program: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x800000, 0x1, 0x1000, 0x800}, 0x10) mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x3, 0x11, r0, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r2, &(0x7f0000000210)="01", 0x1) read(r1, &(0x7f0000800000)=""/8, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x4000010, &(0x7f0000000000)={0x11, 0x10, r4, 0x1, 0x0, 0x0, @multicast}, 0x14) [ 93.058717][ T4635] Bluetooth: hci0: command tx timeout [ 93.073210][ T1363] cfg80211: failed to load regulatory.db [ 93.330411][ T5310] ------------[ cut here ]------------ [ 93.333725][ T5310] skb_assert_len [ 93.335334][ T5310] WARNING: ./include/linux/skbuff.h:2753 at __dev_queue_xmit+0x1fb8/0x3820, CPU#0: syz.0.0/5310 [ 93.339827][ T5310] Modules linked in: [ 93.341623][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.345410][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.350011][ T5310] RIP: 0010:__dev_queue_xmit+0x1fbf/0x3820 [ 93.352881][ T5310] Code: 48 c7 44 24 10 00 00 00 00 e9 50 fe ff ff e8 08 97 24 f8 90 0f 0b 90 e9 d6 e1 ff ff 48 8d 3d 18 68 c4 06 48 c7 c6 86 ef 43 8e <67> 48 0f b9 3a 80 3d 4c 70 9e 06 01 0f 85 86 03 00 00 e8 da 96 24 [ 93.360847][ T5310] RSP: 0018:ffffc9000e1a7660 EFLAGS: 00010246 [ 93.363318][ T5310] RAX: ffffffff89a25e11 RBX: ffff8880438315d0 RCX: 0000000000000002 [ 93.366784][ T5310] RDX: ffff888012da4a80 RSI: ffffffff8e43ef86 RDI: ffffffff9066e400 [ 93.369917][ T5310] RBP: ffffc9000e1a7910 R08: ffff888012bb08a7 R09: 1ffff11002576114 [ 93.373170][ T5310] R10: dffffc0000000000 R11: ffffed1002576115 R12: dffffc0000000000 [ 93.376391][ T5310] R13: 1ffff92001c34eec R14: 0000000000000000 R15: ffff8880438315d0 [ 93.379612][ T5310] FS: 00007fd4a53c16c0(0000) GS:ffff88808c549000(0000) knlGS:0000000000000000 [ 93.383545][ T5310] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.386274][ T5310] CR2: 0000556898bd3660 CR3: 0000000012b55000 CR4: 0000000000352ef0 [ 93.389523][ T5310] Call Trace: [ 93.390964][ T5310] [ 93.392201][ T5310] ? __alloc_skb+0x4cc/0x7a0 [ 93.394377][ T5310] ? alloc_skb_with_frags+0x6b3/0x760 [ 93.396574][ T5310] ? __lock_acquire+0x683/0x2cf0 [ 93.398710][ T5310] ? skb_set_owner_w+0x263/0x3d0 [ 93.401063][ T5310] ? __pfx___dev_queue_xmit+0x10/0x10 [ 93.403213][ T5310] ? sock_alloc_send_pskb+0x896/0x990 [ 93.405653][ T5310] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 93.408055][ T5310] ? packet_parse_headers+0x4dc/0x7b0 [ 93.410507][ T5310] ? packet_parse_headers+0x57e/0x7b0 [ 93.412882][ T5310] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 93.415506][ T5310] ? __pfx_packet_parse_headers+0x10/0x10 [ 93.417954][ T5310] ? packet_xmit+0x68/0x330 [ 93.419814][ T5310] packet_sendmsg+0x1f38/0x4e80 [ 93.421921][ T5310] ? futex_unqueue+0x22/0x240 [ 93.424021][ T5310] ? __pfx_packet_sendmsg+0x10/0x10 [ 93.426243][ T5310] ? aa_sk_perm+0x6d5/0x900 [ 93.428085][ T5310] ? do_set_pmd+0x7b0/0x890 [ 93.429941][ T5310] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.432049][ T5310] ? __pfx_packet_sendmsg+0x10/0x10 [ 93.434430][ T5310] sock_sendmsg_nosec+0x13a/0x180 [ 93.436790][ T5310] __sys_sendto+0x408/0x5a0 [ 93.439245][ T5310] ? __pfx___sys_sendto+0x10/0x10 [ 93.441483][ T5310] ? rcu_is_watching+0x15/0xb0 [ 93.443551][ T5310] __x64_sys_sendto+0xde/0x100 [ 93.445809][ T5310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.448506][ T5310] do_syscall_64+0x174/0x580 [ 93.450857][ T5310] ? trace_irq_disable+0x3b/0x140 [ 93.453142][ T5310] ? clear_bhb_loop+0x70/0xc0 [ 93.455562][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.458153][ T5310] RIP: 0033:0x7fd4a459e0d9 [ 93.460126][ T5310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.467893][ T5310] RSP: 002b:00007fd4a53c0fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 93.471527][ T5310] RAX: ffffffffffffffda RBX: 00007fd4a4825fa0 RCX: 00007fd4a459e0d9 [ 93.475018][ T5310] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 93.478522][ T5310] RBP: 00007fd4a4635024 R08: 0000200000000000 R09: 0000000000000014 [ 93.482043][ T5310] R10: 0000000004000010 R11: 0000000000000246 R12: 0000000000000000 [ 93.486565][ T5310] R13: 00007fd4a4826038 R14: 00007fd4a4825fa0 R15: 00007ffda58154f8 [ 93.490019][ T5310] [ 93.491493][ T5310] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.494899][ T5310] CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.498950][ T5310] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.503519][ T5310] Call Trace: [ 93.504910][ T5310] [ 93.506173][ T5310] vpanic+0x56c/0xa60 [ 93.507799][ T5310] ? __pfx__printk+0x10/0x10 [ 93.509672][ T5310] ? __pfx_vpanic+0x10/0x10 [ 93.511494][ T5310] ? is_bpf_text_address+0x292/0x2b0 [ 93.513572][ T5310] ? is_bpf_text_address+0x26/0x2b0 [ 93.515840][ T5310] panic+0xc5/0xd0 [ 93.517469][ T5310] ? __pfx_panic+0x10/0x10 [ 93.519388][ T5310] __warn+0x315/0x4c0 [ 93.521273][ T5310] ? __dev_queue_xmit+0x1fb8/0x3820 [ 93.523595][ T5310] ? __dev_queue_xmit+0x1fb8/0x3820 [ 93.525702][ T5310] __report_bug+0x276/0x570 [ 93.527520][ T5310] ? packet_sendmsg+0xdef/0x4e80 [ 93.529525][ T5310] ? sock_sendmsg_nosec+0x13a/0x180 [ 93.531746][ T5310] ? __sys_sendto+0x408/0x5a0 [ 93.533824][ T5310] ? __dev_queue_xmit+0x1fb8/0x3820 [ 93.536103][ T5310] ? __pfx___report_bug+0x10/0x10 [ 93.537907][ T5310] report_bug_entry+0x19a/0x290 [ 93.539754][ T5310] ? __dev_queue_xmit+0x1fbf/0x3820 [ 93.541749][ T5310] ? __dev_queue_xmit+0x1fc4/0x3820 [ 93.543967][ T5310] handle_bug+0xce/0x200 [ 93.545848][ T5310] exc_invalid_op+0x1a/0x50 [ 93.547796][ T5310] asm_exc_invalid_op+0x1a/0x20 [ 93.550046][ T5310] RIP: 0010:__dev_queue_xmit+0x1fbf/0x3820 [ 93.552378][ T5310] Code: 48 c7 44 24 10 00 00 00 00 e9 50 fe ff ff e8 08 97 24 f8 90 0f 0b 90 e9 d6 e1 ff ff 48 8d 3d 18 68 c4 06 48 c7 c6 86 ef 43 8e <67> 48 0f b9 3a 80 3d 4c 70 9e 06 01 0f 85 86 03 00 00 e8 da 96 24 [ 93.560159][ T5310] RSP: 0018:ffffc9000e1a7660 EFLAGS: 00010246 [ 93.562825][ T5310] RAX: ffffffff89a25e11 RBX: ffff8880438315d0 RCX: 0000000000000002 [ 93.566286][ T5310] RDX: ffff888012da4a80 RSI: ffffffff8e43ef86 RDI: ffffffff9066e400 [ 93.569729][ T5310] RBP: ffffc9000e1a7910 R08: ffff888012bb08a7 R09: 1ffff11002576114 [ 93.573184][ T5310] R10: dffffc0000000000 R11: ffffed1002576115 R12: dffffc0000000000 [ 93.576531][ T5310] R13: 1ffff92001c34eec R14: 0000000000000000 R15: ffff8880438315d0 [ 93.579680][ T5310] ? __dev_queue_xmit+0x1e1/0x3820 [ 93.581749][ T5310] ? __alloc_skb+0x4cc/0x7a0 [ 93.583632][ T5310] ? alloc_skb_with_frags+0x6b3/0x760 [ 93.585899][ T5310] ? __lock_acquire+0x683/0x2cf0 [ 93.588020][ T5310] ? skb_set_owner_w+0x263/0x3d0 [ 93.590117][ T5310] ? __pfx___dev_queue_xmit+0x10/0x10 [ 93.592282][ T5310] ? sock_alloc_send_pskb+0x896/0x990 [ 93.594467][ T5310] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 93.596570][ T5310] ? packet_parse_headers+0x4dc/0x7b0 [ 93.598773][ T5310] ? packet_parse_headers+0x57e/0x7b0 [ 93.601076][ T5310] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 93.603478][ T5310] ? __pfx_packet_parse_headers+0x10/0x10 [ 93.606078][ T5310] ? packet_xmit+0x68/0x330 [ 93.608321][ T5310] packet_sendmsg+0x1f38/0x4e80 [ 93.610801][ T5310] ? futex_unqueue+0x22/0x240 [ 93.613035][ T5310] ? __pfx_packet_sendmsg+0x10/0x10 [ 93.615473][ T5310] ? aa_sk_perm+0x6d5/0x900 [ 93.617722][ T5310] ? do_set_pmd+0x7b0/0x890 [ 93.619787][ T5310] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.622241][ T5310] ? __pfx_packet_sendmsg+0x10/0x10 [ 93.624402][ T5310] sock_sendmsg_nosec+0x13a/0x180 [ 93.626434][ T5310] __sys_sendto+0x408/0x5a0 [ 93.628397][ T5310] ? __pfx___sys_sendto+0x10/0x10 [ 93.630799][ T5310] ? rcu_is_watching+0x15/0xb0 [ 93.633162][ T5310] __x64_sys_sendto+0xde/0x100 [ 93.635574][ T5310] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.638385][ T5310] do_syscall_64+0x174/0x580 [ 93.640696][ T5310] ? trace_irq_disable+0x3b/0x140 [ 93.643185][ T5310] ? clear_bhb_loop+0x70/0xc0 [ 93.645471][ T5310] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.647827][ T5310] RIP: 0033:0x7fd4a459e0d9 [ 93.649604][ T5310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.657423][ T5310] RSP: 002b:00007fd4a53c0fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 93.660991][ T5310] RAX: ffffffffffffffda RBX: 00007fd4a4825fa0 RCX: 00007fd4a459e0d9 [ 93.664397][ T5310] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 93.667839][ T5310] RBP: 00007fd4a4635024 R08: 0000200000000000 R09: 0000000000000014 [ 93.671327][ T5310] R10: 0000000004000010 R11: 0000000000000246 R12: 0000000000000000 [ 93.674807][ T5310] R13: 00007fd4a4826038 R14: 00007fd4a4825fa0 R15: 00007ffda58154f8 [ 93.678858][ T5310] [ 93.680784][ T5310] Kernel Offset: disabled [ 93.682685][ T5310] Rebooting in 86400 seconds..