------------[ cut here ]------------
WARNING: CPU: 0 PID: 12226 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 0 PID: 12226 Comm: rm Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1027
Code: c6 e8 36 27 4d f9 85 db 0f 84 5b 06 00 00 80 3d f8 32 b7 06 01 0f 85 81 06 00 00 e8 bc 23 4d f9 e9 e7 f9 ff ff e8 b2 23 4d f9 <0f> 0b e8 cb cc fe 01 89 c3 31 ff 89 c6 e8 00 27 4d f9 85 db 74 18
RSP: 0018:ffffc90000006800 EFLAGS: 00010246
RAX: ffffffff883522ce RBX: 0000000000000000 RCX: ffff888076675a00
RDX: 0000000000000100 RSI: ffffffff8adf7140 RDI: ffffffff8adf7100
RBP: ffffc90000006dc8 R08: dffffc0000000000 R09: 1ffffffff2326848
R10: dffffc0000000000 R11: fffffbfff2326849 R12: ffffffff8f01437c
R13: 1ffffffff1e02870 R14: ffffffff8f014382 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7345ce0440 CR3: 0000000063da2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
skb_flow_dissect_flow_keys include/linux/skbuff.h:1531 [inline]
___skb_get_hash+0x55/0x6e0 net/core/flow_dissector.c:1713
__skb_get_hash+0xd2/0x270 net/core/flow_dissector.c:1778
skb_get_hash include/linux/skbuff.h:1573 [inline]
nft_trace_init+0x1e0/0x430 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1612/0x16d0 net/netfilter/nf_tables_core.c:243
nft_do_chain_ipv4+0x156/0x220 net/netfilter/nft_chain_filter.c:23
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb9/0x200 net/netfilter/core.c:614
nf_hook+0x224/0x390 include/linux/netfilter.h:257
__ip_local_out+0x49c/0x5d0 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x120 net/ipv4/ip_output.c:124
iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x22b/0x380 net/ipv4/udp_tunnel_core.c:172
tipc_udp_xmit+0x85d/0xb40 net/tipc/udp_media.c:198
tipc_udp_send_msg+0x27a/0x3e0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2a9/0x3f0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:unwind_next_frame+0x1/0x1fd0 arch/x86/kernel/unwind_orc.c:423
Code: 31 c0 5b 41 5e 41 5f c3 89 d9 80 e1 07 80 c1 03 38 c1 7c 97 48 89 df e8 cd a7 9a 00 eb 8d 66 2e 0f 1f 84 00 00 00 00 00 90 55 <41> 57 41 56 41 55 41 54 53 48 83 ec 70 48 89 fb 49 be 00 00 00 00
RSP: 0018:ffffc9000cc96d38 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffc9000cc96e00 RCX: 0000000080000000
RDX: dffffc0000000000 RSI: ffffffff81c2fb4f RDI: ffffc9000cc96d48
RBP: ffffc9000cc96dd0 R08: ffffc9000cc96e10 R09: 000000000000000e
R10: dffffc0000000000 R11: fffff52001992db5 R12: ffff888076675a00
R13: ffffc9000cc97190 R14: ffffffff8170ec60 R15: ffffc9000cc96d48
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
kmem_cache_free_bulk+0x364/0x480 mm/slub.c:3805
mt_free_bulk lib/maple_tree.c:164 [inline]
mas_destroy+0x251f/0x2d40 lib/maple_tree.c:5864
mas_store_prealloc+0x32c/0x430 lib/maple_tree.c:5792
__vma_adjust+0xfd6/0x1d00 mm/mmap.c:805
vma_adjust include/linux/mm.h:2810 [inline]
__split_vma+0x3a2/0x4f0 mm/mmap.c:-1
do_mas_align_munmap+0x7b8/0x12d0 mm/mmap.c:2501
do_mas_munmap+0x240/0x2b0 mm/mmap.c:2650
__mmap_region mm/mmap.c:2698 [inline]
mmap_region+0x7ab/0x1c50 mm/mmap.c:2916
do_mmap+0x9ce/0x10d0 mm/mmap.c:1436
vm_mmap_pgoff+0x1c1/0x2d0 mm/util.c:520
ksys_mmap_pgoff+0x4bf/0x720 mm/mmap.c:1482
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7345fba242
Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
RSP: 002b:00007fff2ee4a758 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f7345cd6000 RCX: 00007f7345fba242
RDX: 0000000000000001 RSI: 0000000000002000 RDI: 00007f7345cd6000
RBP: 0000000000000812 R08: 0000000000000003 R09: 000000000000b000
R10: 0000000000000812 R11: 0000000000000206 R12: 00007fff2ee4a7e0
R13: 00007f7345f97580 R14: 00007fff2ee4abd0 R15: 00000fffe5dc94ee
----------------
Code disassembly (best guess):
0: 31 c0 xor %eax,%eax
2: 5b pop %rbx
3: 41 5e pop %r14
5: 41 5f pop %r15
7: c3 ret
8: 89 d9 mov %ebx,%ecx
a: 80 e1 07 and $0x7,%cl
d: 80 c1 03 add $0x3,%cl
10: 38 c1 cmp %al,%cl
12: 7c 97 jl 0xffffffab
14: 48 89 df mov %rbx,%rdi
17: e8 cd a7 9a 00 call 0x9aa7e9
1c: eb 8d jmp 0xffffffab
1e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
25: 00 00 00
28: 90 nop
29: 55 push %rbp
* 2a: 41 57 push %r15 <-- trapping instruction
2c: 41 56 push %r14
2e: 41 55 push %r13
30: 41 54 push %r12
32: 53 push %rbx
33: 48 83 ec 70 sub $0x70,%rsp
37: 48 89 fb mov %rdi,%rbx
3a: 49 rex.WB
3b: be 00 00 00 00 mov $0x0,%esi