program: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000002c0)=""/209) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) (async) ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f00000002c0)=""/209) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x0) (async) [ 86.062119][ T5345] bridge_slave_0: left allmulticast mode [ 86.075835][ T5345] bridge_slave_0: left promiscuous mode [ 86.078542][ T5345] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.091605][ T5345] bridge_slave_1: left allmulticast mode [ 86.095097][ T5345] bridge_slave_1: left promiscuous mode [ 86.097557][ T5345] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.103361][ T5345] bond0: (slave bond_slave_0): Releasing backup interface [ 86.117634][ T5345] bond0: (slave bond_slave_1): Releasing backup interface [ 86.135196][ T5345] team0: Port device team_slave_0 removed [ 86.140581][ T5345] team0: Port device team_slave_1 removed [ 86.143456][ T5345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.148023][ T5345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.152208][ T5345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.156182][ T5345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.161807][ T5345] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 86.189870][ T5346] ip6gre0: entered promiscuous mode [ 86.201893][ T5346] team0: Port device ip6gre0 added [ 86.213267][ T5350] team0: Port device ip6gre0 removed [ 86.223372][ T5350] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 86.246749][ T5343] skbuff: skb_under_panic: text:ffffffff8a1c24d8 len:136 put:40 head:ffff8880405c2000 data:ffff8880405c1fe8 tail:0x70 end:0x6c0 dev:team0 [ 86.253544][ T5343] ------------[ cut here ]------------ [ 86.256442][ T5343] kernel BUG at net/core/skbuff.c:213! [ 86.279767][ T5343] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 86.282506][ T5343] CPU: 0 UID: 0 PID: 5343 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) [ 86.286438][ T5343] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.290857][ T5343] Workqueue: mld mld_ifc_work [ 86.293028][ T5343] RIP: 0010:skb_panic+0x157/0x160 [ 86.295176][ T5343] Code: c7 20 0b 6f 8c 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 6e 94 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 86.303470][ T5343] RSP: 0018:ffffc9000d4cf280 EFLAGS: 00010282 [ 86.306088][ T5343] RAX: 0000000000000087 RBX: dffffc0000000000 RCX: b05e9d82f513c900 [ 86.309367][ T5343] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 86.312427][ T5343] RBP: 00000000000006c0 R08: ffffc9000d4cef87 R09: 1ffff92001a99df0 [ 86.315631][ T5343] R10: dffffc0000000000 R11: fffff52001a99df1 R12: ffff888050d67150 [ 86.318562][ T5343] R13: ffff8880405c2000 R14: ffff8880405c1fe8 R15: 0000000000000070 [ 86.321928][ T5343] FS: 0000000000000000(0000) GS:ffff88808d68a000(0000) knlGS:0000000000000000 [ 86.325880][ T5343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.328779][ T5343] CR2: 000055bd10301168 CR3: 0000000050aea000 CR4: 0000000000352ef0 [ 86.332370][ T5343] Call Trace: [ 86.333902][ T5343] [ 86.335355][ T5343] ? ip6gre_header+0xc8/0x790 [ 86.337467][ T5343] ? ip6gre_header+0xc8/0x790 [ 86.339473][ T5343] skb_push+0xc3/0xe0 [ 86.341190][ T5343] ip6gre_header+0xc8/0x790 [ 86.343066][ T5343] ? __pfx_ip6gre_header+0x10/0x10 [ 86.345218][ T5343] ? read_seqbegin+0x1ac/0x250 [ 86.347367][ T5343] ? __pfx_read_seqbegin+0x10/0x10 [ 86.349624][ T5343] ? ___neigh_create+0x1c5f/0x2230 [ 86.351908][ T5343] ? __pfx_ip6gre_header+0x10/0x10 [ 86.354112][ T5343] neigh_connected_output+0x286/0x460 [ 86.356198][ T5343] ip6_finish_output2+0xfb3/0x1480 [ 86.358235][ T5343] ? __pfx_ip6_finish_output2+0x10/0x10 [ 86.360494][ T5343] ? ip6_mtu+0x7d/0x490 [ 86.362356][ T5343] ? ip6_mtu+0x7d/0x490 [ 86.364031][ T5343] ip6_finish_output+0x234/0x7d0 [ 86.371181][ T5343] ? ip6_output+0x126/0x550 [ 86.373218][ T5343] ip6_output+0x340/0x550 [ 86.375214][ T5343] NF_HOOK+0x9e/0x380 [ 86.376896][ T5343] ? NF_HOOK+0x101/0x380 [ 86.378761][ T5343] ? __pfx_NF_HOOK+0x10/0x10 [ 86.380773][ T5343] ? __pfx_dst_output+0x10/0x10 [ 86.382695][ T5343] ? icmp6_dst_alloc+0x3a5/0x420 [ 86.384804][ T5343] ? icmp6_dst_alloc+0x3a5/0x420 [ 86.386890][ T5343] mld_sendpack+0x8d4/0xe60 [ 86.388717][ T5343] ? mld_sendpack+0x1e7/0xe60 [ 86.390726][ T5343] ? __pfx_mld_sendpack+0x10/0x10 [ 86.392913][ T5343] mld_ifc_work+0x83e/0xd60 [ 86.394833][ T5343] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.396971][ T5343] ? process_scheduled_works+0x9ef/0x1770 [ 86.399258][ T5343] process_scheduled_works+0xad1/0x1770 [ 86.401613][ T5343] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.404049][ T5343] worker_thread+0x8a0/0xda0 [ 86.405960][ T5343] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 86.408239][ T5343] ? __kthread_parkme+0x7b/0x200 [ 86.410268][ T5343] kthread+0x711/0x8a0 [ 86.411856][ T5343] ? __pfx_worker_thread+0x10/0x10 [ 86.413868][ T5343] ? __pfx_kthread+0x10/0x10 [ 86.415723][ T5343] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.418281][ T5343] ? lockdep_hardirqs_on+0x98/0x140 [ 86.420786][ T5343] ? __pfx_kthread+0x10/0x10 [ 86.423225][ T5343] ret_from_fork+0x599/0xb30 [ 86.425437][ T5343] ? __pfx_ret_from_fork+0x10/0x10 [ 86.427526][ T5343] ? __pfx_kthread+0x10/0x10 [ 86.429522][ T5343] ret_from_fork_asm+0x1a/0x30 [ 86.431647][ T5343] [ 86.433039][ T5343] Modules linked in: [ 86.435358][ T5343] ---[ end trace 0000000000000000 ]---