program: socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8153, 0x2000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'tunl0\x00', 0x0}) r3 = dup(0xffffffffffffffff) connect$unix(r3, 0x0, 0x0) bind$xdp(r0, &(0x7f00000003c0)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x4000000000000000, 0x3}, 0x0, &(0x7f0000000040)={0x3ff, 0x0, 0x0, 0x9, 0xfffffffffffffffe, 0x0, 0x8000000000000000}, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x2f, 0x1, 0x0, 0x0, 0x0, 0x7, 0x520, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdd12, 0x4, @perf_bp={0x0, 0xc}, 0x209, 0x2, 0x0, 0x5, 0x87c, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x4c}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) [ 124.407928][ T5284] Bluetooth: hci0: command tx timeout [ 124.660264][ T5320] ------------[ cut here ]------------ [ 124.663306][ T5320] len > ((int)(~0U >> 1)) [ 124.663318][ T5320] WARNING: ./include/linux/skbuff.h:2864 at ipip_tunnel_xmit+0x330/0x4c0, CPU#0: syz.0.0/5320 [ 124.673307][ T5320] Modules linked in: [ 124.676678][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 124.682080][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.687571][ T5320] RIP: 0010:ipip_tunnel_xmit+0x330/0x4c0 [ 124.690123][ T5320] Code: ff ff ff 4d 8d bd 4c 0f 00 00 e8 1b a9 62 f7 4c 89 f7 4c 89 ee 4c 89 fa 89 e9 e8 fb b5 fc ff e9 28 ff ff ff e8 01 a9 62 f7 90 <0f> 0b 90 e9 cc fd ff ff 44 89 e7 44 89 fe e8 fd aa 62 f7 45 39 fc [ 124.698448][ T5320] RSP: 0018:ffffc9000e79f298 EFLAGS: 00010287 [ 124.701343][ T5320] RAX: ffffffff8a648bbf RBX: dffffc0000000000 RCX: 0000000000100000 [ 124.704609][ T5320] RDX: ffffc9000f341000 RSI: 0000000000000680 RDI: 0000000000000681 [ 124.707926][ T5320] RBP: 0000000000000000 R08: ffff88800096a580 R09: 0000000000000002 [ 124.711322][ T5320] R10: 0000000000004888 R11: ffffffff8a648890 R12: 00000000ffffff40 [ 124.715027][ T5320] R13: ffff88804003d358 R14: ffff88804003d280 R15: 0000000000000000 [ 124.718587][ T5320] FS: 00007fa1523cb6c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 124.722666][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 124.725796][ T5320] CR2: 00007fa1517ec0b0 CR3: 000000001afc8000 CR4: 0000000000352ef0 [ 124.729439][ T5320] Call Trace: [ 124.731029][ T5320] [ 124.732388][ T5320] ? __dev_direct_xmit+0x33c/0x730 [ 124.734654][ T5320] __dev_direct_xmit+0x4b6/0x730 [ 124.737066][ T5320] ? __pfx___dev_direct_xmit+0x10/0x10 [ 124.739618][ T5320] ? do_raw_spin_unlock+0x4d/0x200 [ 124.741828][ T5320] ? skb_put+0x112/0x210 [ 124.743686][ T5320] xsk_generic_xmit+0x272b/0x4730 [ 124.746023][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 124.748209][ T5320] ? xsk_generic_xmit+0x107/0x4730 [ 124.750863][ T5320] ? xsk_poll+0xa6/0x670 [ 124.753355][ T5320] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 124.756368][ T5320] ? xsk_poll+0xa6/0x670 [ 124.758846][ T5320] ? xsk_poll+0xa6/0x670 [ 124.760762][ T5320] xsk_poll+0x326/0x670 [ 124.762604][ T5320] ? xsk_poll+0xa6/0x670 [ 124.764583][ T5320] sock_poll+0x338/0x3f0 [ 124.767327][ T5320] ? __pfx_sock_poll+0x10/0x10 [ 124.770107][ T5320] do_select+0x1067/0x17f0 [ 124.772682][ T5320] ? do_select+0xb81/0x17f0 [ 124.775546][ T5320] ? __pfx_do_select+0x10/0x10 [ 124.778129][ T5320] ? trace_sched_exit_tp+0x3a/0x130 [ 124.780672][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 124.783156][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.785531][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.787679][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.789915][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.792185][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.794472][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.796944][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.799400][ T5320] ? __pfx_pollwake+0x10/0x10 [ 124.801643][ T5320] core_sys_select+0x86d/0xb40 [ 124.804124][ T5320] ? __pfx_core_sys_select+0x10/0x10 [ 124.807177][ T5320] ? __pfx_set_user_sigmask+0x10/0x10 [ 124.809852][ T5320] ? vm_mmap_pgoff+0x35a/0x4e0 [ 124.812180][ T5320] __se_sys_pselect6+0x267/0x320 [ 124.814491][ T5320] ? __pfx___se_sys_pselect6+0x10/0x10 [ 124.817567][ T5320] ? __x64_sys_pselect6+0x21/0xf0 [ 124.820425][ T5320] do_syscall_64+0x166/0x520 [ 124.822926][ T5320] ? trace_irq_disable+0x3b/0x140 [ 124.825556][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.828691][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 124.831374][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 124.835313][ T5320] RIP: 0033:0x7fa15159e0d9 [ 124.837504][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 124.849041][ T5320] RSP: 002b:00007fa1523cafe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 124.854173][ T5320] RAX: ffffffffffffffda RBX: 00007fa151825fa0 RCX: 00007fa15159e0d9 [ 124.858467][ T5320] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 124.862703][ T5320] RBP: 00007fa151635024 R08: 0000000000000000 R09: 0000000000000000 [ 124.867266][ T5320] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 124.871835][ T5320] R13: 00007fa151826038 R14: 00007fa151825fa0 R15: 00007ffd711b5d38 [ 124.876618][ T5320] [ 124.878418][ T5320] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 124.882227][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 124.886235][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 124.891395][ T5320] Call Trace: [ 124.893457][ T5320] [ 124.895251][ T5320] vpanic+0x56d/0xa60 [ 124.897732][ T5320] ? __pfx__printk+0x10/0x10 [ 124.899868][ T5320] ? __pfx_vpanic+0x10/0x10 [ 124.901941][ T5320] ? is_bpf_text_address+0x292/0x2b0 [ 124.904785][ T5320] ? is_bpf_text_address+0x26/0x2b0 [ 124.907367][ T5320] panic+0xc5/0xd0 [ 124.909258][ T5320] ? __pfx_panic+0x10/0x10 [ 124.911462][ T5320] __warn+0x315/0x4c0 [ 124.913323][ T5320] ? ipip_tunnel_xmit+0x330/0x4c0 [ 124.915924][ T5320] ? ipip_tunnel_xmit+0x330/0x4c0 [ 124.918220][ T5320] __report_bug+0x276/0x570 [ 124.920357][ T5320] ? ipip_tunnel_xmit+0x330/0x4c0 [ 124.922774][ T5320] ? __pfx___report_bug+0x10/0x10 [ 124.925380][ T5320] ? skb_network_protocol+0x234/0x400 [ 124.928442][ T5320] ? netif_skb_features+0xb7a/0x1410 [ 124.931006][ T5320] ? netif_skb_features+0xc83/0x1410 [ 124.933435][ T5320] ? ipip_tunnel_xmit+0x330/0x4c0 [ 124.935792][ T5320] report_bug+0x16b/0x220 [ 124.937866][ T5320] ? ipip_tunnel_xmit+0x330/0x4c0 [ 124.940298][ T5320] ? ipip_tunnel_xmit+0x332/0x4c0 [ 124.942635][ T5320] handle_bug+0x9c/0x200 [ 124.944615][ T5320] exc_invalid_op+0x1a/0x50 [ 124.947052][ T5320] asm_exc_invalid_op+0x1a/0x20 [ 124.949575][ T5320] RIP: 0010:ipip_tunnel_xmit+0x330/0x4c0 [ 124.952439][ T5320] Code: ff ff ff 4d 8d bd 4c 0f 00 00 e8 1b a9 62 f7 4c 89 f7 4c 89 ee 4c 89 fa 89 e9 e8 fb b5 fc ff e9 28 ff ff ff e8 01 a9 62 f7 90 <0f> 0b 90 e9 cc fd ff ff 44 89 e7 44 89 fe e8 fd aa 62 f7 45 39 fc [ 124.961543][ T5320] RSP: 0018:ffffc9000e79f298 EFLAGS: 00010287 [ 124.964390][ T5320] RAX: ffffffff8a648bbf RBX: dffffc0000000000 RCX: 0000000000100000 [ 124.969350][ T5320] RDX: ffffc9000f341000 RSI: 0000000000000680 RDI: 0000000000000681 [ 124.973736][ T5320] RBP: 0000000000000000 R08: ffff88800096a580 R09: 0000000000000002 [ 124.977395][ T5320] R10: 0000000000004888 R11: ffffffff8a648890 R12: 00000000ffffff40 [ 124.980664][ T5320] R13: ffff88804003d358 R14: ffff88804003d280 R15: 0000000000000000 [ 124.984104][ T5320] ? __pfx_ipip_tunnel_xmit+0x10/0x10 [ 124.986687][ T5320] ? ipip_tunnel_xmit+0x32f/0x4c0 [ 124.989627][ T5320] ? ipip_tunnel_xmit+0x32f/0x4c0 [ 124.991851][ T5320] ? __dev_direct_xmit+0x33c/0x730 [ 124.994637][ T5320] __dev_direct_xmit+0x4b6/0x730 [ 124.997801][ T5320] ? __pfx___dev_direct_xmit+0x10/0x10 [ 125.000300][ T5320] ? do_raw_spin_unlock+0x4d/0x200 [ 125.002865][ T5320] ? skb_put+0x112/0x210 [ 125.005016][ T5320] xsk_generic_xmit+0x272b/0x4730 [ 125.007837][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 125.010422][ T5320] ? xsk_generic_xmit+0x107/0x4730 [ 125.012734][ T5320] ? xsk_poll+0xa6/0x670 [ 125.014650][ T5320] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 125.017131][ T5320] ? xsk_poll+0xa6/0x670 [ 125.019081][ T5320] ? xsk_poll+0xa6/0x670 [ 125.021178][ T5320] xsk_poll+0x326/0x670 [ 125.023062][ T5320] ? xsk_poll+0xa6/0x670 [ 125.025017][ T5320] sock_poll+0x338/0x3f0 [ 125.026992][ T5320] ? __pfx_sock_poll+0x10/0x10 [ 125.029175][ T5320] do_select+0x1067/0x17f0 [ 125.031286][ T5320] ? do_select+0xb81/0x17f0 [ 125.033338][ T5320] ? __pfx_do_select+0x10/0x10 [ 125.035491][ T5320] ? trace_sched_exit_tp+0x3a/0x130 [ 125.037948][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 125.040110][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.042303][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.044584][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.046783][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.048926][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.051120][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.053298][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.055704][ T5320] ? __pfx_pollwake+0x10/0x10 [ 125.058459][ T5320] core_sys_select+0x86d/0xb40 [ 125.060904][ T5320] ? __pfx_core_sys_select+0x10/0x10 [ 125.063462][ T5320] ? __pfx_set_user_sigmask+0x10/0x10 [ 125.066455][ T5320] ? vm_mmap_pgoff+0x35a/0x4e0 [ 125.068702][ T5320] __se_sys_pselect6+0x267/0x320 [ 125.071542][ T5320] ? __pfx___se_sys_pselect6+0x10/0x10 [ 125.074831][ T5320] ? __x64_sys_pselect6+0x21/0xf0 [ 125.077623][ T5320] do_syscall_64+0x166/0x520 [ 125.079884][ T5320] ? trace_irq_disable+0x3b/0x140 [ 125.082382][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.085682][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 125.087865][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.091115][ T5320] RIP: 0033:0x7fa15159e0d9 [ 125.093819][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.103447][ T5320] RSP: 002b:00007fa1523cafe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 125.108086][ T5320] RAX: ffffffffffffffda RBX: 00007fa151825fa0 RCX: 00007fa15159e0d9 [ 125.112551][ T5320] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 125.117398][ T5320] RBP: 00007fa151635024 R08: 0000000000000000 R09: 0000000000000000 [ 125.121526][ T5320] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 [ 125.125793][ T5320] R13: 00007fa151826038 R14: 00007fa151825fa0 R15: 00007ffd711b5d38 [ 125.130004][ T5320] [ 125.132182][ T5320] Kernel Offset: disabled [ 125.134853][ T5320] Rebooting in 86400 seconds..