netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:2253! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 27387 Comm: syz-executor.5 Not tainted 4.9.141+ #1 task: ffff8801c5d2df00 task.stack: ffff8801c7958000 RIP: 0010:[] [] skb_copy_and_csum_bits+0x67a/0x7d0 net/core/skbuff.c:2253 RSP: 0018:ffff8801db607230 EFLAGS: 00010206 netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. RAX: ffff8801c5d2df00 RBX: 0000000049e9fd7e RCX: 1ffff10038a254d9 RDX: 0000000000000100 RSI: ffffffff822c1dea RDI: ffff8801c512a6c8 RBP: ffff8801db6072b8 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000003c R11: ffff8801938f42df R12: 0000000000000000 R13: 0000000000000224 R14: 000000000000003c R15: ffff8801c512a6c0 FS: 00007ff65f66b700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020c35000 CR3: 00000001940e2000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Stack: ffffffff822aa650 ffff8801953da488 ffffffff8281cb9e ffffffff810efdbc ffffffff8281b771 ffff8801938f4068 0000003c81d226f7 ffff8801953da484 ffffffff0000003c 0000000049e9fd7e 0000003c000001e8 ffff8801953da3c0 Call Trace: [] icmp_glue_bits+0x7f/0x1d0 net/ipv4/icmp.c:344 [] __ip_append_data.isra.2+0x1dd7/0x2930 net/ipv4/ip_output.c:1081 [] ip_append_data.part.4+0xe4/0x150 net/ipv4/ip_output.c:1231 [] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1220 [] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362 [] icmp_send+0xac3/0x1430 net/ipv4/icmp.c:727 [] ip_fragment.constprop.5+0x1ac/0x200 net/ipv4/ip_output.c:550 [] ip_finish_output+0x7bb/0xc90 net/ipv4/ip_output.c:311 [] NF_HOOK_COND include/linux/netfilter.h:246 [inline] [] ip_output+0x1cd/0x550 net/ipv4/ip_output.c:401 [] dst_output include/net/dst.h:507 [inline] [] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:124 [] ip_queue_xmit+0x897/0x18c0 net/ipv4/ip_output.c:500 [] __tcp_transmit_skb+0x18bb/0x2df0 net/ipv4/tcp_output.c:1041 [] tcp_transmit_skb net/ipv4/tcp_output.c:1057 [inline] [] __tcp_retransmit_skb+0x587/0x1de0 net/ipv4/tcp_output.c:2763 [] tcp_retransmit_skb+0x29/0x2a0 net/ipv4/tcp_output.c:2782 [] tcp_retransmit_timer+0x92a/0x2290 net/ipv4/tcp_timer.c:507 [] tcp_write_timer_handler+0x1f1/0x790 net/ipv4/tcp_timer.c:591 [] tcp_write_timer+0xc2/0x180 net/ipv4/tcp_timer.c:609 [] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319 [] expire_timers+0x234/0x580 kernel/time/timer.c:1359 [] __run_timers kernel/time/timer.c:1674 [inline] [] run_timer_softirq+0x208/0x5e0 kernel/time/timer.c:1687 [] __do_softirq+0x20e/0x964 kernel/softirq.c:288 [] invoke_softirq kernel/softirq.c:368 [inline] [] irq_exit+0x11c/0x150 kernel/softirq.c:409 [] exiting_irq arch/x86/include/asm/apic.h:669 [inline] [] smp_apic_timer_interrupt+0x81/0xb0 arch/x86/kernel/apic/apic.c:962 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648 [ 471.928944] [] ? pty_write+0x6b/0x1d0 drivers/tty/pty.c:114 [] do_tty_write drivers/tty/tty_io.c:1181 [inline] [] tty_write+0x3b7/0x820 drivers/tty/tty_io.c:1265 [] __vfs_write+0x115/0x580 fs/read_write.c:507 [] vfs_write+0x187/0x520 fs/read_write.c:557 [] SYSC_write fs/read_write.c:604 [inline] [] SyS_write+0xd9/0x1c0 fs/read_write.c:596 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 30 ff ff ff 8b 5d c0 e8 86 9c 05 ff 8b 45 c8 85 c0 0f 84 98 fe ff ff e8 76 9c 05 ff <0f> 0b 8b 5d c0 e9 89 fe ff ff c7 45 ac 00 00 00 00 e9 9d fa ff RIP [] skb_copy_and_csum_bits+0x67a/0x7d0 net/core/skbuff.c:2253 RSP ---[ end trace 0451d2f7add7cd12 ]---