------------[ cut here ]------------
WARNING: ./include/linux/skbuff.h:3243 at skb_mac_header include/linux/skbuff.h:3151 [inline], CPU#0: syz.1.2922/14445
WARNING: ./include/linux/skbuff.h:3243 at eth_hdr include/linux/if_ether.h:27 [inline], CPU#0: syz.1.2922/14445
WARNING: ./include/linux/skbuff.h:3243 at tcf_skbmod_act+0x4b0/0x4e0 net/sched/act_skbmod.c:71, CPU#0: syz.1.2922/14445
Modules linked in:
CPU: 0 UID: 0 PID: 14445 Comm: syz.1.2922 Tainted: G        W    L      syzkaller #0 PREEMPT 
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: linux,dummy-virt (DT)
pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : skb_network_header_len include/linux/skbuff.h:3243 [inline]
pc : tcf_skbmod_act+0x4b0/0x4e0 net/sched/act_skbmod.c:55
lr : tc_act include/net/tc_wrapper.h:254 [inline]
lr : tcf_action_exec+0xb0/0x1d4 net/sched/act_api.c:1150
sp : ffff800089bbb850
x29: ffff800089bbb850 x28: f3f000000bcfc108 x27: f3f000000bcfc100
x26: 0000000000000001 x25: 0000000020000000 x24: 0000000010000000
x23: 0000000000000000 x22: 0000000000000010 x21: fcf00000050d4300
x20: f8f000000bcfcd00 x19: f5f0000009d3c500 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000020000304
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff800089bbbac8 x7 : 0000000000000000 x6 : fff07ffffcd05000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : fcf0000012067540
x2 : ffffc1ffbf733230 x1 : 000000000000ffff x0 : 000000000000ffff
Call trace:
 skb_mac_header include/linux/skbuff.h:3151 [inline] (P)
 eth_hdr include/linux/if_ether.h:27 [inline] (P)
 tcf_skbmod_act+0x4b0/0x4e0 net/sched/act_skbmod.c:71 (P)
 tc_act include/net/tc_wrapper.h:254 [inline]
 tcf_action_exec+0xb0/0x1d4 net/sched/act_api.c:1150
 tcf_exts_exec include/net/pkt_cls.h:361 [inline]
 basic_classify+0x80/0xc4 net/sched/cls_basic.c:54
 tc_classify include/net/tc_wrapper.h:260 [inline]
 __tcf_classify net/sched/cls_api.c:1779 [inline]
 tcf_classify+0x1dc/0x410 net/sched/cls_api.c:1875
 tc_run+0x108/0x1e0 net/core/dev.c:4463
 sch_handle_ingress net/core/dev.c:4538 [inline]
 __netif_receive_skb_core.constprop.0+0x4d8/0xc40 net/core/dev.c:6115
 __netif_receive_skb_one_core+0x40/0x8c net/core/dev.c:6262
 __netif_receive_skb+0x18/0x60 net/core/dev.c:6377
 netif_receive_skb_internal net/core/dev.c:6463 [inline]
 netif_receive_skb+0x3c/0xd8 net/core/dev.c:6522
 tun_rx_batched drivers/net/tun.c:1595 [inline]
 tun_get_user+0xbbc/0xf70 drivers/net/tun.c:2045
 tun_chr_write_iter+0x5c/0xf0 drivers/net/tun.c:2091
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x244/0x36c fs/read_write.c:687
 ksys_write+0x70/0x108 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x18/0x24 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x54/0x10c arch/arm64/kernel/syscall.c:49
 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x1c/0x34 arch/arm64/kernel/syscall.c:140
 el0_svc+0x38/0x1fc arch/arm64/kernel/entry-common.c:758
 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777
 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:590
---[ end trace 0000000000000000 ]---