------------[ cut here ]------------
WARNING: net/ipv4/ipmr.c:2302 at ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302, CPU#1: vhost-8798/8799
Modules linked in:
CPU: 1 UID: 0 PID: 8799 Comm: vhost-8798 Not tainted 6.16.0-rc2-next-20250620-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302
Code: df e9 63 f6 ff ff e8 2e 47 bf f7 48 8b 74 24 18 45 31 f6 31 ff ba 02 00 00 00 e8 1a 08 4c ff e9 45 f6 ff ff e8 10 47 bf f7 90 <0f> 0b 90 e9 94 f5 ff ff e8 02 47 bf f7 90 0f 0b 90 42 80 3c 2b 00
RSP: 0018:ffffc90000a08900 EFLAGS: 00010246
RAX: ffffffff8a0111d0 RBX: ffff88801faac500 RCX: ffff888077ff9e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000a08a10 R08: ffff888077ff9e00 R09: 0000000000000004
R10: 0000000000000003 R11: ffffffff8a010620 R12: 0000000000000010
R13: dffffc0000000000 R14: ffff88807ec31400 R15: 0000000000000000
FS:  00007f968966f6c0(0000) GS:ffff888125d26000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000002 CR3: 0000000033372000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799
 igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x286/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:36 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:208 [inline]
RIP: 0010:perf_sw_event include/linux/perf_event.h:1595 [inline]
RIP: 0010:do_user_addr_fault+0x1ae/0x1390 arch/x86/mm/fault.c:1283
Code: 1b 48 89 de 48 81 e6 00 02 00 00 31 ff e8 fa bb 4c 00 48 81 e3 00 02 00 00 0f 84 79 0e 00 00 e8 98 49 54 00 fb 4c 89 7c 24 38 <0f> 1f 44 00 00 e8 f8 b6 4c 00 44 89 f6 83 e6 40 31 ff 48 89 74 24
RSP: 0018:ffffc90003a0f668 EFLAGS: 00000286
RAX: b42a610ae06a9400 RBX: 0000000000000200 RCX: b42a610ae06a9400
RDX: 0000000000000006 RSI: ffffffff8d991d22 RDI: ffffffff8be320a0
RBP: dffffc0000000000 R08: ffffffff8fa193f7 R09: 1ffffffff1f4327e
R10: dffffc0000000000 R11: fffffbfff1f4327f R12: ffffc90003a0f758
R13: 0000000000000002 R14: 0000000000000000 R15: ffff888077ff9e00
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:__get_user_nocheck_2+0x6/0x20 arch/x86/lib/getuser.S:130
Code: 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb 0f ae e8 <0f> b7 10 31 c0 0f 01 ca e9 fd f7 03 00 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003a0f808 EFLAGS: 00050202
RAX: 0000000000000002 RBX: ffff88805bdd01e0 RCX: 0000000000100000
RDX: ffffc90018cd9000 RSI: 0000000000000008 RDI: 0000000000000009
RBP: ffffc90003a0fae8 R08: ffffc90003a0fc80 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f4327f R12: dffffc0000000000
R13: ffff88805bdd01e0 R14: ffff88805bdd0290 R15: ffffc90003a0f810
 vhost_get_avail_idx+0xc4/0x3f0 drivers/vhost/vhost.c:1354
 vhost_get_vq_desc+0x125/0x2420 drivers/vhost/vhost.c:2600
 vhost_transport_do_send_pkt+0x31f/0x1280 drivers/vhost/vsock.c:127
 vhost_run_work_list+0x14e/0x1e0 drivers/vhost/vhost.c:407
 vhost_task_fn+0x281/0x430 kernel/vhost_task.c:49
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 89 de             	mov    %rbx,%rsi
   3:	48 81 e6 00 02 00 00 	and    $0x200,%rsi
   a:	31 ff                	xor    %edi,%edi
   c:	e8 fa bb 4c 00       	call   0x4cbc0b
  11:	48 81 e3 00 02 00 00 	and    $0x200,%rbx
  18:	0f 84 79 0e 00 00    	je     0xe97
  1e:	e8 98 49 54 00       	call   0x5449bb
  23:	fb                   	sti
  24:	4c 89 7c 24 38       	mov    %r15,0x38(%rsp)
* 29:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1) <-- trapping instruction
  2e:	e8 f8 b6 4c 00       	call   0x4cb72b
  33:	44 89 f6             	mov    %r14d,%esi
  36:	83 e6 40             	and    $0x40,%esi
  39:	31 ff                	xor    %edi,%edi
  3b:	48                   	rex.W
  3c:	89                   	.byte 0x89
  3d:	74 24                	je     0x63