------------[ cut here ]------------
len > ((int)(~0U >> 1))
WARNING: ./include/linux/skbuff.h:2865 at pskb_may_pull_reason include/linux/skbuff.h:2865 [inline], CPU#1: syz.8.5026/18870
WARNING: ./include/linux/skbuff.h:2865 at pskb_may_pull include/linux/skbuff.h:2883 [inline], CPU#1: syz.8.5026/18870
WARNING: ./include/linux/skbuff.h:2865 at qdisc_pkt_len_segs_init+0x7af/0xb30 net/core/dev.c:4136, CPU#1: syz.8.5026/18870
Modules linked in:
CPU: 1 UID: 0 PID: 18870 Comm: syz.8.5026 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:pskb_may_pull_reason include/linux/skbuff.h:2865 [inline]
RIP: 0010:pskb_may_pull include/linux/skbuff.h:2883 [inline]
RIP: 0010:qdisc_pkt_len_segs_init+0x7af/0xb30 net/core/dev.c:4136
Code: 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 0f 84 38 fd ff ff 3c 03 0f 8f 30 fd ff ff e8 fc 47 19 f9 e9 26 fd ff ff e8 a2 5a ac f8 90 <0f> 0b 90 e9 2f fb ff ff 48 89 cf e8 e1 47 19 f9 e9 b6 f8 ff ff e8
RSP: 0018:ffffc90000590708 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88804c977900 RCX: ffffffff895b9c2d
RDX: ffff8880490f8000 RSI: ffffffff895ba0fe RDI: ffff8880490f8000
RBP: ffff88806eaa9840 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000fffffffe R11: 0000000000000000 R12: 00000000ffffffea
R13: ffff88804c977928 R14: 00000000fffffffe R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff88809728e000(0063) knlGS:00000000f53f5b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f53f4ff4 CR3: 000000005a26e000 CR4: 0000000000352ef0
Call Trace:
sch_handle_ingress net/core/dev.c:4477 [inline]
__netif_receive_skb_core.constprop.0+0x1144/0x3530 net/core/dev.c:6053
__netif_receive_skb_list_core+0x353/0x940 net/core/dev.c:6277
__netif_receive_skb_list net/core/dev.c:6344 [inline]
netif_receive_skb_list_internal+0x722/0xd40 net/core/dev.c:6435
gro_normal_list include/net/gro.h:523 [inline]
gro_normal_list include/net/gro.h:519 [inline]
gro_flush_normal include/net/gro.h:531 [inline]
napi_complete_done+0x221/0x940 net/core/dev.c:6803
gro_cell_poll+0x46e/0x690 net/core/gro_cells.c:74
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7733
napi_poll net/core/dev.c:7796 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7953
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
tun_rx_batched.isra.0+0x407/0x750 drivers/net/tun.c:1512
tun_get_user+0x1e31/0x3c20 drivers/net/tun.c:1955
tun_chr_write_iter+0xdc/0x200 drivers/net/tun.c:2001
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1070 fs/read_write.c:688
ksys_write+0x12a/0x250 fs/read_write.c:740
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0xe7/0x970 arch/x86/entry/syscall_32.c:307
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f52f7c
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 2e 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 58 b8
RSP: 002b:00000000f53f550c EFLAGS: 00000292 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800004c0
RDX: 000000000000007a RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: d2 74 05 c1 shlb %cl,-0x3f(%rbp,%rax,1)
4: e8 0c 89 02 8b call 0x8b028915
9: 5d pop %rbp
a: fc cld
b: 31 c0 xor %eax,%eax
d: c9 leave
e: c3 ret
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 0f 1f 00 nopl (%rax)
21: 51 push %rcx
22: 52 push %rdx
23: 55 push %rbp
24: 89 e5 mov %esp,%ebp
26: 0f 34 sysenter
28: cd 80 int $0x80
* 2a: 5d pop %rbp <-- trapping instruction
2b: 5a pop %rdx
2c: 59 pop %rcx
2d: c3 ret
2e: 90 nop
2f: 2e 8d b4 26 00 00 00 cs lea 0x0(%rsi,%riz,1),%esi
36: 00
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
3e: 58 pop %rax
3f: b8 .byte 0xb8