------------[ cut here ]------------ WARNING: ./include/linux/skbuff.h:2864 at pskb_may_pull_reason include/linux/skbuff.h:2864 [inline], CPU#0: syz.2.542/6850 WARNING: ./include/linux/skbuff.h:2864 at pskb_may_pull include/linux/skbuff.h:2882 [inline], CPU#0: syz.2.542/6850 WARNING: ./include/linux/skbuff.h:2864 at qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4141, CPU#0: syz.2.542/6850 Modules linked in: CPU: 0 UID: 0 PID: 6850 Comm: syz.2.542 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline] pc : pskb_may_pull include/linux/skbuff.h:2882 [inline] pc : qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4141 lr : pskb_may_pull_reason include/linux/skbuff.h:2864 [inline] lr : pskb_may_pull include/linux/skbuff.h:2882 [inline] lr : qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4141 sp : ffff80008eb57550 x29: ffff80008eb575a0 x28: dfff800000000000 x27: ffff0000d8ab91c0 x26: 0000000000000001 x25: ffffffffffffffea x24: ffff0000f39f18c0 x23: 00000000fffffffe x22: ffff0000d8ab90a8 x21: 0000000000000003 x20: 1fffe0001e73e326 x19: ffff0000f39f18e8 x18: 00000000ffffffff x17: 000000000070007e x16: 0068040000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: ffff0000cbbf9d40 x11: 00000000bde390b1 x10: 0000000000000003 x9 : 0000000000000101 x8 : 0000000000000000 x7 : ffff800084c10a54 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800084c8718c x2 : 00000000fffffffe x1 : ffff0000cbbf9d40 x0 : 0000000000000000 Call trace: pskb_may_pull_reason include/linux/skbuff.h:2864 [inline] (P) pskb_may_pull include/linux/skbuff.h:2882 [inline] (P) qdisc_pkt_len_segs_init+0x3e0/0x888 net/core/dev.c:4141 (P) sch_handle_ingress net/core/dev.c:4482 [inline] __netif_receive_skb_core+0x10ac/0x2b60 net/core/dev.c:6063 __netif_receive_skb_list_core+0x214/0x67c net/core/dev.c:6287 __netif_receive_skb_list net/core/dev.c:6354 [inline] netif_receive_skb_list_internal+0x748/0xa0c net/core/dev.c:6445 gro_normal_list include/net/gro.h:523 [inline] gro_flush_normal include/net/gro.h:531 [inline] napi_complete_done+0x24c/0x62c net/core/dev.c:6813 gro_cell_poll+0x688/0x6b8 net/core/gro_cells.c:74 __napi_poll+0xb4/0x328 net/core/dev.c:7735 napi_poll net/core/dev.c:7798 [inline] net_rx_action+0x5b0/0xc14 net/core/dev.c:7955 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622 __do_softirq+0x14/0x20 kernel/softirq.c:656 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 do_softirq+0x90/0xf8 kernel/softirq.c:523 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] tun_rx_batched+0x4d0/0x620 drivers/net/tun.c:-1 tun_get_user+0x2318/0x364c drivers/net/tun.c:1955 tun_chr_write_iter+0xfc/0x168 drivers/net/tun.c:2001 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 1025 hardirqs last enabled at (1024): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] hardirqs last enabled at (1024): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:198 hardirqs last disabled at (1025): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (1014): [] tun_rx_batched+0x180/0x620 drivers/net/tun.c:1487 softirqs last disabled at (1015): [] __do_softirq+0x14/0x20 kernel/softirq.c:656 ---[ end trace 0000000000000000 ]---