IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready skbuff: skb_over_panic: text:ffffffff827235b8 len:56 put:8 head:ffff880180570780 data:ffff880180570810 tail:0xc8 end:0xc0 dev:ip6tnl0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:105! invalid opcode: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 28947 Comm: syz-executor.4 Not tainted 4.9.141+ #1 task: ffff8801c6d05f00 task.stack: ffff8801884e0000 RIP: 0010:[] [] skb_panic+0x166/0x168 net/core/skbuff.c:105 RSP: 0018:ffff8801db707968 EFLAGS: 00010286 RAX: 0000000000000085 RBX: ffff8801a35fdb40 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81226ef2 RDI: ffff8801c6d067ac RBP: ffff8801db7079d0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88019f289100 R13: ffff880180570810 R14: 00000000000000c8 R15: 00000000000000c0 FS: 0000000001390940(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2fc25000 CR3: 00000001d2713000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff880180570810 00000000000000c8 00000000000000c0 ffff88019f289100 ffffffff822c8b4b ffffffff82c6fe40 ffffffff827235b8 00000008db707aa0 ffff8801a35fdb40 ffffffff827235b8 0000000000000008 00000000000000c8 Call Trace: [] skb_over_panic net/core/skbuff.c:110 [inline] [] skb_put.cold.21+0x23/0x23 net/core/skbuff.c:1439 [] mld_newpack+0x4d8/0x7b0 net/ipv6/mcast.c:1607 [] add_grhead.isra.14+0x29c/0x370 net/ipv6/mcast.c:1690 [] add_grec+0x6ab/0xf20 net/ipv6/mcast.c:1821 [] mld_send_cr net/ipv6/mcast.c:1947 [inline] [] mld_ifc_timer_expire+0x340/0x7b0 net/ipv6/mcast.c:2455 [] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319 [] expire_timers+0x234/0x580 kernel/time/timer.c:1359 [] __run_timers kernel/time/timer.c:1674 [inline] [] run_timer_softirq+0x208/0x5e0 kernel/time/timer.c:1687 [] __do_softirq+0x20e/0x964 kernel/softirq.c:288 [] invoke_softirq kernel/softirq.c:368 [inline] [] irq_exit+0x11c/0x150 kernel/softirq.c:409 [] exiting_irq arch/x86/include/asm/apic.h:669 [inline] [] smp_apic_timer_interrupt+0x81/0xb0 arch/x86/kernel/apic/apic.c:962 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:648 [ 1166.189806] [] ? get_next_corpse net/netfilter/nf_conntrack_core.c:1550 [inline] [ 1166.189806] [] ? nf_ct_iterate_cleanup+0x238/0x480 net/netfilter/nf_conntrack_core.c:1621 [] local_bh_enable include/linux/bottom_half.h:31 [inline] [] get_next_corpse net/netfilter/nf_conntrack_core.c:1565 [inline] [] nf_ct_iterate_cleanup+0x25f/0x480 net/netfilter/nf_conntrack_core.c:1621 [] masq_device_event+0xa8/0xd0 net/ipv4/netfilter/nf_nat_masquerade_ipv4.c:100 [] notifier_call_chain+0xb4/0x1d0 kernel/notifier.c:93 [] __raw_notifier_call_chain kernel/notifier.c:394 [inline] [] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 [] call_netdevice_notifiers_info+0x55/0x70 net/core/dev.c:1647 [] call_netdevice_notifiers net/core/dev.c:1663 [inline] [] dev_close_many+0x2e4/0x6a0 net/core/dev.c:1456 [] rollback_registered_many+0x3ac/0xb50 net/core/dev.c:6838 [] rollback_registered+0xee/0x1b0 net/core/dev.c:6901 [] unregister_netdevice_queue+0x1aa/0x230 net/core/dev.c:7888 [] unregister_netdevice include/linux/netdevice.h:2465 [inline] [] __tun_detach+0x821/0xa00 drivers/net/tun.c:575 [] tun_detach drivers/net/tun.c:585 [inline] [] tun_chr_close+0x44/0x60 drivers/net/tun.c:2392 [] __fput+0x263/0x700 fs/file_table.c:208 [] ____fput+0x15/0x20 fs/file_table.c:244 [] task_work_run+0x10c/0x180 kernel/task_work.c:116 [] tracehook_notify_resume include/linux/tracehook.h:191 [inline] [] exit_to_usermode_loop+0x129/0x150 arch/x86/entry/common.c:162 [] prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] [] syscall_return_slowpath arch/x86/entry/common.c:263 [inline] [] do_syscall_64+0x3e2/0x550 arch/x86/entry/common.c:290 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: 55 ab cf fe 4c 8b 4d b8 8b 4b 78 41 54 48 c7 c7 60 fa c6 82 44 8b 45 d4 41 57 48 8b 55 c8 41 56 48 8b 75 c0 41 55 e8 de a9 c0 fe <0f> 0b e8 47 35 b2 fe 4c 8b 65 08 e8 4e 92 cf fe 48 c7 c1 00 fe RIP [] skb_panic+0x166/0x168 net/core/skbuff.c:101 RSP ---[ end trace 70aa5425a9313237 ]---