skbuff: skb_over_panic: text:ffffffff827f8203 len:232 put:72 head:ffff8801d790a500 data:ffff8801d790a500 tail:0xe8 end:0xc0 dev: ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:105! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 7634 Comm: syz-executor715 Not tainted 4.9.147+ #86 task: ffff8801d5cedf00 task.stack: ffff8801d3818000 RIP: 0010:[] [] skb_panic+0x166/0x168 net/core/skbuff.c:105 RSP: 0018:ffff8801d381ebc0 EFLAGS: 00010286 RAX: 0000000000000086 RBX: ffff8801d72bc000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff812270d2 RDI: ffff8801d5cee7ac RBP: ffff8801d381ec28 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82c6eda0 R13: ffff8801d790a500 R14: 00000000000000e8 R15: 00000000000000c0 FS: 00007f736456a700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fffe85dcf88 CR3: 00000001c9318000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801d790a500 00000000000000e8 00000000000000c0 ffffffff82c6eda0 0000000000000002 ffffffff82c6f1c0 ffffffff827f8203 0000004800000000 ffff8801d72bc000 ffffffff827f8203 0000000000000048 00000000000000e8 Call Trace: [] skb_over_panic net/core/skbuff.c:110 [inline] [] skb_put.cold.21+0x23/0x23 net/core/skbuff.c:1439 [] dump_esp_combs net/key/af_key.c:3025 [inline] [] pfkey_send_acquire+0x1623/0x2390 net/key/af_key.c:3248 [] km_query+0xba/0x1d0 net/xfrm/xfrm_state.c:1807 [] xfrm_state_find+0x18e1/0x2920 net/xfrm/xfrm_state.c:879 [] xfrm_tmpl_resolve_one+0x1d2/0x7a0 net/xfrm/xfrm_policy.c:1500 [] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:1544 [inline] [] xfrm_resolve_and_create_bundle+0x21f/0x1e70 net/xfrm/xfrm_policy.c:1893 [] xfrm_lookup+0x239/0xc00 net/xfrm/xfrm_policy.c:2254 [] xfrm_lookup_route+0x39/0x140 net/xfrm/xfrm_policy.c:2379 [] ip_route_output_flow+0x90/0xa0 net/ipv4/route.c:2448 [] udp_sendmsg+0x13d9/0x1c60 net/ipv4/udp.c:1025 [] udpv6_sendmsg+0x127d/0x2430 net/ipv6/udp.c:1086 [] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770 [] sock_sendmsg_nosec net/socket.c:648 [inline] [] sock_sendmsg+0xbb/0x110 net/socket.c:658 [] ___sys_sendmsg+0x47a/0x840 net/socket.c:1982 [] __sys_sendmmsg+0x161/0x3d0 net/socket.c:2072 [] SYSC_sendmmsg net/socket.c:2103 [inline] [] SyS_sendmmsg+0x35/0x60 net/socket.c:2098 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: 35 88 cf fe 4c 8b 4d b8 8b 4b 78 41 54 48 c7 c7 e0 ed c6 82 44 8b 45 d4 41 57 48 8b 55 c8 41 56 48 8b 75 c0 41 55 e8 be 89 c0 fe <0f> 0b e8 e7 10 b2 fe 4c 8b 65 08 e8 2e 6f cf fe 48 c7 c1 80 f1 RIP [] skb_panic+0x166/0x168 net/core/skbuff.c:101 RSP ---[ end trace 709a7d33f2ea7d7c ]---