------------[ cut here ]------------
WARNING: CPU: 0 PID: 12636 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 0 PID: 12636 Comm: syz.2.2494 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:__skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1027
Code: c6 e8 36 27 4d f9 85 db 0f 84 5b 06 00 00 80 3d f8 32 b7 06 01 0f 85 81 06 00 00 e8 bc 23 4d f9 e9 e7 f9 ff ff e8 b2 23 4d f9 <0f> 0b e8 cb cc fe 01 89 c3 31 ff 89 c6 e8 00 27 4d f9 85 db 74 18
RSP: 0018:ffffc90000006800 EFLAGS: 00010246
RAX: ffffffff883522ce RBX: 0000000000000000 RCX: ffff888026261e00
RDX: 0000000000000100 RSI: ffffffff8adf7140 RDI: ffffffff8adf7100
RBP: ffffc90000006dc8 R08: dffffc0000000000 R09: 1ffffffff2326848
R10: dffffc0000000000 R11: fffffbfff2326849 R12: ffffffff8f01437c
R13: 1ffffffff1e02870 R14: ffffffff8f014382 R15: dffffc0000000000
FS: 00007f3453a436c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3452becc40 CR3: 0000000067754000 CR4: 00000000003506f0
Call Trace:
skb_flow_dissect_flow_keys include/linux/skbuff.h:1531 [inline]
___skb_get_hash+0x55/0x6e0 net/core/flow_dissector.c:1713
__skb_get_hash+0xd2/0x270 net/core/flow_dissector.c:1778
skb_get_hash include/linux/skbuff.h:1573 [inline]
nft_trace_init+0x1e0/0x430 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1612/0x16d0 net/netfilter/nf_tables_core.c:243
nft_do_chain_ipv4+0x156/0x220 net/netfilter/nft_chain_filter.c:23
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb9/0x200 net/netfilter/core.c:614
nf_hook+0x224/0x390 include/linux/netfilter.h:257
__ip_local_out+0x49c/0x5d0 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x120 net/ipv4/ip_output.c:124
iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x22b/0x380 net/ipv4/udp_tunnel_core.c:172
tipc_udp_xmit+0x85d/0xb40 net/tipc/udp_media.c:198
tipc_udp_send_msg+0x27a/0x3e0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2a9/0x3f0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x92f/0xb50 kernel/printk/printk.c:2786
Code: 0f 85 af 00 00 00 e8 10 b0 1a 00 0f b6 5c 24 0f 4d 85 f6 75 07 e8 01 b0 1a 00 eb 06 e8 fa af 1a 00 fb 66 43 c7 44 2f 24 f8 f8 <43> c6 44 2f 26 f8 48 b8 f8 f2 f2 f2 f8 f8 f8 f8 48 05 00 06 06 06
RSP: 0018:ffffc90004a9ef20 EFLAGS: 00000283
RAX: ffffffff81679686 RBX: 0000000000000001 RCX: 0000000000080000
RDX: ffffc9000ef49000 RSI: 0000000000023f9d RDI: 0000000000023f9e
RBP: ffffc90004a9f140 R08: ffffffff91934247 R09: 1ffffffff2326848
R10: dffffc0000000000 R11: fffffbfff2326849 R12: 1ffff92000953e2f
R13: dffffc0000000000 R14: 0000000000000200 R15: 1ffff92000953df0
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303
_printk+0xda/0x130 kernel/printk/printk.c:2328
bio_check_eod block/blk-core.c:521 [inline]
submit_bio_noacct+0x106a/0x1990 block/blk-core.c:735
dio_bio_submit fs/direct-io.c:431 [inline]
dio_send_cur_page+0x36c/0x870 fs/direct-io.c:757
submit_page_section+0x12a/0xac0 fs/direct-io.c:826
do_direct_IO fs/direct-io.c:1041 [inline]
__blockdev_direct_IO+0x1cf0/0x34c0 fs/direct-io.c:1260
blockdev_direct_IO include/linux/fs.h:3377 [inline]
fat_direct_IO+0x1bc/0x2f0 fs/fat/inode.c:288
generic_file_direct_write+0x112/0x330 mm/filemap.c:3787
__generic_file_write_iter+0x15f/0x2a0 mm/filemap.c:3945
generic_file_write_iter+0xab/0x2e0 mm/filemap.c:3989
call_write_iter include/linux/fs.h:2271 [inline]
aio_write+0x545/0x780 fs/aio.c:1615
__io_submit_one fs/aio.c:-1 [inline]
io_submit_one+0x6ea/0x1340 fs/aio.c:2034
__do_sys_io_submit fs/aio.c:2093 [inline]
__se_sys_io_submit+0x19d/0x310 fs/aio.c:2063
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3452b9f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3453a43028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 00007f3452e25fa0 RCX: 00007f3452b9f559
RDX: 0000200000000540 RSI: 000000000000003b RDI: 00007f3453a1a000
RBP: 00007f3452c36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3452e26038 R14: 00007f3452e25fa0 R15: 00007ffcba3e4948
----------------
Code disassembly (best guess):
0: 0f 85 af 00 00 00 jne 0xb5
6: e8 10 b0 1a 00 call 0x1ab01b
b: 0f b6 5c 24 0f movzbl 0xf(%rsp),%ebx
10: 4d 85 f6 test %r14,%r14
13: 75 07 jne 0x1c
15: e8 01 b0 1a 00 call 0x1ab01b
1a: eb 06 jmp 0x22
1c: e8 fa af 1a 00 call 0x1ab01b
21: fb sti
22: 66 43 c7 44 2f 24 f8 movw $0xf8f8,0x24(%r15,%r13,1)
29: f8
* 2a: 43 c6 44 2f 26 f8 movb $0xf8,0x26(%r15,%r13,1) <-- trapping instruction
30: 48 b8 f8 f2 f2 f2 f8 movabs $0xf8f8f8f8f2f2f2f8,%rax
37: f8 f8 f8
3a: 48 05 00 06 06 06 add $0x6060600,%rax