skbuff: skb_over_panic: text:0000000036c525e8 len:736 put:72 head:00000000959a3d8b data:00000000959a3d8b tail:0x2e0 end:0x2c0 dev: ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:105! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 5421 Comm: syz-executor.0 Not tainted 4.9.205-syzkaller #0 task: 00000000ed7c837d task.stack: 00000000a427a9da RIP: 0010:[] [<000000006225c791>] skb_panic+0x176/0x178 net/core/skbuff.c:105 RSP: 0018:ffff8801ca3bed60 EFLAGS: 00010282 RAX: 0000000000000088 RBX: ffff8801ca3eb3c0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8122c977 RDI: ffffed0039477d9e RBP: ffff8801ca3bedc8 R08: 0000000000000088 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82c75800 R13: ffffffff827faec6 R14: 0000000000000048 R15: ffffffff82c753e0 FS: 00007f3819f30700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe0dd80d000 CR3: 00000001c8ff0000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801cd348480 00000000000002e0 00000000000002c0 ffffffff82c753e0 ffffffff822da350 ffff8801cd348480 00000000000002e0 00000000000002c0 00000000000002e0 ffff8801ca3eb3c0 0000000000000048 ffffffff827faec6 Call Trace: [<0000000004a6cbd1>] skb_over_panic net/core/skbuff.c:110 [inline] [<0000000004a6cbd1>] skb_put.cold+0x23/0x23 net/core/skbuff.c:1443 [<0000000036c525e8>] dump_esp_combs net/key/af_key.c:3031 [inline] [<0000000036c525e8>] pfkey_send_acquire+0x1656/0x23f0 net/key/af_key.c:3254 [<00000000971631d8>] km_query+0xba/0x1d0 net/xfrm/xfrm_state.c:1807 [<00000000ccdbc948>] xfrm_state_find+0x18b3/0x2910 net/xfrm/xfrm_state.c:879 [<00000000bd06dd68>] xfrm_tmpl_resolve_one+0x1c7/0x7a0 net/xfrm/xfrm_policy.c:1500 [<00000000a1bf57e3>] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:1544 [inline] [<00000000a1bf57e3>] xfrm_resolve_and_create_bundle+0x210/0x1e80 net/xfrm/xfrm_policy.c:1896 [<00000000709a4103>] xfrm_lookup+0x200/0xaf0 net/xfrm/xfrm_policy.c:2257 [<00000000bc0c5abb>] xfrm_lookup_route+0x38/0x140 net/xfrm/xfrm_policy.c:2382 [<00000000cfae103a>] ip_route_output_flow+0x93/0xa0 net/ipv4/route.c:2487 [<00000000e2c9a5c4>] udp_sendmsg+0x1494/0x1c60 net/ipv4/udp.c:1029 [<0000000016484901>] udpv6_sendmsg+0x12af/0x2430 net/ipv6/udp.c:1086 [<00000000ef2e7c24>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:766 [<00000000a8b95c03>] sock_sendmsg_nosec net/socket.c:649 [inline] [<00000000a8b95c03>] sock_sendmsg+0xbe/0x110 net/socket.c:659 [<000000003438f3bf>] ___sys_sendmsg+0x387/0x8b0 net/socket.c:1983 [<00000000aa50cedc>] __sys_sendmmsg+0x164/0x3d0 net/socket.c:2073 [<000000007f331f47>] SYSC_sendmmsg net/socket.c:2104 [inline] [<000000007f331f47>] SyS_sendmmsg+0x35/0x60 net/socket.c:2099 [<00000000884a169d>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288 [<0000000054be0036>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: 50 0e d0 fe 4c 8b 4d b8 8b 4b 78 41 57 45 89 f0 4c 89 ea ff 75 d0 4c 89 e6 48 c7 c7 20 54 c7 82 ff 75 c8 ff 75 c0 e8 5e d8 c0 fe <0f> 0b e8 62 4e b2 fe 4c 8b 65 08 e8 99 f5 cf fe 48 c7 c1 c0 57 RIP [<000000006225c791>] skb_panic+0x176/0x178 net/core/skbuff.c:101 RSP ---[ end trace 6a90996eb11f70b3 ]---