------------[ cut here ]------------ taprio: dequeue() called with unknown picos per byte. WARNING: CPU: 0 PID: 4682 at net/sched/sch_taprio.c:137 taprio_dequeue+0x1c1/0x210 net/sched/sch_taprio.c:137 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 4682 Comm: syz-executor.4 Not tainted 5.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x4d/0x6a lib/dump_stack.c:113 panic+0xf6/0x283 kernel/panic.c:214 __warn.cold.7+0x31/0x32 kernel/panic.c:571 report_bug+0xb6/0xe0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0x99/0xb0 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:taprio_dequeue+0x1c1/0x210 net/sched/sch_taprio.c:137 Code: 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 80 3d 81 c3 f1 00 00 75 15 48 c7 c7 40 c0 68 82 c6 05 71 c3 f1 00 01 e8 8c 80 61 ff <0f> 0b 48 8d 65 d8 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 41 83 c6 RSP: 0018:ffff888237a03e88 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888226294000 RCX: ffff888237a03d2c RDX: 0000000000000003 RSI: ffffffff82875c78 RDI: ffffffff82875c60 RBP: ffff888237a03ec0 R08: 0000000000000000 R09: 0000000000000035 R10: 0000000080000000 R11: 0000000000000000 R12: ffff888226294180 R13: ffff888226294180 R14: ffff888226294138 R15: ffff888226294000 dequeue_skb net/sched/sch_generic.c:261 [inline] qdisc_restart net/sched/sch_generic.c:364 [inline] __qdisc_run+0x7d/0x550 net/sched/sch_generic.c:382 qdisc_run include/net/pkt_sched.h:121 [inline] net_tx_action+0x141/0x2c0 net/core/dev.c:4636 __do_softirq+0xe8/0x33f kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x82/0xb0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0xa3/0x1a0 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:_raw_spin_unlock_irqrestore+0x2a/0x30 kernel/locking/spinlock.c:185 Code: 55 48 89 e5 41 54 49 89 f4 be 01 00 00 00 48 8b 55 08 53 48 89 fb 48 8d 7f 18 e8 a1 36 31 ff 48 89 df e8 99 76 31 ff 41 54 9d <5b> 41 5c 5d c3 90 55 be 01 00 00 00 48 89 e5 53 48 89 fb 48 8b 55 RSP: 0018:ffffc900012a38a8 EFLAGS: 00000287 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000001 RBX: ffff888237a1b940 RCX: ffffc900012a3864 RDX: 0000000000000001 RSI: ffff888237a1b958 RDI: ffff888237a1b940 RBP: ffffc900012a38b8 R08: 0000000000000000 R09: 0000000000000002 R10: 0000000000000000 R11: 000000000000004f R12: 0000000000000287 R13: ffff888226294348 R14: ffff888237a1b940 R15: ffffffff828796c0 unlock_hrtimer_base kernel/time/hrtimer.c:878 [inline] hrtimer_start_range_ns+0x1a8/0x300 kernel/time/hrtimer.c:1109 hrtimer_start include/linux/hrtimer.h:395 [inline] taprio_start_sched net/sched/sch_taprio.c:585 [inline] taprio_change net/sched/sch_taprio.c:719 [inline] taprio_init+0x394/0x5f0 net/sched/sch_taprio.c:793 qdisc_create+0x1aa/0x470 net/sched/sch_api.c:1240 tc_modify_qdisc+0x135/0x760 net/sched/sch_api.c:1655 rtnetlink_rcv_msg+0x2ed/0x3f0 net/core/rtnetlink.c:5195 netlink_rcv_skb+0x47/0x110 net/netlink/af_netlink.c:2485 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:5213 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x18c/0x230 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x208/0x3b0 net/netlink/af_netlink.c:1925 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0x2e/0x40 net/socket.c:661 ___sys_sendmsg+0x285/0x2e0 net/socket.c:2260 __sys_sendmsg+0x57/0xa0 net/socket.c:2298 __do_sys_sendmsg net/socket.c:2307 [inline] __se_sys_sendmsg net/socket.c:2305 [inline] __x64_sys_sendmsg+0x1a/0x20 net/socket.c:2305 do_syscall_64+0x4f/0x150 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fe8ab18ece9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe8aad110c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fe8ab2adf80 RCX: 00007fe8ab18ece9 RDX: 0000000004008000 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00007fe8ab1db47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007fe8ab2adf80 R15: 00007ffef4c64d38 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 55 push %rbp 1: 48 89 e5 mov %rsp,%rbp 4: 41 54 push %r12 6: 49 89 f4 mov %rsi,%r12 9: be 01 00 00 00 mov $0x1,%esi e: 48 8b 55 08 mov 0x8(%rbp),%rdx 12: 53 push %rbx 13: 48 89 fb mov %rdi,%rbx 16: 48 8d 7f 18 lea 0x18(%rdi),%rdi 1a: e8 a1 36 31 ff call 0xff3136c0 1f: 48 89 df mov %rbx,%rdi 22: e8 99 76 31 ff call 0xff3176c0 27: 41 54 push %r12 29: 9d popf * 2a: 5b pop %rbx <-- trapping instruction 2b: 41 5c pop %r12 2d: 5d pop %rbp 2e: c3 ret 2f: 90 nop 30: 55 push %rbp 31: be 01 00 00 00 mov $0x1,%esi 36: 48 89 e5 mov %rsp,%rbp 39: 53 push %rbx 3a: 48 89 fb mov %rdi,%rbx 3d: 48 rex.W 3e: 8b .byte 0x8b 3f: 55 push %rbp