------------[ cut here ]------------ WARNING: ./include/linux/skbuff.h:3243 at skb_mac_header include/linux/skbuff.h:3151 [inline], CPU#1: syz.2.2509/10924 WARNING: ./include/linux/skbuff.h:3243 at eth_hdr include/linux/if_ether.h:27 [inline], CPU#1: syz.2.2509/10924 WARNING: ./include/linux/skbuff.h:3243 at tcf_skbmod_act+0x1014/0x1820 net/sched/act_skbmod.c:79, CPU#1: syz.2.2509/10924 Modules linked in: CPU: 1 UID: 0 PID: 10924 Comm: syz.2.2509 Tainted: G W L syzkaller #0 PREEMPT Tainted: [W]=WARN, [L]=SOFTLOCKUP Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_network_header_len include/linux/skbuff.h:3243 [inline] pc : tcf_skbmod_act+0x1014/0x1820 net/sched/act_skbmod.c:55 lr : tcf_skbmod_act+0x3fc/0x1820 net/sched/act_skbmod.c:37 sp : ffff80008f1e6fb0 x29: ffff80008f1e6fb0 x28: ffff00001cad4d36 x27: 1fffe00002753e43 x26: 0000000000000000 x25: ffff00001cad4d48 x24: 1fffe0000395a9a9 x23: ffff000018928800 x22: 000000000000ffff x21: 0000000000000010 x20: ffff000013a9f200 x19: ffff00001cad4c80 x18: 00000000f2f2f2f2 x17: 00000000f202f2f2 x16: 00000000f3f3f304 x15: ffff800080c28d20 x14: ffff800080c28bc0 x13: ffff800089e66530 x12: ffff7fbff7ef28e0 x11: 1fffffbff7ef28df x10: ffff7fbff7ef28df x9 : dfff800000000000 x8 : ffff00001cad4d38 x7 : 1fffe0000395a9a7 x6 : 1fffe0000395a9a7 x5 : 0000000000000002 x4 : ffff000013a9f218 x3 : 0000000000000007 x2 : 1fffe0000395a9a6 x1 : 0000000000000006 x0 : 000000000000ffff Call trace: skb_mac_header include/linux/skbuff.h:3151 [inline] (P) eth_hdr include/linux/if_ether.h:27 [inline] (P) tcf_skbmod_act+0x1014/0x1820 net/sched/act_skbmod.c:79 (P) tc_act include/net/tc_wrapper.h:254 [inline] tcf_action_exec+0x150/0x414 net/sched/act_api.c:1150 tcf_exts_exec include/net/pkt_cls.h:361 [inline] basic_classify+0x190/0x2d8 net/sched/cls_basic.c:54 tc_classify include/net/tc_wrapper.h:260 [inline] __tcf_classify net/sched/cls_api.c:1779 [inline] tcf_classify+0x5a0/0xef0 net/sched/cls_api.c:1875 tc_run+0x370/0x748 net/core/dev.c:4463 sch_handle_ingress net/core/dev.c:4538 [inline] __netif_receive_skb_core.constprop.0+0xda0/0x2a30 net/core/dev.c:6115 __netif_receive_skb_one_core+0xa8/0x170 net/core/dev.c:6262 __netif_receive_skb+0x24/0x14c net/core/dev.c:6377 netif_receive_skb_internal net/core/dev.c:6463 [inline] netif_receive_skb+0x134/0x794 net/core/dev.c:6522 tun_rx_batched.isra.0+0x34c/0x560 drivers/net/tun.c:1595 tun_get_user+0x18b8/0x2b20 drivers/net/tun.c:2045 tun_chr_write_iter+0xac/0x1f0 drivers/net/tun.c:2091 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x4c0/0xbac fs/read_write.c:687 ksys_write+0xf0/0x1e0 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x70/0xa0 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x58/0x2a4 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 1711 hardirqs last enabled at (1710): [] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline] hardirqs last enabled at (1710): [] __arm64_exit_to_kernel_mode+0x38/0x98 arch/arm64/kernel/entry-common.c:60 hardirqs last disabled at (1711): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (1704): [] rcu_read_unlock include/linux/rcupdate.h:882 [inline] softirqs last enabled at (1704): [] tun_get_user+0x17e0/0x2b20 drivers/net/tun.c:1974 softirqs last disabled at (1706): [] skb_record_rx_queue include/linux/skbuff.h:5235 [inline] softirqs last disabled at (1706): [] tun_rx_batched.isra.0+0x2d8/0x560 drivers/net/tun.c:1594 ---[ end trace 0000000000000000 ]---