------------[ cut here ]------------ WARNING: ./include/linux/skbuff.h:2865 at pskb_may_pull_reason include/linux/skbuff.h:2865 [inline], CPU#0: syz.5.383/6397 WARNING: ./include/linux/skbuff.h:2865 at pskb_may_pull include/linux/skbuff.h:2883 [inline], CPU#0: syz.5.383/6397 WARNING: ./include/linux/skbuff.h:2865 at qdisc_pkt_len_segs_init+0x3e0/0x8ac net/core/dev.c:4136, CPU#0: syz.5.383/6397 Modules linked in: CPU: 0 UID: 0 PID: 6397 Comm: syz.5.383 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : pskb_may_pull_reason include/linux/skbuff.h:2865 [inline] pc : pskb_may_pull include/linux/skbuff.h:2883 [inline] pc : qdisc_pkt_len_segs_init+0x3e0/0x8ac net/core/dev.c:4136 lr : pskb_may_pull_reason include/linux/skbuff.h:2865 [inline] lr : pskb_may_pull include/linux/skbuff.h:2883 [inline] lr : qdisc_pkt_len_segs_init+0x3e0/0x8ac net/core/dev.c:4136 sp : ffff80008e9874f0 x29: ffff80008e987540 x28: ffff0000c57f6880 x27: 00000000fffffffe x26: ffff0000c57f6898 x25: ffffffffffffffea x24: ffff0000f44ea280 x23: ffff0000f44ea350 x22: 0000000000000003 x21: 0000000000000001 x20: dfff800000000000 x19: ffff0000f44ea2a8 x18: 00000000ffffffff x17: 000000000070007e x16: 0068040000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: ffff80008a3f4d08 x10: 0000000000ff0100 x9 : 0000000000000101 x8 : 0000000000000000 x7 : ffff800084b265a8 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800084b9c400 x2 : 00000000fffffffe x1 : ffff0000c4aa8000 x0 : 0000000000000000 Call trace: pskb_may_pull_reason include/linux/skbuff.h:2865 [inline] (P) pskb_may_pull include/linux/skbuff.h:2883 [inline] (P) qdisc_pkt_len_segs_init+0x3e0/0x8ac net/core/dev.c:4136 (P) sch_handle_ingress net/core/dev.c:4477 [inline] __netif_receive_skb_core+0xed4/0x2b68 net/core/dev.c:6053 __netif_receive_skb_list_core+0x20c/0x664 net/core/dev.c:6277 __netif_receive_skb_list net/core/dev.c:6344 [inline] netif_receive_skb_list_internal+0x740/0x9fc net/core/dev.c:6435 gro_normal_list include/net/gro.h:523 [inline] gro_flush_normal include/net/gro.h:531 [inline] napi_complete_done+0x24c/0x620 net/core/dev.c:6803 gro_cell_poll+0x690/0x6c0 net/core/gro_cells.c:74 __napi_poll+0xb0/0x324 net/core/dev.c:7733 napi_poll net/core/dev.c:7796 [inline] net_rx_action+0x568/0xbcc net/core/dev.c:7953 handle_softirqs+0x2e4/0xd34 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 do_softirq+0x90/0xf8 kernel/softirq.c:523 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] tun_rx_batched+0x4b0/0x5fc drivers/net/tun.c:-1 tun_get_user+0x2314/0x3588 drivers/net/tun.c:1955 tun_chr_write_iter+0xfc/0x168 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x52c/0xa14 fs/read_write.c:688 ksys_write+0x12c/0x224 fs/read_write.c:740 __do_sys_write fs/read_write.c:751 [inline] __se_sys_write fs/read_write.c:748 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:748 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 127 hardirqs last enabled at (126): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] hardirqs last enabled at (126): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:198 hardirqs last disabled at (127): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (116): [] tun_rx_batched+0x174/0x5fc drivers/net/tun.c:1487 softirqs last disabled at (117): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]---