syzbot


WARNING in __skb_flow_dissect

Status: upstream: reported C repro on 2026/01/17 07:47
Reported-by: syzbot+84112fa28f0a5cc0669f@syzkaller.appspotmail.com
First crash: 9d10h, last: 3h05m
Bug presence (1)
Date Name Commit Repro Result
2026/01/24 upstream (ToT) 5dbeeb268b63 C Failed due to an error; will retry later
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __skb_flow_dissect (6) net -1 1 629d 629d 27/29 fixed on 2024/08/14 19:57
upstream WARNING in __skb_flow_dissect net -1 syz 3 2664d 2665d 11/29 fixed on 2018/10/11 18:37
upstream WARNING in __skb_flow_dissect (5) net -1 1 669d 669d 0/29 closed as invalid on 2024/04/26 11:59
upstream WARNING in __skb_flow_dissect (7) net -1 275 13d 6d02h 25/29 upstream: reported on 2026/01/20 16:15
upstream WARNING in __skb_flow_dissect (3) net -1 syz 224 2568d 2657d 11/29 fixed on 2019/03/06 07:43
upstream WARNING in __skb_flow_dissect (4) net -1 C error 6 1178d 1187d 22/29 fixed on 2023/02/24 13:50

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4466 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 1 PID: 4466 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
lr : __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
sp : ffff800008016380
x29: ffff8000080169d0 x28: ffff800008016ae0 x27: 0000000000000002
x26: ffff0000dc3a1a00 x25: ffff8000152051dc x24: dfff800000000000
x23: 0000000000000000 x22: 1ffff00002a40a3c x21: 1ffff00002a40a3c
x20: ffff8000152051e2 x19: ffff700001002cb4 x18: ffff800011b7bf60
x17: ffff800018338000 x16: ffff8000082d9364 x15: 0000000000000000
x14: 000000000000000a x13: 1ffff00002a40071 x12: 0000000000ff0100
x11: ff0080000fda1f0c x10: 0000000000000000 x9 : ffff80000fda1f0c
x8 : ffff0000cd623780 x7 : ffff80000fda8dec x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : ffff80001206b4c0 x0 : 0000000000000001
Call trace:
 __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
 skb_flow_dissect_flow_keys include/linux/skbuff.h:1499 [inline]
 ___skb_get_hash+0x7c/0x5b8 net/core/flow_dissector.c:1708
 __skb_get_hash+0xb8/0x228 net/core/flow_dissector.c:1773
 skb_get_hash include/linux/skbuff.h:1541 [inline]
 nft_trace_init+0x188/0x358 net/netfilter/nf_tables_trace.c:292
 nft_do_chain+0x1260/0x12e8 net/netfilter/nf_tables_core.c:243
 nf_route_table_hook6+0x218/0x5ec net/netfilter/nft_chain_route.c:88
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xb4/0x1f4 net/netfilter/core.c:614
 nf_hook include/linux/netfilter.h:257 [inline]
 __ip6_local_out+0x6b0/0x7cc net/ipv6/output_core.c:149
 ip6_local_out+0x3c/0x15c net/ipv6/output_core.c:159
 nf_send_reset6+0x7a8/0xc18 net/ipv6/netfilter/nf_reject_ipv6.c:395
 nft_reject_inet_eval+0x268/0x550 net/netfilter/nft_reject_inet.c:48
 expr_call_ops_eval net/netfilter/nf_tables_core.c:214 [inline]
 nft_do_chain+0x44c/0x12e8 net/netfilter/nf_tables_core.c:264
 nft_do_chain_inet+0x208/0x2e4 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_slow+0xb4/0x1f4 net/netfilter/core.c:614
 nf_hook include/linux/netfilter.h:257 [inline]
 NF_HOOK+0x1d0/0x36c include/linux/netfilter.h:300
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:310
 __netif_receive_skb_one_core net/core/dev.c:5581 [inline]
 __netif_receive_skb+0xcc/0x2a8 net/core/dev.c:5695
 process_backlog+0x408/0x710 net/core/dev.c:6023
 __napi_poll+0xb4/0x3f0 net/core/dev.c:6590
 napi_poll net/core/dev.c:6657 [inline]
 net_rx_action+0x514/0xb18 net/core/dev.c:6771
 handle_softirqs+0x318/0xc60 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 do_softirq+0xf8/0x1a8 kernel/softirq.c:497
 __local_bh_enable_ip+0x250/0x37c kernel/softirq.c:421
 local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline]
 __dev_queue_xmit+0x1744/0x3134 net/core/dev.c:4373
 dev_queue_xmit include/linux/netdevice.h:3051 [inline]
 neigh_hh_output include/net/neighbour.h:529 [inline]
 neigh_output include/net/neighbour.h:543 [inline]
 ip6_finish_output2+0xd28/0x1840 net/ipv6/ip6_output.c:138
 __ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
 ip6_finish_output+0x594/0x92c net/ipv6/ip6_output.c:216
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
 dst_output include/net/dst.h:453 [inline]
 NF_HOOK include/linux/netfilter.h:302 [inline]
 ip6_xmit+0x1164/0x1a24 net/ipv6/ip6_output.c:357
 inet6_csk_xmit+0x374/0x5c0 net/ipv6/inet6_connection_sock.c:135
 __tcp_transmit_skb+0x17d8/0x2b88 net/ipv4/tcp_output.c:1405
 tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:3901 [inline]
 tcp_connect+0x23e8/0x3de0 net/ipv4/tcp_output.c:3940
 tcp_v6_connect+0xde0/0x139c net/ipv6/tcp_ipv6.c:342
 __inet_stream_connect+0x1f4/0xc3c net/ipv4/af_inet.c:668
 tcp_sendmsg_fastopen+0x30c/0x558 net/ipv4/tcp.c:1207
 tcp_sendmsg_locked+0x2cf0/0x31f0 net/ipv4/tcp.c:1255
 tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1490
 inet6_sendmsg+0xb4/0xd8 net/ipv6/af_inet6.c:668
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x324/0x440 net/socket.c:2152
 __do_sys_sendto net/socket.c:2164 [inline]
 __se_sys_sendto net/socket.c:2160 [inline]
 __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 2711
hardirqs last  enabled at (2710): [<ffff800011a1e1dc>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (2710): [<ffff800011a1e1dc>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (2711): [<ffff800011a1c234>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (2676): [<ffff80000fdc3478>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (2677): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/24 09:03 linux-6.1.y cd9b81672742 4f25b9b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/26 15:12 linux-6.1.y cd9b81672742 a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/26 02:08 linux-6.1.y cd9b81672742 55756628 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/24 15:19 linux-6.1.y cd9b81672742 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/24 15:19 linux-6.1.y cd9b81672742 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/24 03:02 linux-6.1.y cd9b81672742 4f25b9b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/21 10:54 linux-6.1.y cd9b81672742 6f1aa2f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/20 17:52 linux-6.1.y cd9b81672742 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/20 06:01 linux-6.1.y cd9b81672742 572effc1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/17 07:48 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
2026/01/17 07:47 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in __skb_flow_dissect
* Struck through repros no longer work on HEAD.