------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:212!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 14331 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:skb_panic+0x157/0x1d0 net/core/skbuff.c:212
Code: b6 04 01 84 c0 74 04 3c 03 7e 21 41 56 8b 4b 70 45 89 e8 48 c7 c7 e0 7a be 8c 41 57 56 48 89 ee 52 4c 89 e2 e8 1a 06 71 f8 90 <0f> 0b 4c 89 4c 24 10 48 89 54 24 08 48 89 34 24 e8 e4 3e fb f8 4c
RSP: 0018:ffffc90000648720 EFLAGS: 00010286
RAX: 0000000000000094 RBX: ffff888035e79cc0 RCX: ffffffff819b73a9
RDX: 0000000000000000 RSI: ffffffff819beed6 RDI: 0000000000000005
RBP: ffffffff8cbe8ea0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000001 R12: ffffffff89e8c6b8
R13: 0000000038dae12c R14: ffff888031e88120 R15: 0000000000000180
FS: 000055555b1dc500(0000) GS:ffff8880d6c08000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd68cf156c0 CR3: 000000004f7f7000 CR4: 0000000000352ef0
Call Trace:
skb_under_panic net/core/skbuff.c:222 [inline]
skb_push+0xca/0xf0 net/core/skbuff.c:2602
ipgre_header+0x68/0x530 net/ipv4/ip_gre.c:895
dev_hard_header include/linux/netdevice.h:3419 [inline]
neigh_connected_output+0x366/0x620 net/core/neighbour.c:1619
neigh_output include/net/neighbour.h:547 [inline]
ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136
__ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209
ip6_finish_output net/ipv6/ip6_output.c:220 [inline]
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247
dst_output include/net/dst.h:464 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
ndisc_send_skb+0xa85/0x1f50 net/ipv6/ndisc.c:512
ndisc_send_rs+0x129/0x670 net/ipv6/ndisc.c:722
addrconf_rs_timer+0x40d/0x840 net/ipv6/addrconf.c:4037
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872
Code: 94 08 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 12 19 e9 0e 0f 82 74 02 00 00 8b 35 8a 49 e9 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 29 94 08 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc90005947850 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e5656a0 RCX: ffffffff93afd7a0
RDX: 0000000000000000 RSI: ffffffff8da0571e RDI: ffffffff8bf07040
RBP: 0000000000000000 R08: 516a493a02b51f58 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
__fs_reclaim_acquire mm/page_alloc.c:4269 [inline]
fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:4283
might_alloc include/linux/sched/mm.h:318 [inline]
slab_pre_alloc_hook mm/slub.c:4921 [inline]
slab_alloc_node mm/slub.c:5256 [inline]
kmem_cache_alloc_noprof+0x5b/0x6e0 mm/slub.c:5287
vm_area_dup+0x27/0x8d0 mm/vma_init.c:123
dup_mmap+0x86f/0x2280 mm/mmap.c:1780
dup_mm kernel/fork.c:1489 [inline]
copy_mm kernel/fork.c:1541 [inline]
copy_process+0x3f0c/0x76a0 kernel/fork.c:2181
kernel_clone+0xfc/0x930 kernel/fork.c:2609
__do_sys_clone+0xce/0x120 kernel/fork.c:2750
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd68c185e13
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffc61508498 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd68c185e13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 000055555b1dc7d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 000000000005891a R15: 00007ffc61508630
Modules linked in:
vkms_vblank_simulate: vblank timer overrun
---[ end trace 0000000000000000 ]---
RIP: 0010:skb_panic+0x157/0x1d0 net/core/skbuff.c:212
Code: b6 04 01 84 c0 74 04 3c 03 7e 21 41 56 8b 4b 70 45 89 e8 48 c7 c7 e0 7a be 8c 41 57 56 48 89 ee 52 4c 89 e2 e8 1a 06 71 f8 90 <0f> 0b 4c 89 4c 24 10 48 89 54 24 08 48 89 34 24 e8 e4 3e fb f8 4c
RSP: 0018:ffffc90000648720 EFLAGS: 00010286
RAX: 0000000000000094 RBX: ffff888035e79cc0 RCX: ffffffff819b73a9
RDX: 0000000000000000 RSI: ffffffff819beed6 RDI: 0000000000000005
RBP: ffffffff8cbe8ea0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000001 R12: ffffffff89e8c6b8
R13: 0000000038dae12c R14: ffff888031e88120 R15: 0000000000000180
FS: 000055555b1dc500(0000) GS:ffff8880d6c08000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd68cf156c0 CR3: 000000004f7f7000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 94 xchg %eax,%esp
1: 08 12 or %dl,(%rdx)
3: 83 f8 07 cmp $0x7,%eax
6: 0f 87 bc 02 00 00 ja 0x2c8
c: 89 c0 mov %eax,%eax
e: 48 0f a3 05 12 19 e9 bt %rax,0xee91912(%rip) # 0xee91928
15: 0e
16: 0f 82 74 02 00 00 jb 0x290
1c: 8b 35 8a 49 e9 0e mov 0xee9498a(%rip),%esi # 0xee949ac
22: 85 f6 test %esi,%esi
24: 0f 85 8d 00 00 00 jne 0xb7
* 2a: 48 8b 44 24 30 mov 0x30(%rsp),%rax <-- trapping instruction
2f: 65 48 2b 05 29 94 08 sub %gs:0x12089429(%rip),%rax # 0x12089460
36: 12
37: 0f 85 c7 02 00 00 jne 0x304
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c4 .byte 0xc4