skbuff: skb_over_panic: text:ffffffff826f3ca0 len:232 put:72 head:ffff8800a0bae780 data:ffff8800a0bae780 tail:0xe8 end:0xc0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 9883 Comm: syz-executor1 Not tainted 4.4.163+ #121
task: ffff8801d2e92f80 task.stack: ffff8800a5f90000
RIP: 0010:[<ffffffff826f60ee>]  [<ffffffff826f60ee>] skb_panic+0x166/0x168 net/core/skbuff.c:100
RSP: 0018:ffff8800a5f96be0  EFLAGS: 00010286
RAX: 0000000000000086 RBX: ffff8801cd450640 RCX: ffffc90001724000
RDX: 0000000000000000 RSI: ffffffff8121da29 RDI: ffff8801d2e93844
RBP: ffff8800a5f96c48 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82a4a080
R13: ffff8800a0bae780 R14: 00000000000000e8 R15: 00000000000000c0
FS:  00007f6a4c115700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30d23000 CR3: 00000001d820d000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800a0bae780 00000000000000e8 00000000000000c0 ffffffff82a4a080
 ffffffff821eee70 ffffffff82a4a3e0 ffffffff826f3ca0 0000004800000000
 ffff8801cd450640 ffffffff826f3ca0 0000000000000048 00000000000000e8
Call Trace:
 [<ffffffff826f6136>] skb_over_panic net/core/skbuff.c:109 [inline]
 [<ffffffff826f6136>] skb_put.cold.20+0x23/0x23 net/core/skbuff.c:1363
 [<ffffffff826f3ca0>] dump_ah_combs net/key/af_key.c:2980 [inline]
 [<ffffffff826f3ca0>] pfkey_send_acquire+0x1ae0/0x2390 net/key/af_key.c:3246
 [<ffffffff82551b0a>] km_query+0xba/0x1d0 net/xfrm/xfrm_state.c:1756
 [<ffffffff8255f968>] xfrm_state_find+0x15f8/0x24e0 net/xfrm/xfrm_state.c:852
 [<ffffffff82547162>] xfrm_tmpl_resolve_one+0x1d2/0x7a0 net/xfrm/xfrm_policy.c:1455
 [<ffffffff82547949>] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:1499 [inline]
 [<ffffffff82547949>] xfrm_resolve_and_create_bundle+0x219/0x1da0 net/xfrm/xfrm_policy.c:1847
 [<ffffffff8254a8a8>] xfrm_lookup+0x238/0xb70 net/xfrm/xfrm_policy.c:2204
 [<ffffffff8254c089>] xfrm_lookup_route+0x39/0x140 net/xfrm/xfrm_policy.c:2326
 [<ffffffff8239f870>] ip_route_output_flow+0x90/0xa0 net/ipv4/route.c:2437
 [<ffffffff824792e0>] udp_sendmsg+0x1480/0x1c70 net/ipv4/udp.c:1040
 [<ffffffff8260d04d>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
 [<ffffffff824a27c3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821cf9eb>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821cf9eb>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1531>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d4abe>] __sys_sendmmsg+0x12e/0x2e0 net/socket.c:2060
 [<ffffffff821d4ca5>] SYSC_sendmmsg net/socket.c:2090 [inline]
 [<ffffffff821d4ca5>] SyS_sendmmsg+0x35/0x60 net/socket.c:2085
 [<ffffffff827123e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 29 98 d8 fe 4c 8b 4d b8 8b 4b 78 41 54 48 c7 c7 c0 a0 a4 82 44 8b 45 d4 41 57 48 8b 55 c8 41 56 48 8b 75 c0 41 55 e8 1c 6a cb fe <0f> 0b e8 8b 11 c1 fe 4c 8b 65 08 e8 f2 80 d8 fe 48 c7 c1 a0 a3 
RIP  [<ffffffff826f60ee>] skb_panic+0x166/0x168 net/core/skbuff.c:100
 RSP <ffff8800a5f96be0>
---[ end trace 7b74920aacc4c52f ]---