[syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    eaf2aaec0be4 Merge tag 'wireless-drivers-next-2021-08-29' ..
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1219326d300000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d2f9d4c9ff8c5ae7
dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e6e3a9300000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10de8a6d300000

The issue was bisected to:

commit 2d151d39073aff498358543801fca0f670fea981
Author: Steffen Klassert <steffen.klassert@secunet.com>
Date:   Sun Jul 18 07:11:06 2021 +0000

    xfrm: Add possibility to set the default to block if we have no policy

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=114523fe300000
final oops:     https://syzkaller.appspot.com/x/report.txt?x=134523fe300000
console output: https://syzkaller.appspot.com/x/log.txt?x=154523fe300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com
Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")

netlink: 172 bytes leftover after parsing attributes in process `syz-executor354'.
================================================================================
UBSAN: shift-out-of-bounds in net/xfrm/xfrm_user.c:2010:49
shift exponent 224 is too large for 32-bit type 'int'
CPU: 1 PID: 8447 Comm: syz-executor354 Not tainted 5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 xfrm_get_default.cold+0x1f/0x75 net/xfrm/xfrm_user.c:2010
 xfrm_user_rcv_msg+0x430/0xa20 net/xfrm/xfrm_user.c:2869
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2891
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 sock_no_sendpage+0xf3/0x130 net/core/sock.c:2980
 kernel_sendpage.part.0+0x1a0/0x340 net/socket.c:3496
 kernel_sendpage net/socket.c:3493 [inline]
 sock_sendpage+0xe5/0x140 net/socket.c:1003
 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364
 splice_from_pipe_feed fs/splice.c:418 [inline]
 __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562
 splice_from_pipe fs/splice.c:597 [inline]
 generic_splice_sendpage+0xd4/0x140 fs/splice.c:746
 do_splice_from fs/splice.c:767 [inline]
 direct_splice_actor+0x110/0x180 fs/splice.c:936
 splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891
 do_splice_direct+0x1b3/0x280 fs/splice.c:979
 do_sendfile+0x9f0/0x1120 fs/read_write.c:1260
 __do_sys_sendfile64 fs/read_write.c:1325 [inline]
 __se_sys_sendfile64 fs/read_write.c:1311 [inline]
 __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1311
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x43f019
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd24165888 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f019
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005
RBP: 0000000000403000 R08: 0000000000400488 R09: 0000000000400488
R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000403090
R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
================================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[Pavel Skripkin]

[-- Attachment #1: Type: text/plain, Size: 1818 bytes --]

On 8/30/21 23:19, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    eaf2aaec0be4 Merge tag 'wireless-drivers-next-2021-08-29' ..
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=1219326d300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d2f9d4c9ff8c5ae7
> dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e6e3a9300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10de8a6d300000
> 
> The issue was bisected to:
> 
> commit 2d151d39073aff498358543801fca0f670fea981
> Author: Steffen Klassert <steffen.klassert@secunet.com>
> Date:   Sun Jul 18 07:11:06 2021 +0000
> 
>      xfrm: Add possibility to set the default to block if we have no policy
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=114523fe300000
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=134523fe300000
> console output: https://syzkaller.appspot.com/x/log.txt?x=154523fe300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com
> Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
> 
> netlink: 172 bytes leftover after parsing attributes in process `syz-executor354'.
> ================================================================================
> UBSAN: shift-out-of-bounds in net/xfrm/xfrm_user.c:2010:49
> shift exponent 224 is too large for 32-bit type 'int'


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git




With regards,
Pavel Skripkin

[-- Attachment #2: 0001-net-xfrm-fix-shift-out-of-bounds-in-xfrm_get_default.patch --]
[-- Type: text/x-patch, Size: 857 bytes --]

From 0395839028b13f4e380e167c6381e4eea4a9fc42 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 1 Sep 2021 21:55:25 +0300
Subject: [PATCH] net: xfrm: fix shift-out-of-bounds in xfrm_get_default

/* ... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/xfrm/xfrm_user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b7b986520dc7..a1dd38525957 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2007,6 +2007,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	r_up = nlmsg_data(r_nlh);
 
+	if (up->dirmask >= XFRM_USERPOLICY_DIRMASK_MAX)
+		return -EINVAL;
+
 	r_up->action = ((net->xfrm.policy_default & (1 << up->dirmask)) >> up->dirmask);
 	r_up->dirmask = up->dirmask;
 	nlmsg_end(r_skb, r_nlh);
-- 
2.33.0

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot]

> On 8/30/21 23:19, syzbot wrote:
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    eaf2aaec0be4 Merge tag 'wireless-drivers-next-2021-08-29' ..
>> git tree:       net-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1219326d300000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=d2f9d4c9ff8c5ae7
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e6e3a9300000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10de8a6d300000
>> 
>> The issue was bisected to:
>> 
>> commit 2d151d39073aff498358543801fca0f670fea981
>> Author: Steffen Klassert <steffen.klassert@secunet.com>
>> Date:   Sun Jul 18 07:11:06 2021 +0000
>> 
>>      xfrm: Add possibility to set the default to block if we have no policy
>> 
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=114523fe300000
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=134523fe300000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=154523fe300000
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com
>> Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
>> 
>> netlink: 172 bytes leftover after parsing attributes in process `syz-executor354'.
>> ================================================================================
>> UBSAN: shift-out-of-bounds in net/xfrm/xfrm_user.c:2010:49
>> shift exponent 224 is too large for 32-bit type 'int'
>
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

want 2 args (repo, branch), got 3

>
>
>
>
> With regards,
> Pavel Skripkin

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot]

> On 8/30/21 23:19, syzbot wrote:
>> Hello,
>> 
>> syzbot found the following issue on:
>> 
>> HEAD commit:    eaf2aaec0be4 Merge tag 'wireless-drivers-next-2021-08-29' ..
>> git tree:       net-next
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1219326d300000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=d2f9d4c9ff8c5ae7
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e6e3a9300000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10de8a6d300000
>> 
>> The issue was bisected to:
>> 
>> commit 2d151d39073aff498358543801fca0f670fea981
>> Author: Steffen Klassert <steffen.klassert@secunet.com>
>> Date:   Sun Jul 18 07:11:06 2021 +0000
>> 
>>      xfrm: Add possibility to set the default to block if we have no policy
>> 
>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=114523fe300000
>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=134523fe300000
>> console output: https://syzkaller.appspot.com/x/log.txt?x=154523fe300000
>> 
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com
>> Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
>> 
>> netlink: 172 bytes leftover after parsing attributes in process `syz-executor354'.
>> ================================================================================
>> UBSAN: shift-out-of-bounds in net/xfrm/xfrm_user.c:2010:49
>> shift exponent 224 is too large for 32-bit type 'int'
>
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git

want 2 args (repo, branch), got 3

>
>
>
>
> With regards,
> Pavel Skripkin
>
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/52d33ff4-5ddc-0103-9312-f75b7e7cb5b6%40gmail.com.

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[Pavel Skripkin]

[-- Attachment #1: Type: text/plain, Size: 2069 bytes --]

On 9/1/21 21:56, syzbot wrote:
>> On 8/30/21 23:19, syzbot wrote:
>>> Hello,
>>> 
>>> syzbot found the following issue on:
>>> 
>>> HEAD commit:    eaf2aaec0be4 Merge tag 'wireless-drivers-next-2021-08-29' ..
>>> git tree:       net-next
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=1219326d300000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=d2f9d4c9ff8c5ae7
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
>>> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
>>> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11e6e3a9300000
>>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10de8a6d300000
>>> 
>>> The issue was bisected to:
>>> 
>>> commit 2d151d39073aff498358543801fca0f670fea981
>>> Author: Steffen Klassert <steffen.klassert@secunet.com>
>>> Date:   Sun Jul 18 07:11:06 2021 +0000
>>> 
>>>      xfrm: Add possibility to set the default to block if we have no policy
>>> 
>>> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=114523fe300000
>>> final oops:     https://syzkaller.appspot.com/x/report.txt?x=134523fe300000
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=154523fe300000
>>> 
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com
>>> Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy")
>>> 
>>> netlink: 172 bytes leftover after parsing attributes in process `syz-executor354'.
>>> ================================================================================
>>> UBSAN: shift-out-of-bounds in net/xfrm/xfrm_user.c:2010:49
>>> shift exponent 224 is too large for 32-bit type 'int'
>>
>>
>> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
> 
> want 2 args (repo, branch), got 3
> 

Whoops... :(



#syz test: 
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master




With regards,
Pavel Skripkin

[-- Attachment #2: 0001-net-xfrm-fix-shift-out-of-bounds-in-xfrm_get_default.patch --]
[-- Type: text/x-patch, Size: 857 bytes --]

From 0395839028b13f4e380e167c6381e4eea4a9fc42 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 1 Sep 2021 21:55:25 +0300
Subject: [PATCH] net: xfrm: fix shift-out-of-bounds in xfrm_get_default

/* ... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/xfrm/xfrm_user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b7b986520dc7..a1dd38525957 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2007,6 +2007,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	r_up = nlmsg_data(r_nlh);
 
+	if (up->dirmask >= XFRM_USERPOLICY_DIRMASK_MAX)
+		return -EINVAL;
+
 	r_up->action = ((net->xfrm.policy_default & (1 << up->dirmask)) >> up->dirmask);
 	r_up->dirmask = up->dirmask;
 	nlmsg_end(r_skb, r_nlh);
-- 
2.33.0

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

arch/x86/kernel/setup.c:916:6: error: implicit declaration of function 'acpi_mps_check' [-Werror=implicit-function-declaration]
arch/x86/kernel/setup.c:1110:2: error: implicit declaration of function 'acpi_table_upgrade' [-Werror=implicit-function-declaration]
arch/x86/kernel/setup.c:1112:2: error: implicit declaration of function 'acpi_boot_table_init' [-Werror=implicit-function-declaration]
arch/x86/kernel/setup.c:1120:2: error: implicit declaration of function 'early_acpi_boot_init'; did you mean 'early_cpu_init'? [-Werror=implicit-function-declaration]
arch/x86/kernel/setup.c:1162:2: error: implicit declaration of function 'acpi_boot_init' [-Werror=implicit-function-declaration]


Tested on:

commit:         9e9fb765 Merge tag 'net-next-5.15' of git://git.kernel..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master
dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14a2a34d300000

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[Pavel Skripkin]

[-- Attachment #1: Type: text/plain, Size: 1327 bytes --]

On 9/1/21 23:15, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> arch/x86/kernel/setup.c:916:6: error: implicit declaration of function 'acpi_mps_check' [-Werror=implicit-function-declaration]
> arch/x86/kernel/setup.c:1110:2: error: implicit declaration of function 'acpi_table_upgrade' [-Werror=implicit-function-declaration]
> arch/x86/kernel/setup.c:1112:2: error: implicit declaration of function 'acpi_boot_table_init' [-Werror=implicit-function-declaration]
> arch/x86/kernel/setup.c:1120:2: error: implicit declaration of function 'early_acpi_boot_init'; did you mean 'early_cpu_init'? [-Werror=implicit-function-declaration]
> arch/x86/kernel/setup.c:1162:2: error: implicit declaration of function 'acpi_boot_init' [-Werror=implicit-function-declaration]
> 
> 
> Tested on:
> 
> commit:         9e9fb765 Merge tag 'net-next-5.15' of git://git.kernel..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master
> dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
> compiler:
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=14a2a34d300000
> 

Ok, net-next is also broken....

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master




With regards,
Pavel Skripkin

[-- Attachment #2: 0001-net-xfrm-fix-shift-out-of-bounds-in-xfrm_get_default.patch --]
[-- Type: text/x-patch, Size: 1227 bytes --]

From 172c351869e5920630f27d20976b079fca30650c Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 1 Sep 2021 21:55:25 +0300
Subject: [PATCH] net: xfrm: fix shift-out-of-bounds in xfrm_get_default

/* ... */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 arch/x86/kernel/setup.c | 1 +
 net/xfrm/xfrm_user.c    | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index da0a4b64880f..c9e3a17b94f9 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -23,6 +23,7 @@
 #include <linux/usb/xhci-dbgp.h>
 #include <linux/static_call.h>
 #include <linux/swiotlb.h>
+#include <linux/acpi.h>
 
 #include <uapi/linux/mount.h>
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b7b986520dc7..a1dd38525957 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2007,6 +2007,9 @@ static int xfrm_get_default(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	r_up = nlmsg_data(r_nlh);
 
+	if (up->dirmask >= XFRM_USERPOLICY_DIRMASK_MAX)
+		return -EINVAL;
+
 	r_up->action = ((net->xfrm.policy_default & (1 << up->dirmask)) >> up->dirmask);
 	r_up->dirmask = up->dirmask;
 	nlmsg_end(r_skb, r_nlh);
-- 
2.33.0

Re: [syzbot] UBSAN: shift-out-of-bounds in xfrm_get_default

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+b2be9dd8ca6f6c73ee2d@syzkaller.appspotmail.com

Tested on:

commit:         9e9fb765 Merge tag 'net-next-5.15' of git://git.kernel..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git master
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd61edfef9fa14b1
dashboard link: https://syzkaller.appspot.com/bug?extid=b2be9dd8ca6f6c73ee2d
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12546ba9300000

Note: testing is done by a robot and is best-effort only.