------------[ cut here ]------------
hook not found, pf 5 num 0
WARNING: net/netfilter/core.c:514 at __nf_unregister_net_hook+0x1b4/0x660 net/netfilter/core.c:514, CPU#1: syz.1.690/7765
Modules linked in:
CPU: 1 UID: 0 PID: 7765 Comm: syz.1.690 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__nf_unregister_net_hook+0x1b9/0x660 net/netfilter/core.c:514
Code: df 48 c1 ea 03 0f b6 14 02 4c 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 3e 03 00 00 48 8d 3d 0c ea 05 07 8b 53 3c 89 ee <67> 48 0f b9 3a e9 dc 00 00 00 e8 d8 87 2e f8 8b 04 24 48 89 c2 48
RSP: 0018:ffffc9001c107990 EFLAGS: 00010246
RAX: 0000000000000007 RBX: ffff888030d4de00 RCX: ffffffff89906085
RDX: 0000000000000000 RSI: 0000000000000005 RDI: ffffffff90964ad0
RBP: 0000000000000005 R08: 0000000000000004 R09: 0000000000000001
R10: 0000000000000001 R11: ffff888078c5aff0 R12: ffff8880316d4488
R13: ffff888028036320 R14: ffff888028036300 R15: ffff888030d4de3c
FS:  00005555913aa500(0000) GS:ffff8881249f5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fc22ff8 CR3: 00000000202d7000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 nf_unregister_net_hook+0xd5/0x110 net/netfilter/core.c:536
 nft_unregister_flowtable_ops net/netfilter/nf_tables_api.c:9038 [inline]
 nft_flowtable_event net/netfilter/nf_tables_api.c:9817 [inline]
 __nf_tables_flowtable_event+0x25d/0x9d0 net/netfilter/nf_tables_api.c:9862
 nf_tables_flowtable_event+0x172/0x1e0 net/netfilter/nf_tables_api.c:9893
 notifier_call_chain+0xbc/0x3e0 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2230
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 unregister_netdevice_many_notify+0xf81/0x2590 net/core/dev.c:12383
 unregister_netdevice_many net/core/dev.c:12446 [inline]
 unregister_netdevice_queue net/core/dev.c:12260 [inline]
 unregister_netdevice_queue+0x305/0x3c0 net/core/dev.c:12250
 unregister_netdevice include/linux/netdevice.h:3405 [inline]
 __tun_detach+0x119c/0x1490 drivers/net/tun.c:621
 tun_detach drivers/net/tun.c:637 [inline]
 tun_chr_close+0xc2/0x230 drivers/net/tun.c:3436
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xfb/0x540 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4f9558f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd321fc648 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000265d9 RCX: 00007f4f9558f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f4f957e7da0 R08: 0000000000000001 R09: 00000009321fc93f
R10: 0000001b2ec20000 R11: 0000000000000246 R12: 00007f4f957e5fac
R13: 00007f4f957e5fa0 R14: ffffffffffffffff R15: 00007ffd321fc760
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	48 c1 ea 03          	shr    $0x3,%rdx
   4:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx
   8:	4c 89 f8             	mov    %r15,%rax
   b:	83 e0 07             	and    $0x7,%eax
   e:	83 c0 03             	add    $0x3,%eax
  11:	38 d0                	cmp    %dl,%al
  13:	7c 08                	jl     0x1d
  15:	84 d2                	test   %dl,%dl
  17:	0f 85 3e 03 00 00    	jne    0x35b
  1d:	48 8d 3d 0c ea 05 07 	lea    0x705ea0c(%rip),%rdi        # 0x705ea30
  24:	8b 53 3c             	mov    0x3c(%rbx),%edx
  27:	89 ee                	mov    %ebp,%esi
* 29:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2e:	e9 dc 00 00 00       	jmp    0x10f
  33:	e8 d8 87 2e f8       	call   0xf82e8810
  38:	8b 04 24             	mov    (%rsp),%eax
  3b:	48 89 c2             	mov    %rax,%rdx
  3e:	48                   	rex.W