------------[ cut here ]------------
WARNING: ./include/linux/skbuff.h:2864 at pskb_may_pull_reason include/linux/skbuff.h:2864 [inline], CPU#0: syz.4.1290/11353
WARNING: ./include/linux/skbuff.h:2864 at pskb_may_pull include/linux/skbuff.h:2882 [inline], CPU#0: syz.4.1290/11353
WARNING: ./include/linux/skbuff.h:2864 at qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4138, CPU#0: syz.4.1290/11353
Modules linked in:
CPU: 0 UID: 0 PID: 11353 Comm: syz.4.1290 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026
pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline]
pc : pskb_may_pull include/linux/skbuff.h:2882 [inline]
pc : qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4138
lr : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline]
lr : pskb_may_pull include/linux/skbuff.h:2882 [inline]
lr : qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4138
sp : ffff80008eae7550
x29: ffff80008eae75a0 x28: dfff800000000000 x27: ffff0000ccf0d500
x26: 0000000000000001 x25: ffffffffffffffea x24: ffff0000cc0ec000
x23: 00000000fffffffe x22: ffff0000ccf0d3e8 x21: 0000000000000003
x20: 1fffe0001981d80e x19: ffff0000cc0ec028 x18: 0000000000000000
x17: ffff800125401000 x16: ffff80008eae0000 x15: 00000000200004ce
x14: 000000008030e5ac x13: 000000000000000e x12: 0000000000000000
x11: 0000000000000000 x10: ffff700011d5cefc x9 : 0000000000000101
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0008000c03000000
x5 : ffff0000ccf0d3fc x4 : 0000000000000000 x3 : ffff800084c6a8e8
x2 : 00000000fffffffe x1 : ffff0000d6868000 x0 : 0000000000000000
Call trace:
 pskb_may_pull_reason include/linux/skbuff.h:2864 [inline] (P)
 pskb_may_pull include/linux/skbuff.h:2882 [inline] (P)
 qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4138 (P)
 sch_handle_ingress net/core/dev.c:4479 [inline]
 __netif_receive_skb_core+0x10ac/0x2b60 net/core/dev.c:6057
 __netif_receive_skb_list_core+0x214/0x67c net/core/dev.c:6281
 __netif_receive_skb_list net/core/dev.c:6348 [inline]
 netif_receive_skb_list_internal+0x748/0xa0c net/core/dev.c:6439
 gro_normal_list include/net/gro.h:523 [inline]
 gro_flush_normal include/net/gro.h:531 [inline]
 napi_complete_done+0x24c/0x62c net/core/dev.c:6807
 gro_cell_poll+0x688/0x6b8 net/core/gro_cells.c:74
 __napi_poll+0xb4/0x328 net/core/dev.c:7729
 napi_poll net/core/dev.c:7792 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:7949
 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:523
 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 tun_rx_batched+0x4d0/0x620 drivers/net/tun.c:-1
 tun_get_user+0x2318/0x364c drivers/net/tun.c:1986
 tun_chr_write_iter+0xfc/0x168 drivers/net/tun.c:2032
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x51c/0xa0c fs/read_write.c:687
 ksys_write+0x12c/0x228 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:747
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 2011
hardirqs last  enabled at (2010): [<ffff800080b9c828>] kasan_quarantine_put+0xb4/0x1c4 mm/kasan/quarantine.c:234
hardirqs last disabled at (2011): [<ffff8000868bf4e0>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425
softirqs last  enabled at (1998): [<ffff800082c98708>] tun_rx_batched+0x180/0x620 drivers/net/tun.c:1518
softirqs last disabled at (1999): [<ffff8000800204b0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---