------------[ cut here ]------------
WARNING: ./include/linux/skbuff.h:2864 at pskb_may_pull_reason include/linux/skbuff.h:2864 [inline], CPU#1: syz.0.17/4942
WARNING: ./include/linux/skbuff.h:2864 at pskb_network_may_pull_reason include/linux/skbuff.h:3294 [inline], CPU#1: syz.0.17/4942
WARNING: ./include/linux/skbuff.h:2864 at pskb_inet_may_pull_reason include/net/ip_tunnels.h:480 [inline], CPU#1: syz.0.17/4942
WARNING: ./include/linux/skbuff.h:2864 at pskb_inet_may_pull include/net/ip_tunnels.h:485 [inline], CPU#1: syz.0.17/4942
WARNING: ./include/linux/skbuff.h:2864 at ip6_tnl_start_xmit+0xc4c/0x10e0 net/ipv6/ip6_tunnel.c:1434, CPU#1: syz.0.17/4942
Modules linked in:
CPU: 1 UID: 0 PID: 4942 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline]
pc : pskb_network_may_pull_reason include/linux/skbuff.h:3294 [inline]
pc : pskb_inet_may_pull_reason include/net/ip_tunnels.h:480 [inline]
pc : pskb_inet_may_pull include/net/ip_tunnels.h:485 [inline]
pc : ip6_tnl_start_xmit+0xc4c/0x10e0 net/ipv6/ip6_tunnel.c:1434
lr : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline]
lr : pskb_network_may_pull_reason include/linux/skbuff.h:3294 [inline]
lr : pskb_inet_may_pull_reason include/net/ip_tunnels.h:480 [inline]
lr : pskb_inet_may_pull include/net/ip_tunnels.h:485 [inline]
lr : ip6_tnl_start_xmit+0xc4c/0x10e0 net/ipv6/ip6_tunnel.c:1434
sp : ffff800098327060
x29: ffff800098327160 x28: 1fffe0001b744ab6 x27: ffff8000983270a0
x26: dfff800000000000 x25: ffff700013064e14 x24: ffff0000dba255b4
x23: ffff0000dba255d8 x22: ffff0000d3cc70c0 x21: 00000000ffffffc0
x20: ffff0000d84fe000 x19: ffff0000dba25500 x18: 00000000ffffffff
x17: 0000000000000003 x16: ffff800088a57000 x15: ffff800080ce0eb4
x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000000
x11: ffff8001254ee000 x10: 0000000000000003 x9 : 0000000000000200
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff0000d3cc7108 x4 : ffff80009260c018 x3 : ffff8000858a21dc
x2 : 00000000ffffffc0 x1 : ffff0000d0a90000 x0 : 0000000000000000
Call trace:
 pskb_may_pull_reason include/linux/skbuff.h:2864 [inline] (P)
 pskb_network_may_pull_reason include/linux/skbuff.h:3294 [inline] (P)
 pskb_inet_may_pull_reason include/net/ip_tunnels.h:480 [inline] (P)
 pskb_inet_may_pull include/net/ip_tunnels.h:485 [inline] (P)
 ip6_tnl_start_xmit+0xc4c/0x10e0 net/ipv6/ip6_tunnel.c:1434 (P)
 __netdev_start_xmit include/linux/netdevice.h:5429 [inline]
 netdev_start_xmit include/linux/netdevice.h:5438 [inline]
 __dev_direct_xmit+0x2f0/0x548 net/core/dev.c:4990
 __xsk_generic_xmit net/xdp/xsk.c:1280 [inline]
 xsk_generic_xmit+0x174c/0x27e0 net/xdp/xsk.c:1336
 xsk_poll+0x2c4/0x5c8 net/xdp/xsk.c:1464
 sock_poll+0x250/0x310 net/socket.c:1514
 vfs_poll include/linux/poll.h:82 [inline]
 select_poll_one fs/select.c:480 [inline]
 do_select+0xb6c/0x11b8 fs/select.c:536
 core_sys_select+0x6a4/0x9e4 fs/select.c:677
 do_pselect fs/select.c:770 [inline]
 __do_sys_pselect6 fs/select.c:809 [inline]
 __se_sys_pselect6 fs/select.c:800 [inline]
 __arm64_sys_pselect6+0x2f0/0x39c fs/select.c:800
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
irq event stamp: 665
hardirqs last  enabled at (663): [<ffff80008688206c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last  enabled at (663): [<ffff80008688206c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (665): [<ffff80008685dbf4>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483
softirqs last  enabled at (658): [<ffff800084bb85e4>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (664): [<ffff800084c27b34>] netdev_get_tx_queue include/linux/netdevice.h:2731 [inline]
softirqs last disabled at (664): [<ffff800084c27b34>] skb_get_tx_queue include/linux/netdevice.h:2737 [inline]
softirqs last disabled at (664): [<ffff800084c27b34>] __dev_direct_xmit+0x1a8/0x548 net/core/dev.c:4983
---[ end trace 0000000000000000 ]---