------------[ cut here ]------------ WARNING: CPU: 0 PID: 16348 at net/core/flow_dissector.c:1107 __skb_flow_dissect+0xbde/0x6d60 net/core/flow_dissector.c:1102 Modules linked in: CPU: 0 PID: 16348 Comm: syz.2.2307 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:__skb_flow_dissect+0xbde/0x6d60 net/core/flow_dissector.c:1107 Code: db 59 00 00 80 3d 70 ac fd 05 01 0f 85 01 5a 00 00 e8 06 27 0f f9 e9 17 f9 ff ff e8 fc 26 0f f9 e9 b4 03 00 00 e8 f2 26 0f f9 <0f> 0b e9 00 ff ff ff e8 e6 26 0f f9 c6 05 3b ac fd 05 01 48 c7 c7 RSP: 0000:ffffc90004b8e8c0 EFLAGS: 00010246 RAX: ffffffff8877fb0e RBX: ffff88807678b9f0 RCX: ffff88805e841e00 RDX: 0000000000000100 RSI: ffffffff8b1c8f80 RDI: ffffffff8b1c8f40 RBP: ffffc90004b8eed8 R08: dffffc0000000000 R09: 1ffffffff2238ca0 R10: dffffc0000000000 R11: fffffbfff2238ca1 R12: ffffffff8e8b8b78 R13: ffffffff8877f129 R14: 0000000000000000 R15: 1ffffffff1d17170 FS: 0000555582349500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd70c0ad58 CR3: 000000005cd28000 CR4: 00000000003506f0 Call Trace: skb_flow_dissect_flow_keys include/linux/skbuff.h:1544 [inline] ___skb_get_hash net/core/flow_dissector.c:1801 [inline] __skb_get_hash+0xf3/0x2e0 net/core/flow_dissector.c:1866 skb_get_hash include/linux/skbuff.h:1586 [inline] nft_trace_init+0x1bb/0x410 net/netfilter/nf_tables_trace.c:316 nft_do_chain+0x14fc/0x1600 net/netfilter/nf_tables_core.c:268 nf_route_table_hook6+0x366/0x7b0 net/netfilter/nft_chain_route.c:88 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:259 [inline] __ip6_local_out+0x784/0x8a0 net/ipv6/output_core.c:143 ip6_local_out+0x2a/0x130 net/ipv6/output_core.c:153 ip6tunnel_xmit include/net/ip6_tunnel.h:161 [inline] udp_tunnel6_xmit_skb+0x53e/0x970 net/ipv6/ip6_udp_tunnel.c:109 tipc_udp_xmit+0x58d/0xb40 net/tipc/udp_media.c:220 tipc_bearer_xmit_skb+0x2ad/0x3f0 net/tipc/bearer.c:575 tipc_disc_timeout+0x596/0x6f0 net/tipc/discover.c:338 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x542/0x800 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x280/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0x56/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0033:0x7fcd6fc6d284 Code: 48 0f 7e ca 48 39 c2 73 65 48 39 f0 0f 82 2a 01 00 00 48 39 f2 72 65 66 0f c6 c0 01 0f 11 45 00 4c 89 e6 eb 09 90 48 8b 4b 08 <48> 83 c3 08 48 39 d1 72 f3 48 8d 46 f8 48 8b 76 f8 48 39 f2 73 13 RSP: 002b:00007ffed7d6b140 EFLAGS: 00000287 RAX: 00007fcd6fbf2098 RBX: 00007fcd6f929d68 RCX: ffffffff8a75b9a0 RDX: ffffffff8a75b9a0 RSI: 00007fcd6fbf2098 RDI: 00007fcd6fa8fb88 RBP: 00007fcd6f920718 R08: 00007fcd70000000 R09: 00007fcd70016038 R10: 0000000000000001 R11: 0000000000000011 R12: 00007fcd6fbff000 R13: 0000000000000022 R14: 000000000005bd1d R15: 0000000000000001