audit: type=1400 audit(1573739274.568:10): avc:  denied  { map_create } for  pid=3510 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1
skbuff: skb_over_panic: text:000000001e94f601 len:232 put:72 head:000000004f166fe4 data:000000004f166fe4 tail:0xe8 end:0xc0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:105!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 3548 Comm: syz-executor.5 Not tainted 4.9.194+ #0
task: 00000000a3954505 task.stack: 0000000018643a08
RIP: 0010:[<ffffffff8280e1d7>]  [<0000000088cacc57>] skb_panic+0x176/0x178 net/core/skbuff.c:105
RSP: 0018:ffff8801a23ced60  EFLAGS: 00010282
RAX: 0000000000000086 RBX: ffff8801c9289500 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8122c907 RDI: ffffed0034479d9e
RBP: ffff8801a23cedc8 R08: 0000000000000086 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff82c769a0
R13: ffffffff8280b7e6 R14: 0000000000000048 R15: ffffffff82c76580
FS:  00007f4e44763700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020a21000 CR3: 00000001ccfbf000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d39df400 00000000000000e8 00000000000000c0 ffffffff82c76580
 ffffffff822ea180 ffff8801d39df400 00000000000000e8 00000000000000c0
 00000000000000e8 ffff8801c9289500 0000000000000048 ffffffff8280b7e6
Call Trace:
 [<000000009f1d98b3>] skb_over_panic net/core/skbuff.c:110 [inline]
 [<000000009f1d98b3>] skb_put.cold+0x23/0x23 net/core/skbuff.c:1443
 [<000000001e94f601>] dump_esp_combs net/key/af_key.c:3031 [inline]
 [<000000001e94f601>] pfkey_send_acquire+0x1656/0x23f0 net/key/af_key.c:3254
 [<000000005bcb6a1c>] km_query+0xba/0x1d0 net/xfrm/xfrm_state.c:1807
 [<0000000079dc528e>] xfrm_state_find+0x18b3/0x2910 net/xfrm/xfrm_state.c:879
 [<0000000097d4d548>] xfrm_tmpl_resolve_one+0x1c7/0x7a0 net/xfrm/xfrm_policy.c:1500
 [<00000000d32c42c3>] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:1544 [inline]
 [<00000000d32c42c3>] xfrm_resolve_and_create_bundle+0x210/0x1e80 net/xfrm/xfrm_policy.c:1896
 [<0000000024ec46fd>] xfrm_lookup+0x200/0xaf0 net/xfrm/xfrm_policy.c:2257
 [<0000000088d5efa1>] xfrm_lookup_route+0x38/0x140 net/xfrm/xfrm_policy.c:2382
 [<0000000016848977>] ip_route_output_flow+0x93/0xa0 net/ipv4/route.c:2485
 [<000000006c75dd01>] udp_sendmsg+0x1494/0x1c60 net/ipv4/udp.c:1029
 [<000000001c730f8c>] udpv6_sendmsg+0x12af/0x2430 net/ipv6/udp.c:1086
 [<000000006381f404>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:766
 [<000000004db93c7c>] sock_sendmsg_nosec net/socket.c:649 [inline]
 [<000000004db93c7c>] sock_sendmsg+0xbe/0x110 net/socket.c:659
 [<00000000726fd011>] ___sys_sendmsg+0x387/0x8b0 net/socket.c:1983
 [<000000001c433f43>] __sys_sendmmsg+0x164/0x3d0 net/socket.c:2073
 [<000000001f6f63b7>] SYSC_sendmmsg net/socket.c:2104 [inline]
 [<000000001f6f63b7>] SyS_sendmmsg+0x35/0x60 net/socket.c:2099
 [<000000002a46e329>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
 [<00000000dea66206>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Code: c0 06 cf fe 4c 8b 4d b8 8b 4b 78 41 57 45 89 f0 4c 89 ea ff 75 d0 4c 89 e6 48 c7 c7 c0 65 c7 82 ff 75 c8 ff 75 c0 e8 27 ce bf fe <0f> 0b e8 22 45 b1 fe 4c 8b 65 08 e8 09 ee ce fe 48 c7 c1 60 69 
RIP  [<0000000088cacc57>] skb_panic+0x176/0x178 net/core/skbuff.c:101
 RSP <ffff8801a23ced60>
futex_wake_op: syz-executor.3 tries to shift op by -1; fix this program
---[ end trace e27902f5bc3e560e ]---