------------[ cut here ]------------ WARNING: net/core/skbuff.c:7243 at skb_attempt_defer_free+0x538/0x674 net/core/skbuff.c:7243, CPU#1: syz.1.159/7446 Modules linked in: CPU: 1 UID: 0 PID: 7446 Comm: syz.1.159 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : skb_attempt_defer_free+0x538/0x674 net/core/skbuff.c:7243 lr : skb_attempt_defer_free+0x538/0x674 net/core/skbuff.c:7243 sp : ffff80009c157260 x29: ffff80009c1572c0 x28: ffff70001382ae78 x27: 0000000000000008 x26: ffff80009c157260 x25: 1ffff0001382ae4c x24: dfff800000000000 x23: 1fffe0001b39f5c3 x22: 0000000000000000 x21: ffff0000d9cfae20 x20: 0000000000000000 x19: ffff0000d9cfadc0 x18: 00000000ffffffff x17: ffff800093599000 x16: ffff80008af04608 x15: 0000000000000001 x14: 1fffe0001b39f5d4 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000080000 x10: 000000000000045f x9 : ffff8000a54ae000 x8 : 0000000000000460 x7 : 0000000000000000 x6 : 0000000020000848 x5 : 0000000020000848 x4 : 0000000000000001 x3 : ffff800089ab4dd4 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000002 Call trace: skb_attempt_defer_free+0x538/0x674 net/core/skbuff.c:7243 (P) skb_consume_udp+0x98/0x250 net/ipv4/udp.c:1854 udp_recvmsg+0xea8/0x13bc net/ipv4/udp.c:2145 sk_udp_recvmsg net/ipv4/udp_bpf.c:-1 [inline] udp_bpf_recvmsg+0xa84/0xca4 net/ipv4/udp_bpf.c:-1 inet_recvmsg+0x110/0x1b8 net/ipv4/af_inet.c:891 sock_recvmsg_nosec net/socket.c:1078 [inline] sock_recvmsg net/socket.c:1100 [inline] ____sys_recvmsg+0x24c/0x744 net/socket.c:2812 ___sys_recvmsg+0x188/0x45c net/socket.c:2854 do_recvmmsg+0x294/0x7cc net/socket.c:2949 __sys_recvmmsg net/socket.c:3023 [inline] __do_sys_recvmmsg net/socket.c:3046 [inline] __se_sys_recvmmsg net/socket.c:3039 [inline] __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:3039 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x5c/0x26c arch/arm64/kernel/entry-common.c:724 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:743 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 irq event stamp: 72 hardirqs last enabled at (71): [] __local_bh_enable_ip+0x1ec/0x35c kernel/softirq.c:455 hardirqs last disabled at (72): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:412 softirqs last enabled at (70): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (70): [] __skb_recv_udp+0x3d4/0x7c8 net/ipv4/udp.c:2000 softirqs last disabled at (68): [] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (68): [] __skb_recv_udp+0x1cc/0x7c8 net/ipv4/udp.c:1972 ---[ end trace 0000000000000000 ]---