Here's a reduced testcase. David --- // https://syzkaller.appspot.com/bug?id=6ffe7d1ebf1efaddb7ddd04784b9b22a8562b8d0 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <endian.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <unistd.h> #include <linux/kcm.h> #define OSERROR(R, S) do { if ((long)(R) == -1L) { perror((S)); exit(1); } } while(0) int main(void) { struct msghdr msg; int kcmfd, res; kcmfd = socket(AF_KCM, SOCK_DGRAM, KCMPROTO_CONNECTED); OSERROR(kcmfd, "socket"); memset(&msg, 0, sizeof(msg)); res = sendmsg(kcmfd, &msg, 0); OSERROR(res, "sendmsg"); return 0; }