Extracting prog: 1m18.451148332s
Minimizing prog: 28m7.631382467s
Simplifying prog options: 6m40.030785513s
Extracting C: 1m39.875946492s
Simplifying C: 0s
extracting reproducer from 15 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
single: successfully extracted reproducer
found reproducer with 6 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
socket$nl_route(0x10, 0x3, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, 0x0, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, 0x0, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, 0x0, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
program did not crash
simplifying guilty program options
testing program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
program did not crash
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
program did not crash
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket-socket$nl_route-sendmsg$nl_route-connect$inet6-sendmsg$nl_xfrm
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket(0xa, 0x3, 0xff)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0200010000000014000500fe80000000000000000000000000000208000400", @ANYRES32=0x2, @ANYBLOB="0600150008000000200016801c00010000020101"], 0x60}}, 0x0)
connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newsa={0xf0, 0x1a, 0x7, 0x0, 0x25dfdbfc, {{@in6=@mcast2, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in6=@local, 0x0, 0x2b}, @in6=@private0, {0xfffffffffffffffe, 0x4000000000000000, 0x2, 0x1fffffffffffffd, 0x0, 0x0, 0x0, 0x8}, {0x6, 0x200000, 0x7}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x1, 0x0, 0x70}}, 0xf0}}, 0x0)
program crashed: BUG: MAX_LOCK_DEPTH too low!
validation run: crashed=true
reproducing took 42m17.773231742s
repro crashed as (corrupted=false):
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by syz.0.17/4385:
#0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#1: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#3: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#4: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#44: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#45: ffff8880b8f35df8 (lock){..-.}-{2:2}, at: local_lock_acquire+0x5/0x120 include/linux/local_lock_internal.h:28
#46: ffff88813fffbcd8 (&zone->lock){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#46: ffff88813fffbcd8 (&zone->lock){..-.}-{2:2}, at: free_pcppages_bulk+0x498/0x780 mm/page_alloc.c:1519
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: read_seqbegin include/linux/seqlock.h:897 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: zone_span_seqbegin include/linux/memory_hotplug.h:83 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: page_outside_zone_boundaries mm/page_alloc.c:580 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: bad_range+0x76/0x2c0 mm/page_alloc.c:607
INFO: lockdep is turned off.
CPU: 1 PID: 4385 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x170f/0x7d40 kernel/locking/lockdep.c:-1
lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
seqcount_lockdep_reader_access+0xb8/0x190 include/linux/seqlock.h:103
read_seqbegin include/linux/seqlock.h:897 [inline]
zone_span_seqbegin include/linux/memory_hotplug.h:83 [inline]
page_outside_zone_boundaries mm/page_alloc.c:580 [inline]
bad_range+0x76/0x2c0 mm/page_alloc.c:607
__free_one_page+0x137/0xc10 mm/page_alloc.c:1080
free_pcppages_bulk+0x57d/0x780 mm/page_alloc.c:1539
free_unref_page+0x151/0x2a0 mm/page_alloc.c:3416
free_nonslab_page+0xde/0x150 mm/slub.c:3540
skb_free_head net/core/skbuff.c:655 [inline]
pskb_expand_head+0x363/0x1100 net/core/skbuff.c:1747
__skb_cow include/linux/skbuff.h:3414 [inline]
skb_cow_head include/linux/skbuff.h:3448 [inline]
rpl_do_srh_inline net/ipv6/rpl_iptunnel.c:157 [inline]
rpl_do_srh+0x50a/0xe50 net/ipv6/rpl_iptunnel.c:201
rpl_output+0x178/0x730 net/ipv6/rpl_iptunnel.c:217
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
rawv6_send_hdrinc+0xd34/0x1650 net/ipv6/raw.c:659
rawv6_sendmsg+0x11a6/0x1710 net/ipv6/raw.c:917
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd16317df19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd86c52258 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fd1633fafa0 RCX: 00007fd16317df19
RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007fd16320cf6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd1633fafac R14: 00007fd1633fafa0 R15: 00007fd1633fafa0
syz.0.17 (4385) used greatest stack depth: 6224 bytes left
final repro crashed as (corrupted=false):
BUG: MAX_LOCK_DEPTH too low!
turning off the locking correctness validator.
depth: 48 max: 48!
48 locks held by syz.0.17/4385:
#0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#1: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#3: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#4: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#5: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#6: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#7: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#8: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#9: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#10: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#11: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#12: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#13: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#14: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#15: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#16: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#17: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#18: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#19: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#20: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#21: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#22: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#23: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#24: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#25: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#26: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#27: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#28: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#29: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#30: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#31: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#32: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#33: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#34: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#35: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#36: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#37: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#38: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#39: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#40: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#41: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#42: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#43: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#44: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
#45: ffff8880b8f35df8 (lock){..-.}-{2:2}, at: local_lock_acquire+0x5/0x120 include/linux/local_lock_internal.h:28
#46: ffff88813fffbcd8 (&zone->lock){..-.}-{2:2}, at: spin_lock include/linux/spinlock.h:364 [inline]
#46: ffff88813fffbcd8 (&zone->lock){..-.}-{2:2}, at: free_pcppages_bulk+0x498/0x780 mm/page_alloc.c:1519
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: read_seqbegin include/linux/seqlock.h:897 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: zone_span_seqbegin include/linux/memory_hotplug.h:83 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: page_outside_zone_boundaries mm/page_alloc.c:580 [inline]
#47: ffff88813fffb7c0 (&____s->seqcount){...-}-{0:0}, at: bad_range+0x76/0x2c0 mm/page_alloc.c:607
INFO: lockdep is turned off.
CPU: 1 PID: 4385 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
__lock_acquire+0x170f/0x7d40 kernel/locking/lockdep.c:-1
lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
seqcount_lockdep_reader_access+0xb8/0x190 include/linux/seqlock.h:103
read_seqbegin include/linux/seqlock.h:897 [inline]
zone_span_seqbegin include/linux/memory_hotplug.h:83 [inline]
page_outside_zone_boundaries mm/page_alloc.c:580 [inline]
bad_range+0x76/0x2c0 mm/page_alloc.c:607
__free_one_page+0x137/0xc10 mm/page_alloc.c:1080
free_pcppages_bulk+0x57d/0x780 mm/page_alloc.c:1539
free_unref_page+0x151/0x2a0 mm/page_alloc.c:3416
free_nonslab_page+0xde/0x150 mm/slub.c:3540
skb_free_head net/core/skbuff.c:655 [inline]
pskb_expand_head+0x363/0x1100 net/core/skbuff.c:1747
__skb_cow include/linux/skbuff.h:3414 [inline]
skb_cow_head include/linux/skbuff.h:3448 [inline]
rpl_do_srh_inline net/ipv6/rpl_iptunnel.c:157 [inline]
rpl_do_srh+0x50a/0xe50 net/ipv6/rpl_iptunnel.c:201
rpl_output+0x178/0x730 net/ipv6/rpl_iptunnel.c:217
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
rpl_output+0x321/0x730 net/ipv6/rpl_iptunnel.c:250
lwtunnel_output+0x27e/0x440 net/core/lwtunnel.c:342
dst_output include/net/dst.h:452 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
rawv6_send_hdrinc+0xd34/0x1650 net/ipv6/raw.c:659
rawv6_sendmsg+0x11a6/0x1710 net/ipv6/raw.c:917
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
__sys_sendmsg net/socket.c:2529 [inline]
__do_sys_sendmsg net/socket.c:2538 [inline]
__se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd16317df19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd86c52258 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fd1633fafa0 RCX: 00007fd16317df19
RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007fd16320cf6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd1633fafac R14: 00007fd1633fafa0 R15: 00007fd1633fafa0
syz.0.17 (4385) used greatest stack depth: 6224 bytes left