netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. ------------[ cut here ]------------ kernel BUG at net/core/dev.c:2648! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 9903 Comm: syz-executor.3 Not tainted 4.14.212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88808ec24400 task.stack: ffff88806ea20000 RIP: 0010:skb_checksum_help+0x638/0x7d0 net/core/dev.c:2648 RSP: 0018:ffff88806ea27088 EFLAGS: 00010212 RAX: 0000000000040000 RBX: 00000000000003d2 RCX: ffffc90006add000 RDX: 000000000000a158 RSI: ffffffff85dda268 RDI: ffff8880a057ab1a RBP: ffff8880a057aa80 R08: ffff8880a057ab00 R09: 00000000000202b5 R10: ffff88808ec24d28 R11: ffff88808ec24400 R12: ffff8880a057ab04 R13: ffff8880a057ab4c R14: ffff8880a057ab10 R15: 000000000000534c FS: 00007fa22864a700(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3002a000 CR3: 00000000a48f5000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: skb_csum_hwoffload_help+0x6d/0xf0 net/core/dev.c:3055 validate_xmit_skb+0x77a/0x9f0 net/core/dev.c:3097 __dev_queue_xmit+0x816/0x2480 net/core/dev.c:3513 neigh_hh_output include/net/neighbour.h:490 [inline] neigh_output include/net/neighbour.h:498 [inline] ip_finish_output2+0x9db/0x1340 net/ipv4/ip_output.c:230 ip_finish_output+0x37b/0xc50 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:239 [inline] ip_output+0x1cd/0x510 net/ipv4/ip_output.c:406 dst_output include/net/dst.h:470 [inline] ip_local_out+0x93/0x170 net/ipv4/ip_output.c:125 iptunnel_xmit+0x5cc/0x950 net/ipv4/ip_tunnel_core.c:91 geneve_xmit_skb drivers/net/geneve.c:864 [inline] geneve_xmit+0xc94/0x2880 drivers/net/geneve.c:942 __netdev_start_xmit include/linux/netdevice.h:4039 [inline] netdev_start_xmit include/linux/netdevice.h:4048 [inline] xmit_one net/core/dev.c:3005 [inline] dev_hard_start_xmit+0x188/0x890 net/core/dev.c:3021 sch_direct_xmit+0x251/0x500 net/sched/sch_generic.c:186 qdisc_restart net/sched/sch_generic.c:249 [inline] __qdisc_run+0x25d/0xe00 net/sched/sch_generic.c:257 __dev_xmit_skb net/core/dev.c:3231 [inline] __dev_queue_xmit+0x13ac/0x2480 net/core/dev.c:3489 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready packet_snd+0x1393/0x21e0 net/packet/af_packet.c:3024 overlayfs: workdir and upperdir must reside under the same mount syz-executor.0 (9920) used greatest stack depth: 24696 bytes left packet_sendmsg+0x1139/0x2aca net/packet/af_packet.c:3049 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45e299 RSP: 002b:00007fa228649c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045e299 RDX: 0000000000003287 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 000000000119bfd8 R08: 0000000000000000 R09: 00000000000002ff IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready R10: 0000000004000002 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffff5a9f41f R14: 00007fa22864a9c0 R15: 000000000119bf8c Code: a3 fb e9 c5 fd ff ff e8 f7 9c 79 fb 48 89 ef 41 bc ea ff ff ff e8 f9 f8 ff ff e9 4c fe ff ff e8 df 9c 79 fb 0f 0b e8 d8 9c 79 fb <0f> 0b 4c 89 f7 e8 5e 6b a3 fb e9 f5 f9 ff ff 4c 89 f7 e8 e1 6e RIP: skb_checksum_help+0x638/0x7d0 net/core/dev.c:2648 RSP: ffff88806ea27088 ---[ end trace 311939b61ba37130 ]---