skbuff: skb_over_panic: text:0000000093bb623f len:56 put:8 head:000000003c2a8b60 data:000000008a81fd68 tail:0xc8 end:0xc0 dev:ip6tnl0
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:105!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 29466 Comm: kworker/1:3 Not tainted 4.9.203-syzkaller #0
Workqueue: ipv6_addrconf addrconf_dad_work
task: 0000000077c6f6ec task.stack: 000000004608ed77
RIP: 0010:[<ffffffff827fd9a7>]  [<00000000c2173d8c>] skb_panic+0x176/0x178 net/core/skbuff.c:105
RSP: 0018:ffff88019479f718  EFLAGS: 00010282
RAX: 0000000000000085 RBX: ffff8801d29c0dc0 RCX: 0000000000000000
ip6_tunnel: š
 xmit: Local address not yet configured!
RDX: 0000000000000000 RSI: ffffffff8122c977 RDI: ffffed00328f3ed5
RBP: ffff88019479f780 R08: 0000000000000085 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82c75840
R13: ffffffff8272b80e R14: 0000000000000008 R15: ffff8801a2492200
FS:  0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffc7c93668 CR3: 000000018db68000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801c8c6cf90 00000000000000c8 00000000000000c0 ffff8801a2492200
 ffffffff822dfc6c ffff8801c8c6cf90 00000000000000c8 00000000000000c0
 00000000000000c8 ffff8801d29c0dc0 0000000000000008 ffffffff8272b80e
Call Trace:
 [<00000000626925c1>] skb_over_panic net/core/skbuff.c:110 [inline]
 [<00000000626925c1>] skb_put.cold+0x23/0x23 net/core/skbuff.c:1443
 [<0000000093bb623f>] mld_newpack+0x4ce/0x7a0 net/ipv6/mcast.c:1608
 [<00000000a71f2a7f>] add_grhead.isra.0+0x29c/0x370 net/ipv6/mcast.c:1691
 [<0000000099ec4798>] add_grec+0x6a3/0xf10 net/ipv6/mcast.c:1822
 [<0000000045d3ee94>] mld_send_initial_cr.part.0+0xbd/0x150 net/ipv6/mcast.c:2073
 [<00000000a35618b5>] mld_send_initial_cr net/ipv6/mcast.c:2091 [inline]
 [<00000000a35618b5>] ipv6_mc_dad_complete+0x17c/0x1d0 net/ipv6/mcast.c:2085
 [<000000005cc8c481>] addrconf_dad_completed+0x401/0x930 net/ipv6/addrconf.c:4025
audit: type=1400 audit(1574824957.403:260): avc:  denied  { syslog } for  pid=31246 comm="syz-executor.2" capability=34  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1
 [<000000004590a866>] addrconf_dad_begin net/ipv6/addrconf.c:3822 [inline]
 [<000000004590a866>] addrconf_dad_work+0x840/0xc50 net/ipv6/addrconf.c:3922
 [<000000004681ac04>] process_one_work+0x88b/0x1600 kernel/workqueue.c:2114
 [<0000000026078389>] worker_thread+0x5df/0x11d0 kernel/workqueue.c:2251
 [<000000008e61fcf2>] kthread+0x278/0x310 kernel/kthread.c:211
 [<000000002e4323e8>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375
Code: 60 0e d0 fe 4c 8b 4d b8 8b 4b 78 41 57 45 89 f0 4c 89 ea ff 75 d0 4c 89 e6 48 c7 c7 60 54 c7 82 ff 75 c8 ff 75 c0 e8 7e d7 c0 fe <0f> 0b e8 82 4d b2 fe 4c 8b 65 08 e8 a9 f5 cf fe 48 c7 c1 00 58 
RIP  [<00000000c2173d8c>] skb_panic+0x176/0x178 net/core/skbuff.c:101
 RSP <ffff88019479f718>
---[ end trace dcef3583983b1349 ]---