skbuff: skb_under_panic: text:ffffffff8a109c27 len:1412267108 put:1412267052 head:ffff888028e96a40 data:ffff887fd4bbeed4 tail:0xf8 end:0x180 dev:team0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:211!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 8913 Comm: syz.2.727 Not tainted 6.16.0-syzkaller-12111-gd7e82594a45c #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:211
Code: c7 c0 d8 93 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 6e 0d f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900000075d8 EFLAGS: 00010286
RAX: 0000000000000096 RBX: dffffc0000000000 RCX: 9b6b682915ab1e00
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc900000072e7 R09: 1ffff92000000e5c
R10: dffffc0000000000 R11: fffff52000000e5d R12: ffff8880786498d0
R13: ffff888028e96a40 R14: ffff887fd4bbeed4 R15: 00000000000000f8
FS: 00007f36624396c0(0000) GS:ffff888125c21000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3662418d58 CR3: 000000007731e000 CR4: 00000000003526f0
Call Trace:
skb_under_panic net/core/skbuff.c:221 [inline]
skb_push+0xc3/0xe0 net/core/skbuff.c:2601
ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:895
dev_hard_header include/linux/netdevice.h:3415 [inline]
neigh_connected_output+0x286/0x460 net/core/neighbour.c:1619
neigh_output include/net/neighbour.h:547 [inline]
ip6_finish_output2+0x11fe/0x16a0 net/ipv6/ip6_output.c:141
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xb54/0x1440 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x369/0x670 net/ipv6/addrconf.c:4037
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:412
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e9 ab d2 b7 f5 cc
RSP: 0018:ffffc9001b16e5f0 EFLAGS: 00000286
RAX: 1ffff9200362dc01 RBX: ffffffff90db1d04 RCX: 0000000000000001
RDX: ffffc9001b16e708 RSI: dffffc0000000000 RDI: ffffc9001b16ff48
RBP: dffffc0000000000 R08: ffffc9001b16ff48 R09: 0000000000000000
R10: ffffc9001b16e718 R11: fffff5200362dce5 R12: ffffc9001b16ff48
R13: ffffc9001b16e718 R14: ffffc9001b16e6c8 R15: 1ffffffff21b63a0
unwind_next_frame+0x17c4/0x2390 arch/x86/kernel/unwind_orc.c:-1
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:356
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4180 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4236
skb_clone+0x212/0x3a0 net/core/skbuff.c:2049
__netlink_deliver_tap_skb net/netlink/af_netlink.c:300 [inline]
__netlink_deliver_tap+0x404/0x850 net/netlink/af_netlink.c:325
netlink_deliver_tap+0x19c/0x1b0 net/netlink/af_netlink.c:338
__netlink_sendskb net/netlink/af_netlink.c:1262 [inline]
netlink_broadcast_deliver net/netlink/af_netlink.c:1401 [inline]
do_one_broadcast net/netlink/af_netlink.c:1490 [inline]
netlink_broadcast_filtered+0xe2b/0x12c0 net/netlink/af_netlink.c:1535
nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
nlmsg_multicast include/net/netlink.h:1184 [inline]
xfrm_nlmsg_multicast+0x18f/0x1f0 net/xfrm/xfrm_user.c:1590
xfrm_send_acquire+0x99d/0xee0 net/xfrm/xfrm_user.c:3843
km_query+0x119/0x210 net/xfrm/xfrm_state.c:2767
xfrm_state_find+0x3bca/0x5400 net/xfrm/xfrm_state.c:1558
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline]
xfrm_resolve_and_create_bundle+0x768/0x2f80 net/xfrm/xfrm_policy.c:2871
xfrm_lookup_with_ifid+0x2a7/0x1a70 net/xfrm/xfrm_policy.c:3205
xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
xfrm_lookup_route+0x3c/0x1c0 net/xfrm/xfrm_policy.c:3347
rawv6_sendmsg+0xdab/0x1820 net/ipv6/raw.c:893
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x19c/0x270 net/socket.c:729
____sys_sendmsg+0x52d/0x830 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmmsg+0x227/0x430 net/socket.c:2757
__do_sys_sendmmsg net/socket.c:2784 [inline]
__se_sys_sendmmsg net/socket.c:2781 [inline]
__x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2781
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f366158ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3662439038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f36617b5fa0 RCX: 00007f366158ebe9
RDX: 00000000000002e9 RSI: 0000200000000480 RDI: 0000000000000004
RBP: 00007f3661611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000ffe0 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f36617b6038 R14: 00007f36617b5fa0 R15: 00007ffdf859d478
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:211
Code: c7 c0 d8 93 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 6e 0d f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900000075d8 EFLAGS: 00010286
RAX: 0000000000000096 RBX: dffffc0000000000 RCX: 9b6b682915ab1e00
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc900000072e7 R09: 1ffff92000000e5c
R10: dffffc0000000000 R11: fffff52000000e5d R12: ffff8880786498d0
R13: ffff888028e96a40 R14: ffff887fd4bbeed4 R15: 00000000000000f8
FS: 00007f36624396c0(0000) GS:ffff888125c21000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3662418d58 CR3: 000000007731e000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 90 nop
31: 90 nop
32: 90 nop
33: 90 nop
34: 90 nop
35: 90 nop
36: 90 nop
37: 90 nop
38: 90 nop
39: 90 nop
3a: e9 ab d2 b7 f5 jmp 0xf5b7d2ea
3f: cc int3