------------[ cut here ]------------
WARNING: CPU: 1 PID: 8825 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 1 PID: 8825 Comm: syz.3.1176 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:__skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1027
Code: c6 e8 06 2f 46 f9 85 db 0f 84 5b 06 00 00 80 3d da 37 d2 06 01 0f 85 81 06 00 00 e8 8c 2b 46 f9 e9 e7 f9 ff ff e8 82 2b 46 f9 <0f> 0b e8 2b d8 fe 01 89 c3 31 ff 89 c6 e8 d0 2e 46 f9 85 db 74 18
RSP: 0018:ffffc900001df800 EFLAGS: 00010246
RAX: ffffffff883c1afe RBX: 0000000000000000 RCX: ffff888062bd9e00
RDX: 0000000000000100 RSI: ffffffff8aff71c0 RDI: ffffffff8aff7180
RBP: ffffc900001dfdc8 R08: dffffc0000000000 R09: 1ffffffff236e048
R10: dffffc0000000000 R11: fffffbfff236e049 R12: ffffffff8f23513c
R13: 1ffffffff1e46a28 R14: ffffffff8f235142 R15: dffffc0000000000
FS: 000055556d5a9500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa1d9e59d58 CR3: 0000000028763000 CR4: 00000000003526e0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
skb_flow_dissect_flow_keys include/linux/skbuff.h:1531 [inline]
___skb_get_hash+0x55/0x6e0 net/core/flow_dissector.c:1713
__skb_get_hash+0xd2/0x270 net/core/flow_dissector.c:1778
skb_get_hash include/linux/skbuff.h:1573 [inline]
nft_trace_init+0x1e0/0x430 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1612/0x16d0 net/netfilter/nf_tables_core.c:243
nft_do_chain_ipv4+0x156/0x220 net/netfilter/nft_chain_filter.c:23
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb9/0x200 net/netfilter/core.c:614
nf_hook+0x224/0x390 include/linux/netfilter.h:257
__ip_local_out+0x49c/0x5d0 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x120 net/ipv4/ip_output.c:124
iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x22b/0x380 net/ipv4/udp_tunnel_core.c:172
tipc_udp_xmit+0x85d/0xb40 net/tipc/udp_media.c:198
tipc_udp_send_msg+0x27a/0x3e0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2a9/0x3f0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:finish_task_switch+0x267/0x8e0 kernel/sched/core.c:5125
Code: e1 08 85 c0 0f 84 38 01 00 00 48 85 db 0f 85 57 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 63 89 eb 08 e8 be 2b 2f 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc9000e9ef7c0 EFLAGS: 00000282
RAX: ed8da7e422b3e700 RBX: 0000000000000000 RCX: ed8da7e422b3e700
RDX: dffffc0000000000 RSI: ffffffff8aac19a0 RDI: ffffffff8aff71e0
RBP: ffffc9000e9ef810 R08: ffffffff91b70277 R09: 1ffffffff236e04e
R10: dffffc0000000000 R11: fffffbfff236e04f R12: ffff888062bd9e00
R13: 1ffff110171a76f2 R14: dffffc0000000000 R15: ffff8880b8d3b790
context_switch kernel/sched/core.c:5249 [inline]
__schedule+0x1087/0x4030 kernel/sched/core.c:6563
preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6875
irqentry_exit+0x63/0x70 kernel/entry/common.c:442
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:696
RIP: 0010:anon_vma_compatible mm/mmap.c:1114 [inline]
RIP: 0010:reusable_anon_vma mm/mmap.c:1145 [inline]
RIP: 0010:find_mergeable_anon_vma+0x153/0x7f0 mm/mmap.c:1171
Code: df 41 80 3c 06 00 74 08 4c 89 e7 e8 37 e7 10 00 4d 8b 24 24 4d 89 fe 49 c1 ee 03 48 b8 00 00 00 00 00 fc ff df 41 80 3c 06 00 <74> 08 4c 89 ff e8 13 e7 10 00 4d 8b 2f 4c 89 e7 4c 89 ee e8 f5 8c
RSP: 0000:ffffc9000e9efb20 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff8880756b86c0 RCX: ffff888062bd9e00
RDX: 0000000000000000 RSI: ffffffff8f0b99a0 RDI: ffff888074f90c0c
RBP: ffffc9000e9efc20 R08: ffff888062bd9e00 R09: 0000000000000003
R10: 0000000000000009 R11: 0000000000000000 R12: 00007fa1d9e5a000
R13: ffffc9000e9efb60 R14: 1ffff1100c4c6595 R15: ffff888062632ca8
__anon_vma_prepare+0x77/0x430 mm/rmap.c:199
anon_vma_prepare include/linux/rmap.h:159 [inline]
do_anonymous_page mm/memory.c:4187 [inline]
handle_pte_fault mm/memory.c:5027 [inline]
__handle_mm_fault mm/memory.c:5171 [inline]
handle_mm_fault+0x3717/0x3d40 mm/memory.c:5292
do_user_addr_fault+0x58e/0xb20 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1429 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fa1d8f5c704
Code: 8d 3c 30 4c 89 de 4c 89 54 24 30 e8 66 2c 04 00 4c 8b 54 24 30 85 c0 0f 85 e1 00 00 00 48 8b 44 24 28 48 89 df 4c 89 54 24 30 <4c> 89 93 98 06 00 00 48 89 83 90 06 00 00 48 8d 83 10 03 00 00 4c
RSP: 002b:00007ffd0a505b30 EFLAGS: 00010246
RAX: 00007fa1d9e39000 RBX: 00007fa1d9e596c0 RCX: 00007fa1d8f9f357
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007fa1d9e596c0
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007ffd0a505c80
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: e1 08 loope 0xa
2: 85 c0 test %eax,%eax
4: 0f 84 38 01 00 00 je 0x142
a: 48 85 db test %rbx,%rbx
d: 0f 85 57 01 00 00 jne 0x16a
13: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
18: 4c 89 e7 mov %r12,%rdi
1b: e8 63 89 eb 08 call 0x8eb8983
20: e8 be 2b 2f 00 call 0x2f2be3
25: fb sti
26: 4c 8b 65 b8 mov -0x48(%rbp),%r12
* 2a: 49 8d bc 24 f8 15 00 lea 0x15f8(%r12),%rdi <-- trapping instruction
31: 00
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 42 0f b6 04 30 movzbl (%rax,%r14,1),%eax
3e: 84 c0 test %al,%al