program: capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0xffffffff, 0x2}) r0 = syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x80201) socket$packet(0x11, 0x3, 0x300) socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800, 0x0, 0x2}, 0x20) (async) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800, 0x0, 0x2}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) (async) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'ip6gre0\x00', 0x0}) bind$xdp(r1, &(0x7f00000003c0)={0x2c, 0xa, r3, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r1, 0x80000000) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}) (async) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(&(0x7f0000000800)=[{r1, 0x4}], 0x1, 0x0, 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x53, 0x7c67c9a5346444f2, 0x6, 0xab, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="2b380000001f", 0x0, 0x5, 0x0, 0x1, 0x0}) [ 94.395463][ T4642] Bluetooth: hci0: command tx timeout [ 94.527064][ T5316] capability: warning: `syz.0.0' uses 32-bit capabilities (legacy support in use) [ 94.581272][ T5317] ------------[ cut here ]------------ [ 94.584242][ T5317] len > ((int)(~0U >> 1)) [ 94.584255][ T5317] WARNING: ./include/linux/skbuff.h:2864 at ip6gre_tunnel_xmit+0xc78/0xf50, CPU#0: syz.0.0/5317 [ 94.590632][ T5317] Modules linked in: [ 94.593165][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.596958][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.601382][ T5317] RIP: 0010:ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.603908][ T5317] Code: 8c 24 90 01 00 00 4c 89 ef be 02 00 00 00 31 d2 e8 6d 5f 01 00 e9 1f fe ff ff e8 43 fa 22 f7 e9 15 fe ff ff e8 39 fa 22 f7 90 <0f> 0b 90 e9 49 f5 ff ff 44 89 ff 44 89 ee e8 35 fc 22 f7 45 39 ef [ 94.612369][ T5317] RSP: 0018:ffffc9000e237200 EFLAGS: 00010293 [ 94.614997][ T5317] RAX: ffffffff8aa43a87 RBX: 1ffff92001c46e4c RCX: ffff888035c04b00 [ 94.618457][ T5317] RDX: 0000000000000000 RSI: 00000000ffffff40 RDI: 0000000000000000 [ 94.621925][ T5317] RBP: ffffc9000e237490 R08: ffff888035c04b00 R09: 0000000000000002 [ 94.625304][ T5317] R10: 0000000000004888 R11: ffffffff8aa42e10 R12: 0000000000000000 [ 94.628687][ T5317] R13: ffff888043539140 R14: ffff888043539218 R15: 00000000ffffff40 [ 94.632112][ T5317] FS: 00007fc1597d66c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.635848][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.638478][ T5317] CR2: 00007fc1597b4fe8 CR3: 000000001fcaa000 CR4: 0000000000352ef0 [ 94.641756][ T5317] Call Trace: [ 94.643226][ T5317] [ 94.644507][ T5317] ? kmem_cache_alloc_node_noprof+0x111/0x620 [ 94.647142][ T5317] ? __pfx_ip6gre_tunnel_xmit+0x10/0x10 [ 94.649388][ T5317] ? skb_network_protocol+0x234/0x400 [ 94.651750][ T5317] ? netif_skb_features+0xb7a/0x1410 [ 94.653935][ T5317] ? netif_skb_features+0xc83/0x1410 [ 94.656050][ T5317] ? __alloc_skb+0x4d0/0x7a0 [ 94.657945][ T5317] ? __pfx_netif_skb_features+0x10/0x10 [ 94.659933][ T5317] ? validate_xmit_skb+0xcac/0x14f0 [ 94.661826][ T5317] ? validate_xmit_xfrm+0x5d/0x1120 [ 94.663672][ T5317] ? __dev_direct_xmit+0x33c/0x730 [ 94.665745][ T5317] __dev_direct_xmit+0x4b6/0x730 [ 94.667821][ T5317] ? __pfx___dev_direct_xmit+0x10/0x10 [ 94.669950][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.672274][ T5317] ? skb_put+0x112/0x210 [ 94.674145][ T5317] xsk_generic_xmit+0x272b/0x4730 [ 94.676249][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 94.678392][ T5317] ? xsk_generic_xmit+0x107/0x4730 [ 94.680540][ T5317] ? xsk_poll+0xa6/0x670 [ 94.682428][ T5317] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 94.684524][ T5317] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.686824][ T5317] ? xsk_poll+0xa6/0x670 [ 94.688443][ T5317] ? xsk_poll+0xa6/0x670 [ 94.690134][ T5317] xsk_poll+0x326/0x670 [ 94.691851][ T5317] ? xsk_poll+0xa6/0x670 [ 94.693295][ T5317] sock_poll+0x338/0x3f0 [ 94.694674][ T5317] ? __pfx_sock_poll+0x10/0x10 [ 94.696195][ T5317] do_sys_poll+0x990/0x1110 [ 94.697690][ T5317] ? do_sys_poll+0x4c1/0x1110 [ 94.699607][ T5317] ? __pfx_do_sys_poll+0x10/0x10 [ 94.701694][ T5317] ? update_se+0x90/0x1020 [ 94.703477][ T5317] ? __pfx___pollwait+0x10/0x10 [ 94.705342][ T5317] ? __pfx_pollwake+0x10/0x10 [ 94.707220][ T5317] ? futex_private_hash_put+0x132/0x160 [ 94.709570][ T5317] ? futex_wake+0x51b/0x5f0 [ 94.711659][ T5317] ? set_user_sigmask+0xcd/0x1c0 [ 94.713875][ T5317] ? __pfx_set_user_sigmask+0x10/0x10 [ 94.716267][ T5317] __se_sys_ppoll+0x209/0x2b0 [ 94.718317][ T5317] ? __pfx___se_sys_ppoll+0x10/0x10 [ 94.720447][ T5317] ? __x64_sys_ppoll+0x20/0xc0 [ 94.722426][ T5317] do_syscall_64+0x166/0x520 [ 94.724212][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.726297][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.728959][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.731238][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.733643][ T5317] RIP: 0033:0x7fc15899e0d9 [ 94.735556][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.743396][ T5317] RSP: 002b:00007fc1597d5fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 94.746929][ T5317] RAX: ffffffffffffffda RBX: 00007fc158c26090 RCX: 00007fc15899e0d9 [ 94.750252][ T5317] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000800 [ 94.753743][ T5317] RBP: 00007fc158a35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.756878][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.760070][ T5317] R13: 00007fc158c26128 R14: 00007fc158c26090 R15: 00007ffecc3502b8 [ 94.763426][ T5317] [ 94.764735][ T5317] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.767892][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.771523][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.775530][ T5317] Call Trace: [ 94.776917][ T5317] [ 94.778192][ T5317] vpanic+0x56d/0xa60 [ 94.779799][ T5317] ? __pfx__printk+0x10/0x10 [ 94.781623][ T5317] ? __pfx_vpanic+0x10/0x10 [ 94.783541][ T5317] ? is_bpf_text_address+0x292/0x2b0 [ 94.785752][ T5317] ? is_bpf_text_address+0x26/0x2b0 [ 94.787899][ T5317] panic+0xc5/0xd0 [ 94.789501][ T5317] ? __pfx_panic+0x10/0x10 [ 94.791358][ T5317] __warn+0x315/0x4c0 [ 94.793032][ T5317] ? ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.795191][ T5317] ? ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.797369][ T5317] __report_bug+0x276/0x570 [ 94.799307][ T5317] ? ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.801340][ T5317] ? __pfx___report_bug+0x10/0x10 [ 94.803425][ T5317] ? kasan_save_track+0x4f/0x80 [ 94.805425][ T5317] ? kasan_save_track+0x3e/0x80 [ 94.807392][ T5317] ? __kasan_slab_alloc+0x6c/0x80 [ 94.809402][ T5317] ? kmem_cache_alloc_node_noprof+0x359/0x620 [ 94.811875][ T5317] ? __alloc_skb+0x27a/0x7a0 [ 94.813766][ T5317] ? alloc_skb_with_frags+0xc6/0x760 [ 94.815899][ T5317] ? sock_alloc_send_pskb+0x878/0x990 [ 94.818141][ T5317] ? xsk_generic_xmit+0x972/0x4730 [ 94.820234][ T5317] ? xsk_poll+0x326/0x670 [ 94.821915][ T5317] ? sock_poll+0x338/0x3f0 [ 94.823745][ T5317] ? do_sys_poll+0x990/0x1110 [ 94.825670][ T5317] ? __se_sys_ppoll+0x209/0x2b0 [ 94.827557][ T5317] ? do_syscall_64+0x166/0x520 [ 94.829399][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.831859][ T5317] ? ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.833888][ T5317] report_bug+0x16b/0x220 [ 94.835638][ T5317] ? ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.837777][ T5317] ? ip6gre_tunnel_xmit+0xc7a/0xf50 [ 94.839909][ T5317] handle_bug+0x9c/0x200 [ 94.841594][ T5317] exc_invalid_op+0x1a/0x50 [ 94.843397][ T5317] asm_exc_invalid_op+0x1a/0x20 [ 94.845336][ T5317] RIP: 0010:ip6gre_tunnel_xmit+0xc78/0xf50 [ 94.847620][ T5317] Code: 8c 24 90 01 00 00 4c 89 ef be 02 00 00 00 31 d2 e8 6d 5f 01 00 e9 1f fe ff ff e8 43 fa 22 f7 e9 15 fe ff ff e8 39 fa 22 f7 90 <0f> 0b 90 e9 49 f5 ff ff 44 89 ff 44 89 ee e8 35 fc 22 f7 45 39 ef [ 94.855032][ T5317] RSP: 0018:ffffc9000e237200 EFLAGS: 00010293 [ 94.857326][ T5317] RAX: ffffffff8aa43a87 RBX: 1ffff92001c46e4c RCX: ffff888035c04b00 [ 94.860421][ T5317] RDX: 0000000000000000 RSI: 00000000ffffff40 RDI: 0000000000000000 [ 94.863639][ T5317] RBP: ffffc9000e237490 R08: ffff888035c04b00 R09: 0000000000000002 [ 94.866949][ T5317] R10: 0000000000004888 R11: ffffffff8aa42e10 R12: 0000000000000000 [ 94.870223][ T5317] R13: ffff888043539140 R14: ffff888043539218 R15: 00000000ffffff40 [ 94.873470][ T5317] ? __pfx_ip6gre_tunnel_xmit+0x10/0x10 [ 94.875549][ T5317] ? ip6gre_tunnel_xmit+0xc77/0xf50 [ 94.877482][ T5317] ? kmem_cache_alloc_node_noprof+0x111/0x620 [ 94.879728][ T5317] ? __pfx_ip6gre_tunnel_xmit+0x10/0x10 [ 94.881896][ T5317] ? skb_network_protocol+0x234/0x400 [ 94.884116][ T5317] ? netif_skb_features+0xb7a/0x1410 [ 94.886386][ T5317] ? netif_skb_features+0xc83/0x1410 [ 94.888632][ T5317] ? __alloc_skb+0x4d0/0x7a0 [ 94.890687][ T5317] ? __pfx_netif_skb_features+0x10/0x10 [ 94.893049][ T5317] ? validate_xmit_skb+0xcac/0x14f0 [ 94.895248][ T5317] ? validate_xmit_xfrm+0x5d/0x1120 [ 94.897371][ T5317] ? __dev_direct_xmit+0x33c/0x730 [ 94.899624][ T5317] __dev_direct_xmit+0x4b6/0x730 [ 94.901863][ T5317] ? __pfx___dev_direct_xmit+0x10/0x10 [ 94.904247][ T5317] ? do_raw_spin_unlock+0x4d/0x200 [ 94.906290][ T5317] ? skb_put+0x112/0x210 [ 94.908006][ T5317] xsk_generic_xmit+0x272b/0x4730 [ 94.910022][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 94.912269][ T5317] ? xsk_generic_xmit+0x107/0x4730 [ 94.914656][ T5317] ? xsk_poll+0xa6/0x670 [ 94.917056][ T5317] ? __pfx_xsk_generic_xmit+0x10/0x10 [ 94.919442][ T5317] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.921972][ T5317] ? xsk_poll+0xa6/0x670 [ 94.923776][ T5317] ? xsk_poll+0xa6/0x670 [ 94.925573][ T5317] xsk_poll+0x326/0x670 [ 94.927320][ T5317] ? xsk_poll+0xa6/0x670 [ 94.929040][ T5317] sock_poll+0x338/0x3f0 [ 94.930793][ T5317] ? __pfx_sock_poll+0x10/0x10 [ 94.932773][ T5317] do_sys_poll+0x990/0x1110 [ 94.934813][ T5317] ? do_sys_poll+0x4c1/0x1110 [ 94.936800][ T5317] ? __pfx_do_sys_poll+0x10/0x10 [ 94.938910][ T5317] ? update_se+0x90/0x1020 [ 94.940761][ T5317] ? __pfx___pollwait+0x10/0x10 [ 94.942858][ T5317] ? __pfx_pollwake+0x10/0x10 [ 94.944823][ T5317] ? futex_private_hash_put+0x132/0x160 [ 94.947199][ T5317] ? futex_wake+0x51b/0x5f0 [ 94.949261][ T5317] ? set_user_sigmask+0xcd/0x1c0 [ 94.951537][ T5317] ? __pfx_set_user_sigmask+0x10/0x10 [ 94.953903][ T5317] __se_sys_ppoll+0x209/0x2b0 [ 94.955930][ T5317] ? __pfx___se_sys_ppoll+0x10/0x10 [ 94.958190][ T5317] ? __x64_sys_ppoll+0x20/0xc0 [ 94.960287][ T5317] do_syscall_64+0x166/0x520 [ 94.962400][ T5317] ? trace_irq_disable+0x3b/0x140 [ 94.964628][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.967191][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 94.969163][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.971700][ T5317] RIP: 0033:0x7fc15899e0d9 [ 94.973629][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.981780][ T5317] RSP: 002b:00007fc1597d5fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 94.985272][ T5317] RAX: ffffffffffffffda RBX: 00007fc158c26090 RCX: 00007fc15899e0d9 [ 94.988518][ T5317] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000800 [ 94.991767][ T5317] RBP: 00007fc158a35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.995202][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.998550][ T5317] R13: 00007fc158c26128 R14: 00007fc158c26090 R15: 00007ffecc3502b8 [ 95.001938][ T5317] [ 95.003578][ T5317] Kernel Offset: disabled [ 95.005423][ T5317] Rebooting in 86400 seconds..