skbuff: skb_under_panic: text:ffffffff8a25e9d8 len:112 put:40 head:ffff88805a1b9d40 data:ffff88805a1b9d28 tail:0x58 end:0x180 dev:team0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:213!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 21670 Comm: syz.5.3130 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213
Code: c7 20 98 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 ce 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900000076e0 EFLAGS: 00010282
RAX: 0000000000000087 RBX: dffffc0000000000 RCX: b21fc3552acae300
RDX: 0000000000000100 RSI: 0000000000000101 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc90000007447 R09: 1ffff92000000e88
R10: dffffc0000000000 R11: fffff52000000e89 R12: ffff888059e14650
R13: ffff88805a1b9d40 R14: ffff88805a1b9d28 R15: 0000000000000058
FS:  0000000000000000(0000) GS:ffff888125e21000(0063) knlGS:00000000f546cb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080022018 CR3: 0000000031784000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 skb_under_panic net/core/skbuff.c:223 [inline]
 skb_push+0xc3/0xe0 net/core/skbuff.c:2641
 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371
 dev_hard_header include/linux/netdevice.h:3436 [inline]
 neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ndisc_send_skb+0xbce/0x1510 net/ipv6/ndisc.c:512
 addrconf_rs_timer+0x369/0x6a0 net/ipv6/addrconf.c:4037
 call_timer_fn+0x16e/0x590 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2373 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2385
 run_timer_base kernel/time/timer.c:2394 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2404
 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_preempt_read_enter kernel/rcu/tree_plugin.h:391 [inline]
RIP: 0010:__rcu_read_lock+0x2a/0x60 kernel/rcu/tree_plugin.h:414
Code: f3 0f 1e fa 53 65 48 8b 1c 25 08 f0 7f 92 48 81 c3 84 04 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 18 ff 03 8b 03 3d 00 00 00 40 7d 07 5b e9 d1 c0 b4 09 cc
RSP: 0018:ffffc9000bbd71c0 EFLAGS: 00000a07
RAX: 0000000000000000 RBX: ffff88806565a304 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000011 RDI: ffffea0001c11cc0
RBP: 0000000000000011 R08: ffffea0001c11cc7 R09: 1ffffd4000382398
R10: dffffc0000000000 R11: fffff94000382399 R12: ffffea0001c11cc0
R13: 0000000000000001 R14: dffffc0000000000 R15: ffff88813fffb400
 rcu_read_lock include/linux/rcupdate.h:865 [inline]
 lruvec_stat_mod_folio+0x68/0x2e0 mm/memcontrol.c:787
 __folio_mod_stat+0x6b/0x1c0 mm/rmap.c:1215
 folio_add_new_anon_rmap+0x64a/0x1a80 mm/rmap.c:1575
 wp_page_copy mm/memory.c:3786 [inline]
 do_wp_page+0x1bed/0x5810 mm/memory.c:4180
 handle_pte_fault mm/memory.c:6289 [inline]
 __handle_mm_fault mm/memory.c:6411 [inline]
 handle_mm_fault+0x14c5/0x32b0 mm/memory.c:6580
 do_user_addr_fault+0x764/0x1380 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x71/0xd0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:__put_user_nocheck_4+0x3/0x10 arch/x86/lib/putuser.S:104
Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 d7 6d 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000bbd7878 EFLAGS: 00050282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000080022018
RDX: ffff888065659e80 RSI: 0000000080000002 RDI: 00000000ffffffff
RBP: ffffc9000bbd79f0 R08: ffffc9000bbd7627 R09: 1ffff9200177aec4
R10: dffffc0000000000 R11: fffff5200177aec5 R12: 0000000080000002
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000080022000
 ____sys_recvmsg+0x2ab/0x460 net/socket.c:2825
 ___sys_recvmsg+0x1b5/0x510 net/socket.c:2854
 do_recvmmsg+0x36a/0x770 net/socket.c:2941
 __sys_recvmmsg+0x19d/0x280 net/socket.c:3023
 __do_compat_sys_recvmmsg_time32 net/compat.c:418 [inline]
 __se_compat_sys_recvmmsg_time32 net/compat.c:414 [inline]
 __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 net/compat.c:414
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0x1dc/0x560 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf709d539
Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f546c55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0
RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213
Code: c7 20 98 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 ce 6a f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900000076e0 EFLAGS: 00010282
RAX: 0000000000000087 RBX: dffffc0000000000 RCX: b21fc3552acae300
RDX: 0000000000000100 RSI: 0000000000000101 RDI: 0000000000000000
RBP: 0000000000000180 R08: ffffc90000007447 R09: 1ffff92000000e88
R10: dffffc0000000000 R11: fffff52000000e89 R12: ffff888059e14650
R13: ffff88805a1b9d40 R14: ffff88805a1b9d28 R15: 0000000000000058
FS:  0000000000000000(0000) GS:ffff888125e21000(0063) knlGS:00000000f546cb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080022018 CR3: 0000000031784000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	f3 0f 1e fa          	endbr64
   4:	53                   	push   %rbx
   5:	65 48 8b 1c 25 08 f0 	mov    %gs:0xffffffff927ff008,%rbx
   c:	7f 92
   e:	48 81 c3 84 04 00 00 	add    $0x484,%rbx
  15:	48 89 d8             	mov    %rbx,%rax
  18:	48 c1 e8 03          	shr    $0x3,%rax
  1c:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  23:	fc ff df
  26:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	75 18                	jne    0x46
  2e:	ff 03                	incl   (%rbx)
  30:	8b 03                	mov    (%rbx),%eax
  32:	3d 00 00 00 40       	cmp    $0x40000000,%eax
  37:	7d 07                	jge    0x40
  39:	5b                   	pop    %rbx
  3a:	e9 d1 c0 b4 09       	jmp    0x9b4c110
  3f:	cc                   	int3