------------[ cut here ]------------
WARNING: CPU: 0 PID: 13299 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 0 PID: 13299 Comm: syz.7.2875 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1027
Code: c6 e8 06 2f 46 f9 85 db 0f 84 5b 06 00 00 80 3d da 37 d2 06 01 0f 85 81 06 00 00 e8 8c 2b 46 f9 e9 e7 f9 ff ff e8 82 2b 46 f9 <0f> 0b e8 2b d8 fe 01 89 c3 31 ff 89 c6 e8 d0 2e 46 f9 85 db 74 18
RSP: 0000:ffffc90000006800 EFLAGS: 00010246
RAX: ffffffff883c1afe RBX: 0000000000000000 RCX: ffff88802edcda00
RDX: 0000000000000100 RSI: ffffffff8aff71c0 RDI: ffffffff8aff7180
RBP: ffffc90000006dc8 R08: dffffc0000000000 R09: 1ffffffff236e048
R10: dffffc0000000000 R11: fffffbfff236e049 R12: ffffffff8f23513c
R13: 1ffffffff1e46a28 R14: ffffffff8f235142 R15: dffffc0000000000
FS: 00005555737ce500(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d923ffc CR3: 000000007bc10000 CR4: 00000000003506f0
Call Trace:
skb_flow_dissect_flow_keys include/linux/skbuff.h:1531 [inline]
___skb_get_hash+0x55/0x6e0 net/core/flow_dissector.c:1713
__skb_get_hash+0xd2/0x270 net/core/flow_dissector.c:1778
skb_get_hash include/linux/skbuff.h:1573 [inline]
nft_trace_init+0x1e0/0x430 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1612/0x16d0 net/netfilter/nf_tables_core.c:243
nft_do_chain_ipv4+0x156/0x220 net/netfilter/nft_chain_filter.c:23
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb9/0x200 net/netfilter/core.c:614
nf_hook+0x224/0x390 include/linux/netfilter.h:257
__ip_local_out+0x49c/0x5d0 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x120 net/ipv4/ip_output.c:124
iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x22b/0x380 net/ipv4/udp_tunnel_core.c:172
tipc_udp_xmit+0x85d/0xb40 net/tipc/udp_media.c:198
tipc_udp_send_msg+0x27a/0x3e0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2a9/0x3f0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_count_sub+0x0/0x160 kernel/sched/core.c:5734
Code: 48 c7 c1 a8 14 23 8f 80 e1 07 80 c1 03 38 c1 0f 8c 6e ff ff ff 48 c7 c7 a8 14 23 8f e8 e9 e2 7a 00 89 df e9 5b ff ff ff 66 90 <55> 53 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 40 71 c7 97 48 c1 e8
RSP: 0000:ffffc90003bb7538 EFLAGS: 00000206
RAX: ffffc90003bb8000 RBX: ffffc90003bb75e8 RCX: ffffc90003bb7c48
RDX: ffffc90003bb7601 RSI: dffffc0000000000 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffc90003bb7c30 R09: ffffc90003bb7638
R10: dffffc0000000000 R11: fffff52000776ec9 R12: ffffc90003bb0000
R13: dffffc0000000000 R14: ffffc90003bb75f8 R15: ffffc90003bb7c40
unwind_next_frame+0x1719/0x1fd0 arch/x86/kernel/unwind_orc.c:629
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
save_stack+0x121/0x230 mm/page_owner.c:127
__set_page_owner+0x19/0x60 mm/page_owner.c:190
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
prep_new_page mm/page_alloc.c:2567 [inline]
get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
__alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
__pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
pte_alloc_one+0x7b/0x310 arch/x86/mm/pgtable.c:33
__do_fault+0xd7/0x4e0 mm/memory.c:4273
do_shared_fault mm/memory.c:4684 [inline]
do_fault mm/memory.c:4762 [inline]
handle_pte_fault mm/memory.c:5029 [inline]
__handle_mm_fault mm/memory.c:5171 [inline]
handle_mm_fault+0x192e/0x3d40 mm/memory.c:5292
do_user_addr_fault+0x58e/0xb20 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1429 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f390a473c09
Code: 89 dc 41 83 e4 03 0f 85 c9 01 00 00 4c 89 ff be 04 00 00 00 e8 88 8f fe ff 49 8b 47 40 41 83 47 30 04 48 8d 50 fc 49 89 57 40 <89> 68 fc 41 8b 47 30 48 83 c4 28 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 002b:00007ffd040adb70 EFLAGS: 00010202
RAX: 0000001b2d924000 RBX: 0000000000000000 RCX: 00000000005ffde8
RDX: 0000001b2d923ffc RSI: 00000000005ffde8 RDI: 00007f390b355700
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f390a812000
R10: 00007f390b355700 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000182 R14: ffffffff812f8a4c R15: 00007f390b355720
----------------
Code disassembly (best guess):
0: 48 c7 c1 a8 14 23 8f mov $0xffffffff8f2314a8,%rcx
7: 80 e1 07 and $0x7,%cl
a: 80 c1 03 add $0x3,%cl
d: 38 c1 cmp %al,%cl
f: 0f 8c 6e ff ff ff jl 0xffffff83
15: 48 c7 c7 a8 14 23 8f mov $0xffffffff8f2314a8,%rdi
1c: e8 e9 e2 7a 00 call 0x7ae30a
21: 89 df mov %ebx,%edi
23: e9 5b ff ff ff jmp 0xffffff83
28: 66 90 xchg %ax,%ax
* 2a: 55 push %rbp <-- trapping instruction
2b: 53 push %rbx
2c: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
33: fc ff df
36: 48 c7 c0 40 71 c7 97 mov $0xffffffff97c77140,%rax
3d: 48 rex.W
3e: c1 .byte 0xc1
3f: e8 .byte 0xe8