------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:3404!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.4.0-rc4-syzkaller-00198-g9e87b63ed37e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:skb_copy_and_csum_bits+0x78b/0x850 net/core/skbuff.c:3404
Code: 08 08 eb 8a 44 8b 3c 24 e9 21 fe ff ff e8 6d 5a cf f9 e9 63 fd ff ff 48 8b 3c 24 e8 5f 5a cf f9 e9 d0 fc ff ff e8 65 91 7c f9 <0f> 0b 48 89 44 24 30 e8 49 5a cf f9 48 8b 44 24 30 e9 a4 fb ff ff
RSP: 0018:ffffc90000588198 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000000001e8 RCX: 0000000000000100
RDX: ffff888013ad4800 RSI: ffffffff8807b4db RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000000001e8 R11: 0000000000094001 R12: 000000000000003c
R13: 000000000000003c R14: ffff888048e42068 R15: 0000000000009bc6
FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f735167c CR3: 000000006409e000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
icmp_glue_bits+0x7b/0x210 net/ipv4/icmp.c:353
__ip_append_data+0x1d2f/0x39d0 net/ipv4/ip_output.c:1162
ip_append_data net/ipv4/ip_output.c:1344 [inline]
ip_append_data+0x115/0x1a0 net/ipv4/ip_output.c:1323
icmp_push_reply+0xa8/0x450 net/ipv4/icmp.c:370
__icmp_send+0xba6/0x1450 net/ipv4/icmp.c:770
icmp_send include/net/icmp.h:43 [inline]
ip_fragment.constprop.0+0x1e1/0x240 net/ipv4/ip_output.c:588
__ip_finish_output net/ipv4/ip_output.c:305 [inline]
__ip_finish_output+0x2de/0x650 net/ipv4/ip_output.c:289
ip_finish_output+0x31/0x280 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:292 [inline]
ip_output+0x1a3/0x320 net/ipv4/ip_output.c:431
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x8d9/0x1c50 net/ipv4/ip_output.c:533
__tcp_transmit_skb+0x194b/0x3800 net/ipv4/tcp_output.c:1399
tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]
__tcp_retransmit_skb+0x5fc/0x28a0 net/ipv4/tcp_output.c:3241
tcp_retransmit_skb+0x2e/0x360 net/ipv4/tcp_output.c:3264
tcp_retransmit_timer+0xfd1/0x35a0 net/ipv4/tcp_timer.c:547
tcp_write_timer_handler net/ipv4/tcp_timer.c:630 [inline]
tcp_write_timer_handler+0x4e2/0x990 net/ipv4/tcp_timer.c:604
tcp_write_timer+0xa6/0x2b0 net/ipv4/tcp_timer.c:647
call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
expire_timers+0x29b/0x4b0 kernel/time/timer.c:1751
__run_timers kernel/time/timer.c:2022 [inline]
__run_timers kernel/time/timer.c:1995 [inline]
run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
__do_softirq+0x1d4/0x905 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x114/0x190 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:72 [inline]
RIP: 0010:default_idle+0xf/0x20 arch/x86/kernel/process.c:711
Code: 89 07 49 c7 c0 08 00 00 00 4d 29 c8 4c 01 c7 4c 29 c2 e9 76 ff ff ff cc cc cc cc f3 0f 1e fa 66 90 0f 00 2d e3 a8 36 00 fb f4 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 65
RSP: 0018:ffffc90000477e08 EFLAGS: 00000246
RAX: 00000000007ff895 RBX: 0000000000000002 RCX: ffffffff8a0fd585
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff88802c836ceb
R10: ffffed1005906d9d R11: 0000000000000000 R12: 0000000000000002
R13: ffffffff8e7a7e50 R14: 0000000000000000 R15: 0000000000000000
default_idle_call+0x67/0xa0 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0x317/0x3c0 kernel/sched/idle.c:282
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:379
start_secondary+0x221/0x2b0 arch/x86/kernel/smpboot.c:269
secondary_startup_64_no_verify+0xf4/0xfb
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_copy_and_csum_bits+0x78b/0x850 net/core/skbuff.c:3404
Code: 08 08 eb 8a 44 8b 3c 24 e9 21 fe ff ff e8 6d 5a cf f9 e9 63 fd ff ff 48 8b 3c 24 e8 5f 5a cf f9 e9 d0 fc ff ff e8 65 91 7c f9 <0f> 0b 48 89 44 24 30 e8 49 5a cf f9 48 8b 44 24 30 e9 a4 fb ff ff
RSP: 0018:ffffc90000588198 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000000001e8 RCX: 0000000000000100
RDX: ffff888013ad4800 RSI: ffffffff8807b4db RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000000001e8 R11: 0000000000094001 R12: 000000000000003c
R13: 000000000000003c R14: ffff888048e42068 R15: 0000000000009bc6
FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000f735167c CR3: 000000006409e000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 89 07 mov %eax,(%rdi)
2: 49 c7 c0 08 00 00 00 mov $0x8,%r8
9: 4d 29 c8 sub %r9,%r8
c: 4c 01 c7 add %r8,%rdi
f: 4c 29 c2 sub %r8,%rdx
12: e9 76 ff ff ff jmpq 0xffffff8d
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: f3 0f 1e fa endbr64
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d e3 a8 36 00 verw 0x36a8e3(%rip) # 0x36a90b
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: c3 retq
2c: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1)
33: 00 00 00 00
37: 0f 1f 40 00 nopl 0x0(%rax)
3b: f3 0f 1e fa endbr64
3f: 65 gs