program: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r2 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0xa, 0x9, 0x8, 0x2}, 0x50) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="1802000000000000000000000000000018130000", @ANYRES32=r2, @ANYBLOB="0000000000000000850000002e00000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000001200)=ANY=[@ANYRES32=r1, @ANYRES32=r3, @ANYBLOB="0500"/12, @ANYRES32, @ANYBLOB="2be3849976ae2c9b153522dc1586b710fbfbcc00448c33ac46bc14dda2744ad3e9a224a98ec62db2900aca7055c7af9a363af701097d4951e626640962f6c306000000992268541b984f865f", @ANYRES64=0x0], 0x10) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r4, 0x80045105, &(0x7f00000000c0)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) r5 = dup2(r0, r2) sendmsg$TIPC_CMD_DISABLE_BEARER(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x8085}, 0x40000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000007, 0x38011, r6, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) r7 = socket(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d40)=@newqdisc={0x3a8, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x378, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x64, 0x2, 0x3, 0x17, 0xd, 0x28, 0x1}}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "a2a88faa7ec665a571a9ad3d1f9512e3c591df4a4554c6c2e2cc6cb4d9aee4579684743ad4888f1522a47ddaff3d4f9450d288e8559bc4f795aa0d1bc74d926038adb808cba6e90535b2eb8ba3e8ff927207d17a86b10d604e77a459df67e7f0c842d463ca5977b7e2eb55fbb9881d15633717817c735da52a1da7d64bb22e58550d8ee20883e41ec2f119a6a6364d68900c1cce4a3b3225a9ce9e1e00b444e9e7bcd10e1dec202ce7786aa7cf10d4dd6bbcee586d7903a6239ff90b49cd7fddb0c67ddab326cdb2d0fa48a783f691be9ebaa1243b21afd04a372650aa7eb46a2675cc67ae12d3b99c9acb4d9fb7c78081d269b443affd86eededd4867311221"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x1}}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}]}, 0x3a8}}, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18}]}}]}, 0x48}}, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) r11 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') preadv(r11, &(0x7f0000000000)=[{&(0x7f0000000200)=""/4096, 0x1000}], 0x1, 0x0, 0x0) r12 = dup2(r2, r1) write$binfmt_elf32(r12, &(0x7f0000001280)={{0x7f, 0x45, 0x4c, 0x46, 0x97, 0x7, 0x42, 0xc, 0x3e0, 0x2, 0x3e, 0x0, 0x273, 0x38, 0x366, 0xff, 0x2, 0x20, 0x2, 0x401, 0x9, 0xfffe}, [{0x1, 0x5, 0x7ff, 0x5, 0xbac6, 0x5, 0x4, 0xb6d}, {0x5, 0x0, 0x9, 0x8, 0x8, 0x6, 0x6}], "cbcdf478a2fb8e67251bd340554406995b6d06a292570e9c8b90f7ad35c075a13147cd3d183f558956c59a74ae603222bcb16b51305898afda1322ec7d6f25e4603e3924d4c345cf89b52395e43dc0271444196ed410a4e180b4e06959707875ce6bba788a1861", ['\x00']}, 0x1df) read$FUSE(r5, &(0x7f0000001900)={0x2020}, 0x2020) [ 122.819767][ T5324] ------------[ cut here ]------------ [ 122.822359][ T5324] TCP recvmsg seq # bug: copied DADAD6, seq DADB02, rcvnxt DADCE1, fl 0 [ 122.826225][ T5324] WARNING: net/ipv4/tcp.c:2732 at tcp_recvmsg_locked+0x1d36/0x3800, CPU#0: syz.0.0/5324 [ 122.830542][ T5324] Modules linked in: [ 122.832283][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 122.836136][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 122.840479][ T5324] RIP: 0010:tcp_recvmsg_locked+0x1d8d/0x3800 [ 122.843295][ T5324] Code: 4c 8b 6c 24 70 0f 85 d1 0c 00 00 41 8b 16 4c 89 c0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 ee 0c 00 00 41 8b 08 44 8b 44 24 48 <67> 48 0f b9 3a e9 e1 ec ff ff e8 b4 af 8b f7 bb ed ff ff ff eb 34 [ 122.851988][ T5324] RSP: 0018:ffffc9000ed67640 EFLAGS: 00010246 [ 122.854574][ T5324] RAX: 0000000000000000 RBX: 1ffff11007d49023 RCX: 0000000000dadce1 [ 122.858048][ T5324] RDX: 0000000000dadb02 RSI: 0000000000dadad6 RDI: ffffffff9067f2a0 [ 122.861454][ T5324] RBP: ffffc9000ed67a10 R08: 0000000000000000 R09: ffffc9000ed67a7c [ 122.864759][ T5324] R10: dffffc0000000000 R11: fffffbfff20af687 R12: dffffc0000000000 [ 122.868544][ T5324] R13: ffff888012d600e8 R14: ffff88803ea48118 R15: ffff88803ea480f0 [ 122.871828][ T5324] FS: 00007f3a17e3b6c0(0000) GS:ffff88808c53e000(0000) knlGS:0000000000000000 [ 122.875741][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.878537][ T5324] CR2: 000020000000135f CR3: 0000000012599000 CR4: 0000000000352ef0 [ 122.881868][ T5324] Call Trace: [ 122.883296][ T5324] [ 122.884554][ T5324] ? rcu_is_watching+0x15/0xb0 [ 122.887364][ T5324] ? hrtimer_start_range_ns_common+0x83b/0xb90 [ 122.890019][ T5324] ? finish_task_switch+0x412/0xc60 [ 122.892292][ T5324] ? lockdep_hardirqs_on+0x7a/0x110 [ 122.894509][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 122.896728][ T5324] ? __pfx_tcp_recvmsg_locked+0x10/0x10 [ 122.899011][ T5324] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 122.901378][ T5324] ? do_raw_spin_lock+0x12b/0x2f0 [ 122.903535][ T5324] ? lock_sock_nested+0x6a/0x100 [ 122.905817][ T5324] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 122.908017][ T5324] ? tcp_recvmsg+0x1df/0x7f0 [ 122.909978][ T5324] ? __local_bh_enable_ip+0xd0/0x130 [ 122.912113][ T5324] tcp_recvmsg+0x203/0x7f0 [ 122.913983][ T5324] ? __pfx_aa_sk_perm+0x10/0x10 [ 122.916153][ T5324] ? __pfx_tcp_recvmsg+0x10/0x10 [ 122.918182][ T5324] ? sock_rps_record_flow+0x19/0x350 [ 122.920466][ T5324] ? inet_recvmsg+0xb3/0x120 [ 122.922424][ T5324] ? __pfx_inet_recvmsg+0x10/0x10 [ 122.924539][ T5324] sock_recvmsg+0x166/0x1e0 [ 122.926611][ T5324] sock_read_iter+0x22a/0x2f0 [ 122.928604][ T5324] ? __pfx_sock_read_iter+0x10/0x10 [ 122.930794][ T5324] ? bpf_lsm_file_permission+0x9/0x20 [ 122.933014][ T5324] ? security_file_permission+0x75/0x260 [ 122.935350][ T5324] vfs_read+0x595/0xa80 [ 122.937298][ T5324] ? __pfx_vfs_read+0x10/0x10 [ 122.939296][ T5324] ? __fget_files+0x2a/0x420 [ 122.941344][ T5324] ksys_read+0x150/0x270 [ 122.943103][ T5324] ? __pfx_ksys_read+0x10/0x10 [ 122.945402][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.948772][ T5324] do_syscall_64+0x174/0x580 [ 122.950705][ T5324] ? trace_irq_disable+0x3b/0x140 [ 122.952900][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 122.955057][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.957673][ T5324] RIP: 0033:0x7f3a16f9e0d9 [ 122.959569][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.967619][ T5324] RSP: 002b:00007f3a17e3afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 122.971124][ T5324] RAX: ffffffffffffffda RBX: 00007f3a17225fa0 RCX: 00007f3a16f9e0d9 [ 122.974402][ T5324] RDX: 0000000000002020 RSI: 0000200000001900 RDI: 0000000000000005 [ 122.977779][ T5324] RBP: 00007f3a17035024 R08: 0000000000000000 R09: 0000000000000000 [ 122.981218][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 122.984599][ T5324] R13: 00007f3a17226038 R14: 00007f3a17225fa0 R15: 00007ffed61a6718 [ 122.988025][ T5324] [ 122.989375][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 122.992513][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 122.996308][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 123.000543][ T5324] Call Trace: [ 123.001939][ T5324] [ 123.003238][ T5324] vpanic+0x56c/0xa60 [ 123.005006][ T5324] ? __pfx__printk+0x10/0x10 [ 123.006921][ T5324] ? __pfx_vpanic+0x10/0x10 [ 123.008770][ T5324] ? is_bpf_text_address+0x292/0x2b0 [ 123.010964][ T5324] ? is_bpf_text_address+0x26/0x2b0 [ 123.013158][ T5324] panic+0xc5/0xd0 [ 123.014746][ T5324] ? __pfx_panic+0x10/0x10 [ 123.016610][ T5324] __warn+0x315/0x4c0 [ 123.018332][ T5324] ? tcp_recvmsg_locked+0x1d36/0x3800 [ 123.020599][ T5324] ? tcp_recvmsg_locked+0x1d36/0x3800 [ 123.022841][ T5324] __report_bug+0x276/0x570 [ 123.024791][ T5324] ? tcp_recvmsg_locked+0x1d36/0x3800 [ 123.027089][ T5324] ? __pfx___report_bug+0x10/0x10 [ 123.029267][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 123.031364][ T5324] report_bug_entry+0x19a/0x290 [ 123.033468][ T5324] ? tcp_recvmsg_locked+0x1d8d/0x3800 [ 123.035733][ T5324] ? tcp_recvmsg_locked+0x1d92/0x3800 [ 123.038002][ T5324] handle_bug+0xce/0x200 [ 123.039856][ T5324] exc_invalid_op+0x1a/0x50 [ 123.041826][ T5324] asm_exc_invalid_op+0x1a/0x20 [ 123.043940][ T5324] RIP: 0010:tcp_recvmsg_locked+0x1d8d/0x3800 [ 123.046515][ T5324] Code: 4c 8b 6c 24 70 0f 85 d1 0c 00 00 41 8b 16 4c 89 c0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 ee 0c 00 00 41 8b 08 44 8b 44 24 48 <67> 48 0f b9 3a e9 e1 ec ff ff e8 b4 af 8b f7 bb ed ff ff ff eb 34 [ 123.054396][ T5324] RSP: 0018:ffffc9000ed67640 EFLAGS: 00010246 [ 123.056924][ T5324] RAX: 0000000000000000 RBX: 1ffff11007d49023 RCX: 0000000000dadce1 [ 123.060313][ T5324] RDX: 0000000000dadb02 RSI: 0000000000dadad6 RDI: ffffffff9067f2a0 [ 123.063578][ T5324] RBP: ffffc9000ed67a10 R08: 0000000000000000 R09: ffffc9000ed67a7c [ 123.066858][ T5324] R10: dffffc0000000000 R11: fffffbfff20af687 R12: dffffc0000000000 [ 123.070202][ T5324] R13: ffff888012d600e8 R14: ffff88803ea48118 R15: ffff88803ea480f0 [ 123.073503][ T5324] ? rcu_is_watching+0x15/0xb0 [ 123.075556][ T5324] ? hrtimer_start_range_ns_common+0x83b/0xb90 [ 123.078238][ T5324] ? finish_task_switch+0x412/0xc60 [ 123.080504][ T5324] ? lockdep_hardirqs_on+0x7a/0x110 [ 123.082675][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 123.084813][ T5324] ? __pfx_tcp_recvmsg_locked+0x10/0x10 [ 123.087181][ T5324] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 123.089514][ T5324] ? do_raw_spin_lock+0x12b/0x2f0 [ 123.091657][ T5324] ? lock_sock_nested+0x6a/0x100 [ 123.093780][ T5324] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 123.096069][ T5324] ? tcp_recvmsg+0x1df/0x7f0 [ 123.098122][ T5324] ? __local_bh_enable_ip+0xd0/0x130 [ 123.100475][ T5324] tcp_recvmsg+0x203/0x7f0 [ 123.102469][ T5324] ? __pfx_aa_sk_perm+0x10/0x10 [ 123.104639][ T5324] ? __pfx_tcp_recvmsg+0x10/0x10 [ 123.106808][ T5324] ? sock_rps_record_flow+0x19/0x350 [ 123.109158][ T5324] ? inet_recvmsg+0xb3/0x120 [ 123.111128][ T5324] ? __pfx_inet_recvmsg+0x10/0x10 [ 123.113294][ T5324] sock_recvmsg+0x166/0x1e0 [ 123.115329][ T5324] sock_read_iter+0x22a/0x2f0 [ 123.117402][ T5324] ? __pfx_sock_read_iter+0x10/0x10 [ 123.119717][ T5324] ? bpf_lsm_file_permission+0x9/0x20 [ 123.122077][ T5324] ? security_file_permission+0x75/0x260 [ 123.124550][ T5324] vfs_read+0x595/0xa80 [ 123.126331][ T5324] ? __pfx_vfs_read+0x10/0x10 [ 123.128373][ T5324] ? __fget_files+0x2a/0x420 [ 123.130357][ T5324] ksys_read+0x150/0x270 [ 123.132264][ T5324] ? __pfx_ksys_read+0x10/0x10 [ 123.134361][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.136996][ T5324] do_syscall_64+0x174/0x580 [ 123.138990][ T5324] ? trace_irq_disable+0x3b/0x140 [ 123.141140][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 123.143154][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 123.145609][ T5324] RIP: 0033:0x7f3a16f9e0d9 [ 123.147444][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.154989][ T5324] RSP: 002b:00007f3a17e3afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 123.158318][ T5324] RAX: ffffffffffffffda RBX: 00007f3a17225fa0 RCX: 00007f3a16f9e0d9 [ 123.161698][ T5324] RDX: 0000000000002020 RSI: 0000200000001900 RDI: 0000000000000005 [ 123.164904][ T5324] RBP: 00007f3a17035024 R08: 0000000000000000 R09: 0000000000000000 [ 123.168055][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 123.171191][ T5324] R13: 00007f3a17226038 R14: 00007f3a17225fa0 R15: 00007ffed61a6718 [ 123.174422][ T5324] [ 123.176092][ T5324] Kernel Offset: disabled [ 123.177976][ T5324] Rebooting in 86400 seconds..