syzkaller0: entered promiscuous mode syzkaller0: entered allmulticast mode Oops: stack segment: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5981 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:bpf_net_ctx_get_ri include/linux/filter.h:820 [inline] RIP: 0010:____bpf_redirect net/core/filter.c:2545 [inline] RIP: 0010:bpf_redirect+0x58/0x170 net/core/filter.c:2543 Code: 81 c7 30 18 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 b6 d8 b3 f8 4d 8b 3f 4d 8d 67 38 4c 89 e5 48 c1 ed 03 <42> 0f b6 44 2d 00 84 c0 0f 85 b9 00 00 00 41 8b 1c 24 89 de 83 e6 RSP: 0018:ffffc90003c4f078 EFLAGS: 00010202 RAX: 1ffff11005833a96 RBX: dffffc0000000000 RCX: ffff88802c19bc80 RDX: 0000000000000000 RSI: 00000080ffffffff RDI: ffff8880784488c0 RBP: 0000000000000007 R08: 1ffff1100f089132 R09: 1ffff1100f089126 R10: ffffc90003c4f320 R11: ffffffffa02019ec R12: 0000000000000038 R13: dffffc0000000000 R14: 00000080ffffffff R15: 0000000000000000 FS: 0000555591a4a500(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002280 CR3: 0000000078508000 CR4: 00000000003526f0 Call Trace: bpf_prog_6338e008a91e2d10+0x23/0x29 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline] __bpf_prog_run include/linux/filter.h:723 [inline] bpf_prog_run include/linux/filter.h:730 [inline] bpf_prog_run_data_pointers+0x19d/0x340 include/linux/filter.h:918 cls_bpf_classify+0x25b/0xad0 net/sched/cls_bpf.c:103 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x4cf/0x1130 net/sched/cls_api.c:1860 drr_classify net/sched/sch_drr.c:317 [inline] drr_enqueue+0x2d4/0x9d0 net/sched/sch_drr.c:346 dev_qdisc_enqueue+0x4e/0x240 net/core/dev.c:4144 __dev_xmit_skb net/core/dev.c:4259 [inline] __dev_queue_xmit+0x1ae1/0x3850 net/core/dev.c:4795 packet_snd net/packet/af_packet.c:3077 [inline] packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3bb8d9bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdba8487a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f3bb9015fa0 RCX: 00007f3bb8d9bf79 RDX: 0000000000000005 RSI: 0000200000000280 RDI: 0000000000000007 RBP: 00007f3bb8e327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3bb9015fac R14: 00007f3bb9015fa0 R15: 00007f3bb9015fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bpf_net_ctx_get_ri include/linux/filter.h:820 [inline] RIP: 0010:____bpf_redirect net/core/filter.c:2545 [inline] RIP: 0010:bpf_redirect+0x58/0x170 net/core/filter.c:2543 Code: 81 c7 30 18 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 b6 d8 b3 f8 4d 8b 3f 4d 8d 67 38 4c 89 e5 48 c1 ed 03 <42> 0f b6 44 2d 00 84 c0 0f 85 b9 00 00 00 41 8b 1c 24 89 de 83 e6 RSP: 0018:ffffc90003c4f078 EFLAGS: 00010202 RAX: 1ffff11005833a96 RBX: dffffc0000000000 RCX: ffff88802c19bc80 RDX: 0000000000000000 RSI: 00000080ffffffff RDI: ffff8880784488c0 RBP: 0000000000000007 R08: 1ffff1100f089132 R09: 1ffff1100f089126 R10: ffffc90003c4f320 R11: ffffffffa02019ec R12: 0000000000000038 R13: dffffc0000000000 R14: 00000080ffffffff R15: 0000000000000000 FS: 0000555591a4a500(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002280 CR3: 0000000078508000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 81 c7 30 18 00 00 add $0x1830,%edi 6: 4c 89 f8 mov %r15,%rax 9: 48 c1 e8 03 shr $0x3,%rax d: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 12: 74 08 je 0x1c 14: 4c 89 ff mov %r15,%rdi 17: e8 b6 d8 b3 f8 call 0xf8b3d8d2 1c: 4d 8b 3f mov (%r15),%r15 1f: 4d 8d 67 38 lea 0x38(%r15),%r12 23: 4c 89 e5 mov %r12,%rbp 26: 48 c1 ed 03 shr $0x3,%rbp * 2a: 42 0f b6 44 2d 00 movzbl 0x0(%rbp,%r13,1),%eax <-- trapping instruction 30: 84 c0 test %al,%al 32: 0f 85 b9 00 00 00 jne 0xf1 38: 41 8b 1c 24 mov (%r12),%ebx 3c: 89 de mov %ebx,%esi 3e: 83 .byte 0x83 3f: e6 .byte 0xe6