------------[ cut here ]------------
WARNING: CPU: 0 PID: 15145 at net/ipv6/ip6_output.c:1799 __ip6_append_data+0x2edc/0x362c net/ipv6/ip6_output.c:1799
Modules linked in:
CPU: 0 PID: 15145 Comm: syz-executor.3 Not tainted 6.6.0-rc4-syzkaller-g19af4a4ed414 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ip6_append_data+0x2edc/0x362c net/ipv6/ip6_output.c:1799
lr : __ip6_append_data+0x2edc/0x362c net/ipv6/ip6_output.c:1799
sp : ffff8000a5186ea0
x29: ffff8000a51870c0 x28: ffff0000d15d3c80 x27: 1ffff00014a30e10
x26: 00000000000005a7 x25: dfff800000000000 x24: ffff0000d4f98a00
x23: 0000000000000000 x22: ffff0000d8d01520 x21: 00000516401d7c69
x20: 00000000000005a3 x19: 00000000000005a7 x18: 1fffe000368379ce
x17: ffff80008e19d000 x16: ffff80008051f9c4 x15: 0000000000000001
x14: 1fffe000265310fb x13: 0000000000000000 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000d8d00000 x7 : 00000000000005a7 x6 : ffff8000a5187760
x5 : ffff800088fc2904 x4 : ffff0000d8d01520 x3 : ffff000132988dc8
x2 : ffff000132988c98 x1 : 00000000000005a7 x0 : 00000000000005a3
Call trace:
 __ip6_append_data+0x2edc/0x362c net/ipv6/ip6_output.c:1799
 ip6_append_data+0x210/0x33c net/ipv6/ip6_output.c:1894
 l2tp_ip6_sendmsg+0x10a8/0x1a58 net/l2tp/l2tp_ip6.c:631
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:840
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg+0xc8/0x13c net/socket.c:753
 splice_to_socket+0x7cc/0xd58 fs/splice.c:881
 do_splice_from fs/splice.c:933 [inline]
 direct_splice_actor+0xe4/0x1c0 fs/splice.c:1142
 splice_direct_to_actor+0x2a0/0x7e4 fs/splice.c:1088
 do_splice_direct+0x20c/0x348 fs/splice.c:1194
 do_sendfile+0x4b8/0xcc4 fs/read_write.c:1254
 __do_sys_sendfile64 fs/read_write.c:1322 [inline]
 __se_sys_sendfile64 fs/read_write.c:1308 [inline]
 __arm64_sys_sendfile64+0x160/0x3b4 fs/read_write.c:1308
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
irq event stamp: 350
hardirqs last  enabled at (349): [<ffff8000801dad74>] __local_bh_enable_ip+0x24c/0x4ac kernel/softirq.c:386
hardirqs last disabled at (350): [<ffff80008a627820>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:436
softirqs last  enabled at (348): [<ffff8000887dfdc8>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (348): [<ffff8000887dfdc8>] lock_sock_nested+0xcc/0x11c net/core/sock.c:3512
softirqs last disabled at (346): [<ffff8000887dfd70>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (346): [<ffff8000887dfd70>] lock_sock_nested+0x74/0x11c net/core/sock.c:3508
---[ end trace 0000000000000000 ]---