Warning: Permanently added '10.128.0.13' (ED25519) to the list of known hosts. [*] Starting TIPC pskb_expand_head bug reproducer... [+] unshare(CLONE_NEWUSER | CLONE_NEWNET) successful. [+] RTM_NEWLINK veth pair netlink ACK (success). [+] Created veth pair (veth0 <-> veth1) successfully. [+] Interface veth0 brought UP successfully. [+] Interface veth1 brought UP successfully. [+] AF_PACKET socket bound to veth0 (ETH_P_TIPC) successfully. [+] AF_PACKET socket bound to veth1 (ETH_P_TIPC) successfully. [+] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) successful. [+] Resolved TIPCv2 Generic Netlink family ID: 57 [+] TIPC_NL_NET_SET netlink ACK (success). [+] TIPC_NL_KEY_SET netlink ACK (success). [+] TIPC_NL_BEARER_ENABLE netlink ACK (success). [+] AF_PACKET socket bound to veth0 (ETH_P_TIPC) successfully. [ 128.772114][ T5940] tipc: Started in network mode [ 128.772161][ T5940] tipc: Node identity 1001001, cluster identity 4711 [ 128.772176][ T5940] tipc: Nod ** replaying previous printk message ** [ 128.772176][ T5940] tipc: Node number set to 16781313 [ 128.774255][ T5940] tipc: Cannot configure node identity twice [ 128.777132][ T5940] tipc: Enabled bearer , priority 10 [ 128.794813][ C0] ------------[ cut here ]------------ [ 128.794871][ C0] kernel BUG at net/core/skbuff.c:2308! [ 128.794985][ C0] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 128.835642][ C0] CPU: 0 UID: 0 PID: 5940 Comm: syz-executor216 Not tainted syzkaller #0 PREEMPT(full) [ 128.845657][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 128.856213][ C0] RIP: 0010:pskb_expand_head+0x135a/0x13a0 [ 128.862276][ C0] Code: e9 10 f3 ff ff e8 76 06 1b f8 4c 89 e7 48 c7 c6 80 0c 23 8d e8 97 19 7b f7 90 0f 0b e8 5f 06 1b f8 90 0f 0b e8 57 06 1b f8 90 <0f> 0b 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c d8 fa ff ff 48 8b 3c 24 [ 128.883134][ C0] RSP: 0018:ffffc90000007520 EFLAGS: 00010246 [ 128.889429][ C0] RAX: ffffffff89ad0a29 RBX: dffffc0000000000 RCX: ffff88802a490000 [ 128.898310][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000001 [ 128.906782][ C0] RBP: 0000000000000000 R08: 0000000000000100 R09: 1ffff1100e875c3a [ 128.915418][ C0] R10: dffffc0000000000 R11: ffffed100e875c3b R12: 0000000000000820 [ 128.924283][ C0] R13: 0000000000000000 R14: 0000000000000002 R15: ffff8880743ae0f0 [ 128.932667][ C0] FS: 000055557b02f400(0000) GS:ffff888123abf000(0000) knlGS:0000000000000000 [ 128.943297][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 128.949914][ C0] CR2: 00007fff61507fa8 CR3: 000000007506a000 CR4: 00000000003526f0 [ 128.958088][ C0] Call Trace: [ 128.961501][ C0] [ 128.964641][ C0] __pskb_pull_tail+0x111/0x1870 [ 128.969840][ C0] skb_cow_data+0x2ed/0xc50 [ 128.974844][ C0] ? tipc_crypto_rcv+0x20a/0x23d0 [ 128.980100][ C0] tipc_crypto_rcv+0x346/0x23d0 [ 128.985299][ C0] ? tipc_node_find_by_id+0x425/0x4a0 [ 128.990790][ C0] ? __pfx_tipc_crypto_rcv+0x10/0x10 [ 128.996828][ C0] ? tipc_node_find_by_id+0xab/0x4a0 [ 129.002440][ C0] ? __pfx_tipc_node_find_by_id+0x10/0x10 [ 129.008280][ C0] ? net_generic+0x1e/0x240 [ 129.013153][ C0] ? tipc_ehdr_validate+0x190/0x350 [ 129.018752][ C0] tipc_rcv+0x4b7/0x1040 [ 129.023109][ C0] ? __pfx_tipc_rcv+0x10/0x10 [ 129.027839][ C0] ? tipc_l2_rcv_msg+0x28/0x470 [ 129.032911][ C0] tipc_l2_rcv_msg+0x2d9/0x470 [ 129.037988][ C0] __netif_receive_skb_core+0x2988/0x30c0 [ 129.044049][ C0] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 129.050425][ C0] ? __lock_acquire+0x747/0x2de0 [ 129.055462][ C0] ? lock_acquire+0x115/0x350 [ 129.060453][ C0] ? process_backlog+0x3de/0x18b0 [ 129.065611][ C0] ? process_backlog+0x3de/0x18b0 [ 129.071039][ C0] ? process_backlog+0x3de/0x18b0 [ 129.076427][ C0] process_backlog+0x727/0x18b0 [ 129.081516][ C0] ? process_backlog+0x3de/0x18b0 [ 129.086705][ C0] __napi_poll+0xaa/0x330 [ 129.091335][ C0] net_rx_action+0x61d/0xf50 [ 129.096331][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 129.102088][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 129.108023][ C0] ? __pfx_sched_clock_cpu+0x10/0x10 [ 129.113631][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 129.119604][ C0] ? sched_clock+0x41/0x60 [ 129.124344][ C0] handle_softirqs+0x226/0x860 [ 129.129248][ C0] ? do_softirq+0x77/0xd0 [ 129.133804][ C0] ? __dev_queue_xmit+0x29b/0x3920 [ 129.139156][ C0] do_softirq+0x77/0xd0 [ 129.143539][ C0] [ 129.146757][ C0] [ 129.149978][ C0] __local_bh_enable_ip+0x100/0x140 [ 129.155483][ C0] ? __dev_queue_xmit+0x29b/0x3920 [ 129.160621][ C0] __dev_queue_xmit+0x1efb/0x3920 [ 129.165991][ C0] ? __dev_queue_xmit+0x29b/0x3920 [ 129.171310][ C0] ? kasan_quarantine_put+0xbb/0x1f0 [ 129.176944][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 129.182519][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 129.188260][ C0] ? kfree+0x1c5/0x650 [ 129.192564][ C0] ? tipc_crypto_xmit+0x11f6/0x21a0 [ 129.197886][ C0] ? tipc_crypto_xmit+0x13e7/0x21a0 [ 129.203882][ C0] ? eth_header+0x11b/0x200 [ 129.208595][ C0] ? __asan_memcpy+0x40/0x70 [ 129.213843][ C0] ? eth_header+0x11b/0x200 [ 129.218662][ C0] ? __pfx_eth_header+0x10/0x10 [ 129.224093][ C0] tipc_l2_send_msg+0x331/0x400 [ 129.229415][ C0] tipc_bearer_xmit_skb+0x2b3/0x400 [ 129.235075][ C0] ? tipc_bearer_xmit_skb+0xa9/0x400 [ 129.240567][ C0] ? __pfx_tipc_bearer_xmit_skb+0x10/0x10 [ 129.246418][ C0] __tipc_nl_bearer_enable+0x10ec/0x1480 [ 129.253044][ C0] ? __pfx___mutex_trylock_common+0x10/0x10 [ 129.259064][ C0] ? __pfx___tipc_nl_bearer_enable+0x10/0x10 [ 129.265331][ C0] ? rcu_is_watching+0x16/0xb0 [ 129.270562][ C0] ? __pfx___mutex_lock+0x10/0x10 [ 129.275886][ C0] ? __kmalloc_noprof+0x38c/0x720 [ 129.281288][ C0] ? __nla_parse+0x40/0x60 [ 129.285932][ C0] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 129.292329][ C0] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 129.299113][ C0] tipc_nl_bearer_enable+0x22/0x40 [ 129.304394][ C0] genl_family_rcv_msg_doit+0x233/0x340 [ 129.310136][ C0] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 129.316792][ C0] ? bpf_lsm_capable+0x9/0x20 [ 129.321500][ C0] ? security_capable+0x7e/0x2c0 [ 129.326910][ C0] genl_rcv_msg+0x614/0x7a0 [ 129.331467][ C0] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.336870][ C0] ? __pfx_tipc_nl_bearer_enable+0x10/0x10 [ 129.343409][ C0] netlink_rcv_skb+0x226/0x4a0 [ 129.348465][ C0] ? __pfx_genl_rcv_msg+0x10/0x10 [ 129.354332][ C0] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 129.360097][ C0] ? down_read+0x2be/0x330 [ 129.364597][ C0] genl_rcv+0x28/0x40 [ 129.368830][ C0] netlink_unicast+0x8ef/0xa80 [ 129.374076][ C0] netlink_sendmsg+0x813/0xb40 [ 129.379315][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.384988][ C0] ? apparmor_socket_sendmsg+0x98/0x360 [ 129.390822][ C0] ? __pfx_netlink_sendmsg+0x10/0x10 [ 129.397005][ C0] sock_sendmsg_nosec+0x13a/0x180 [ 129.402251][ C0] __sys_sendto+0x408/0x5a0 [ 129.407070][ C0] ? __pfx___sys_sendto+0x10/0x10 [ 129.412327][ C0] ? __pfx___sys_bind+0x10/0x10 [ 129.417568][ C0] ? __pfx_ksys_write+0x10/0x10 [ 129.423047][ C0] __x64_sys_sendto+0xde/0x100 [ 129.428488][ C0] do_syscall_64+0x166/0x520 [ 129.433500][ C0] ? trace_irq_disable+0x3b/0x140 [ 129.438816][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.445193][ C0] ? clear_bhb_loop+0x70/0xc0 [ 129.450072][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 129.456467][ C0] RIP: 0033:0x7f091b73dcf7 [ 129.461227][ C0] Code: 48 89 fa 4c 89 df e8 98 1d 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 129.482087][ C0] RSP: 002b:00007fff615088d0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 129.491507][ C0] RAX: ffffffffffffffda RBX: 000055557b02f400 RCX: 00007f091b73dcf7 [ 129.499773][ C0] RDX: 0000000000000028 RSI: 00007fff61509950 RDI: 0000000000000005 [ 129.508761][ C0] RBP: 0000000000000005 R08: 00007fff61508924 R09: 000000000000000c [ 129.517298][ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000005 [+] AF_PACKET socket bound to veth1 (ETH_P_TIPC) successfully. [*] Enabling bearer on veth1 to trigger bug... [ 129.525742][ C0] R13: 00007f091b77b018 R14: 00007f091b7a2cc0 R15: 0000000000000002 [ 129.534706][ C0] [ 129.537745][ C0] Modules linked in: [ 129.541846][ C0] ---[ end trace 0000000000000000 ]--- [ 129.548015][ C0] RIP: 0010:pskb_expand_head+0x135a/0x13a0 [ 129.548062][ C0] Code: e9 10 f3 ff ff e8 76 06 1b f8 4c 89 e7 48 c7 c6 80 0c 23 8d e8 97 19 7b f7 90 0f 0b e8 5f 06 1b f8 90 0f 0b e8 57 06 1b f8 90 <0f> 0b 89 d1 80 e1 07 80 c1 03 38 c1 0f 8c d8 fa ff ff 48 8b 3c 24 [ 129.548082][ C0] RSP: 0018:ffffc90000007520 EFLAGS: 00010246 [ 129.548105][ C0] RAX: ffffffff89ad0a29 RBX: dffffc0000000000 RCX: ffff88802a490000 [ 129.548124][ C0] RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000001 [ 129.548139][ C0] RBP: 0000000000000000 R08: 0000000000000100 R09: 1ffff1100e875c3a [ 129.548162][ C0] R10: dffffc0000000000 R11: ffffed100e875c3b R12: 0000000000000820 [ 129.548179][ C0] R13: 0000000000000000 R14: 0000000000000002 R15: ffff8880743ae0f0 [ 129.548194][ C0] FS: 000055557b02f400(0000) GS:ffff888123abf000(0000) knlGS:0000000000000000 [ 129.548242][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.548264][ C0] CR2: 00007fff61507fa8 CR3: 000000007506a000 CR4: 00000000003526f0 [ 129.548289][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 129.654259][ C0] Kernel Offset: disabled [ 129.658842][ C0] Rebooting in 86400 seconds..