808771][ T5332] syz.0.0 uses obsolete (PF_INET,SOCK_PACKET) [ 108.832623][ C0] BUG: unable to handle page fault for address: ffffed10224673b6 [ 108.835869][ C0] #PF: supervisor read access in kernel mode [ 108.838558][ C0] #PF: error_code(0x0000) - not-present page [ 108.841730][ C0] PGD 5ffd5067 P4D 5ffd5067 PUD 2fffa067 PMD 0 [ 108.844884][ C0] Oops: Oops: 0000 [#1] SMP KASAN NOPTI [ 108.847254][ C0] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 108.851178][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 108.855383][ C0] RIP: 0010:qdisc_pkt_len_segs_init+0x336/0xa30 [ 108.858692][ C0] Code: 44 89 e3 43 80 3c 2e 00 4c 8d b5 d8 00 00 00 74 08 4c 89 f7 e8 1b 34 ac f8 49 8b 06 48 01 c3 48 83 c3 0c 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 9d 04 00 00 44 8b 3b 41 c1 ef 02 41 83 [ 108.867246][ C0] RSP: 0018:ffffc900000071c0 EFLAGS: 00010a03 [ 108.869943][ C0] RAX: 1ffff110224673b6 RBX: ffff888112339db4 RCX: ffff88803629a540 [ 108.873702][ C0] RDX: 0000000000000100 RSI: 0000000000000042 RDI: 0000000000000008 [ 108.877511][ C0] RBP: ffff8880124563c0 R08: ffff888012339df5 R09: 0000000000000002 [ 108.880766][ C0] R10: ffff888012339df2 R11: ffffed10024673bf R12: fffffffffffffff4 [ 108.883940][ C0] R13: dffffc0000000000 R14: ffff888012456498 R15: 00000000ffffffc6 [ 108.887512][ C0] FS: 00007f432c1a16c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 108.891545][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.894464][ C0] CR2: ffffed10224673b6 CR3: 0000000011ca6000 CR4: 0000000000352ef0 [ 108.898045][ C0] Call Trace: [ 108.899641][ C0] [ 108.901178][ C0] __dev_queue_xmit+0x27f/0x37f0 [ 108.903692][ C0] ? kmem_cache_alloc_node_noprof+0x1e1/0x610 [ 108.906438][ C0] ? skb_copy_bits+0x42b/0x900 [ 108.908530][ C0] ? skb_copy_bits+0x7e1/0x900 [ 108.910576][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 108.913104][ C0] ? __pskb_pull_tail+0x129e/0x1890 [ 108.915917][ C0] ? __asan_memset+0x22/0x50 [ 108.918031][ C0] ? __skb_pad+0x3f8/0x600 [ 108.919913][ C0] ? __skb_put+0x49/0xe0 [ 108.921753][ C0] ? hsr_create_tagged_frame+0x8f3/0xe30 [ 108.924321][ C0] hsr_forward_skb+0x152a/0x28c0 [ 108.926828][ C0] ? hsr_forward_skb+0xb3/0x28c0 [ 108.929451][ C0] ? __pfx_hsr_forward_skb+0x10/0x10 [ 108.931912][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 108.934151][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 108.936439][ C0] ? hsr_addr_is_self+0x26/0x3e0 [ 108.938691][ C0] ? hsr_addr_is_self+0x26/0x3e0 [ 108.941230][ C0] ? hsr_addr_is_self+0x26/0x3e0 [ 108.943682][ C0] ? hsr_handle_frame+0x695/0xa50 [ 108.945863][ C0] hsr_handle_frame+0x6a0/0xa50 [ 108.947963][ C0] ? __pfx_hsr_handle_frame+0x10/0x10 [ 108.950338][ C0] __netif_receive_skb_core+0x989/0x30b0 [ 108.953071][ C0] ? __kasan_check_byte+0x12/0x40 [ 108.955740][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 108.958403][ C0] ? rcu_is_watching+0x15/0xb0 [ 108.960612][ C0] ? __kasan_check_byte+0x12/0x40 [ 108.962809][ C0] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 108.965558][ C0] ? lock_release+0x4b/0x3c0 [ 108.967554][ C0] ? lock_release+0x4b/0x3c0 [ 108.969565][ C0] ? __lock_acquire+0x683/0x2cf0 [ 108.971817][ C0] ? __kernel_text_address+0xd/0x30 [ 108.974418][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 108.977647][ C0] __netif_receive_skb_list_core+0x24d/0x830 [ 108.980422][ C0] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 108.983231][ C0] netif_receive_skb_list_internal+0x995/0xcf0 [ 108.986220][ C0] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 108.989440][ C0] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 108.992527][ C0] ? dev_gro_receive+0x1097/0x2380 [ 108.994767][ C0] napi_complete_done+0x299/0x730 [ 108.997038][ C0] ? __pfx_napi_complete_done+0x10/0x10 [ 108.999844][ C0] ? gro_cell_poll+0x175/0x5d0 [ 109.002434][ C0] gro_cell_poll+0x5ab/0x5d0 [ 109.004860][ C0] ? gro_cell_poll+0x175/0x5d0 [ 109.007170][ C0] __napi_poll+0xaa/0x330 [ 109.008990][ C0] net_rx_action+0x61d/0xf50 [ 109.011024][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 109.013132][ C0] ? hrtimer_interrupt+0x7de/0x910 [ 109.015459][ C0] handle_softirqs+0x225/0x840 [ 109.017987][ C0] ? do_softirq+0x76/0xd0 [ 109.020210][ C0] ? tun_rx_batched+0x185/0x790 [ 109.022257][ C0] do_softirq+0x76/0xd0 [ 109.023971][ C0] [ 109.025221][ C0] [ 109.026474][ C0] __local_bh_enable_ip+0xf8/0x130 [ 109.028734][ C0] ? tun_rx_batched+0x185/0x790 [ 109.031344][ C0] tun_rx_batched+0x616/0x790 [ 109.033731][ C0] ? __pfx_tun_rx_batched+0x10/0x10 [ 109.035999][ C0] ? tun_get_user+0x2717/0x4370 [ 109.038044][ C0] ? tun_get_user+0x2717/0x4370 [ 109.040024][ C0] ? tun_get_user+0x23cb/0x4370 [ 109.042084][ C0] ? tun_get_user+0x23cb/0x4370 [ 109.044222][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 109.046634][ C0] ? tun_get_user+0x2717/0x4370 [ 109.048849][ C0] ? tun_get_user+0x2717/0x4370 [ 109.051120][ C0] tun_get_user+0x2b44/0x4370 [ 109.053128][ C0] ? aa_file_perm+0x18b/0x15f0 [ 109.055175][ C0] ? aa_file_perm+0x4ed/0x15f0 [ 109.057247][ C0] ? __pfx_tun_get_user+0x10/0x10 [ 109.059555][ C0] ? __lock_acquire+0x683/0x2cf0 [ 109.062071][ C0] ? __pfx___futex_wait+0x10/0x10 [ 109.064426][ C0] ? ref_tracker_alloc+0x341/0x4b0 [ 109.066607][ C0] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 109.068826][ C0] ? tun_get+0x1c/0x2f0 [ 109.070647][ C0] ? tun_get+0x1c/0x2f0 [ 109.072720][ C0] ? tun_get+0x1c/0x2f0 [ 109.074808][ C0] ? tun_get+0x1c/0x2f0 [ 109.076907][ C0] tun_chr_write_iter+0x113/0x200 [ 109.079080][ C0] vfs_write+0x612/0xba0 [ 109.080935][ C0] ? __pfx_vfs_write+0x10/0x10 [ 109.082903][ C0] ? __fget_files+0x2a/0x420 [ 109.084973][ C0] ksys_write+0x150/0x270 [ 109.086999][ C0] ? __pfx_ksys_write+0x10/0x10 [ 109.089372][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.091998][ C0] do_syscall_64+0x174/0x580 [ 109.093951][ C0] ? trace_irq_disable+0x3b/0x140 [ 109.096147][ C0] ? clear_bhb_loop+0x40/0x90 [ 109.098340][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.101232][ C0] RIP: 0033:0x7f432b39de59 [ 109.103685][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.112192][ C0] RSP: 002b:00007f432c1a0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.115776][ C0] RAX: ffffffffffffffda RBX: 00007f432b625fa0 RCX: 00007f432b39de59 [ 109.119272][ C0] RDX: 000000000000fdef RSI: 00002000000002c0 RDI: 0000000000000004 [ 109.123251][ C0] RBP: 00007f432b433e6f R08: 0000000000000000 R09: 0000000000000000 [ 109.126552][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 109.129889][ C0] R13: 00007f432b626038 R14: 00007f432b625fa0 R15: 00007ffe1634edb8 [ 109.133308][ C0] [ 109.134757][ C0] Modules linked in: [ 109.136812][ C0] CR2: ffffed10224673b6 [ 109.139016][ C0] ---[ end trace 0000000000000000 ]--- [ 109.141620][ C0] RIP: 0010:qdisc_pkt_len_segs_init+0x336/0xa30 [ 109.144381][ C0] Code: 44 89 e3 43 80 3c 2e 00 4c 8d b5 d8 00 00 00 74 08 4c 89 f7 e8 1b 34 ac f8 49 8b 06 48 01 c3 48 83 c3 0c 48 89 d8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 9d 04 00 00 44 8b 3b 41 c1 ef 02 41 83 [ 109.152667][ C0] RSP: 0018:ffffc900000071c0 EFLAGS: 00010a03 [ 109.155625][ C0] RAX: 1ffff110224673b6 RBX: ffff888112339db4 RCX: ffff88803629a540 [ 109.159690][ C0] RDX: 0000000000000100 RSI: 0000000000000042 RDI: 0000000000000008 [ 109.163339][ C0] RBP: ffff8880124563c0 R08: ffff888012339df5 R09: 0000000000000002 [ 109.166823][ C0] R10: ffff888012339df2 R11: ffffed10024673bf R12: fffffffffffffff4 [ 109.170296][ C0] R13: dffffc0000000000 R14: ffff888012456498 R15: 00000000ffffffc6 [ 109.174653][ C0] FS: 00007f432c1a16c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 109.178845][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.181671][ C0] CR2: ffffed10224673b6 CR3: 0000000011ca6000 CR4: 0000000000352ef0 [ 109.185047][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 109.188409][ C0] Kernel Offset: disabled [ 109.190224][ C0] Rebooting in 86400 seconds..