------------[ cut here ]------------
!rcu_read_lock_held()
WARNING: ./include/net/dst.h:326 at skb_dst_force include/net/dst.h:326 [inline], CPU#0: kcompactd1/36
WARNING: ./include/net/dst.h:326 at xfrm_output_one net/xfrm/xfrm_output.c:549 [inline], CPU#0: kcompactd1/36
WARNING: ./include/net/dst.h:326 at xfrm_output_resume+0x41d9/0x64e0 net/xfrm/xfrm_output.c:597, CPU#0: kcompactd1/36
Modules linked in:
CPU: 0 UID: 0 PID: 36 Comm: kcompactd1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:skb_dst_force include/net/dst.h:326 [inline]
RIP: 0010:xfrm_output_one net/xfrm/xfrm_output.c:549 [inline]
RIP: 0010:xfrm_output_resume+0x41d9/0x64e0 net/xfrm/xfrm_output.c:597
Code: be b5 01 00 00 48 c7 c2 a0 f7 53 8d e8 70 94 06 f7 e9 aa fc ff ff e8 f6 3f 2b f7 90 0f 0b 90 e9 7e ed ff ff e8 e8 3f 2b f7 90 <0f> 0b 90 e9 44 e0 ff ff 48 89 df e8 07 cc 51 fa 84 c0 0f 84 e1 00
RSP: 0018:ffffc900000078c0 EFLAGS: 00010246
RAX: ffffffff8a9de0f8 RBX: 0000000000000000 RCX: ffff888140af8000
RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffffc90000007b50 R08: 0000000000000100 R09: 1ffffffff237c017
R10: dffffc0000000000 R11: fffffbfff237c018 R12: dffffc0000000000
R13: ffff8880725422d8 R14: ffff888079436990 R15: ffff888056c7a480
FS: 0000000000000000(0000) GS:ffff888123408000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2e44f0 CR3: 0000000076e76000 CR4: 00000000003526f0
Call Trace:
iptfs_output_queued net/xfrm/xfrm_iptfs.c:2325 [inline]
iptfs_delay_timer+0x3803/0x4310 net/xfrm/xfrm_iptfs.c:2362
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2136
hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2153
handle_softirqs+0x265/0x8d0 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:schedule_timeout+0x0/0x2c0 kernel/time/sleep_timeout.c:62
Code: a7 37 f6 e9 ee fe ff ff e8 6d 52 fd ff cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0018:ffffc90000ac7b18 EFLAGS: 00000246
RAX: ffffffff822101b1 RBX: 0000000000000000 RCX: ffff888140af8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000032
RBP: ffffc90000ac7e18 R08: ffff8880216b8807 R09: 1ffff110042d7100
R10: dffffc0000000000 R11: ffffed10042d7101 R12: 0000000000000032
R13: fffff52000158f78 R14: dffffc0000000000 R15: ffff88823fff7380
kcompactd+0x3f2/0x12a0 mm/compaction.c:3215
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess), 3 bytes skipped:
0: e9 ee fe ff ff jmp 0xfffffef3
5: e8 6d 52 fd ff call 0xfffd5277
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
* 27: f3 0f 1e fa endbr64 <-- trapping instruction
2b: 55 push %rbp
2c: 48 89 e5 mov %rsp,%rbp
2f: 41 57 push %r15
31: 41 56 push %r14
33: 41 55 push %r13
35: 41 54 push %r12
37: 53 push %rbx
38: 48 83 e4 e0 and $0xffffffffffffffe0,%rsp
3c: 48 rex.W