------------[ cut here ]------------
WARNING: net/mptcp/subflow.c:1527 at subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527, CPU#1: syz.1.4328/23265
Modules linked in:
CPU: 1 UID: 0 PID: 23265 Comm: syz.1.4328 Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527
Code: 89 ee e8 08 62 5d f6 40 84 ed 75 21 e8 be 67 5d f6 44 89 fe bf 07 00 00 00 e8 51 62 5d f6 41 83 ff 07 74 09 e8 a6 67 5d f6 90 <0f> 0b 90 e8 9d 67 5d f6 48 89 df e8 f5 ac ff ff 31 ff 89 c5 89 c6
RSP: 0018:ffffc90000a08548 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88804a01bfc0 RCX: ffffffff8b61033f
RDX: ffff88802f789e80 RSI: ffffffff8b61034a RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000004 R11: ffff88802f78a9b0 R12: ffff88807b270c00
R13: 1ffff920001410a9 R14: ffff88805bc02400 R15: 0000000000000004
FS: 00007f52b94ea6c0(0000) GS:ffff8881249fc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555558cd4588 CR3: 000000003213a000 CR4: 00000000003526f0
Call Trace:
tcp_data_ready+0x114/0x5a0 net/ipv4/tcp_input.c:5371
tcp_data_queue+0x1ac2/0x4ff0 net/ipv4/tcp_input.c:5461
tcp_rcv_state_process+0xfb6/0x6540 net/ipv4/tcp_input.c:7185
tcp_v4_do_rcv+0x68e/0x10a0 net/ipv4/tcp_ipv4.c:1904
tcp_v4_rcv+0x3077/0x4db0 net/ipv4/tcp_ipv4.c:2324
ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3f2/0x720 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:474 [inline]
ip_rcv_finish net/ipv4/ip_input.c:453 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_rcv+0x2e0/0x600 net/ipv4/ip_input.c:573
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6250
process_backlog+0x4a2/0x1650 net/core/dev.c:6602
__napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x9f9/0xfa0 net/core/dev.c:7881
handle_softirqs+0x219/0x950 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x24/0xc0 kernel/rcu/tree.c:751
Code: 90 90 90 90 90 90 f3 0f 1e fa 55 53 65 ff 05 73 95 0f 12 e8 7e d4 d2 09 48 c7 c3 e8 79 b3 93 89 c5 83 f8 07 0f 87 82 00 00 00 <48> 8d 3c ed 20 3f d7 8d 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48
RSP: 0018:ffffc90005066af0 EFLAGS: 00000297
RAX: 0000000000000001 RBX: ffffffff93b379e8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8bf2b500 RDI: ffffffff8bf2b540
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88802f78a9b0 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0x2cd/0x330 kernel/locking/lockdep.c:5831
local_lock_acquire include/linux/local_lock_internal.h:41 [inline]
__folio_batch_add_and_move+0x662/0xc30 mm/swap.c:192
shmem_alloc_and_add_folio+0x835/0xc20 mm/shmem.c:1991
shmem_get_folio_gfp+0x67f/0x1610 mm/shmem.c:2556
shmem_get_folio mm/shmem.c:2662 [inline]
shmem_write_begin+0x1a4/0x3b0 mm/shmem.c:3315
generic_perform_write+0x3c4/0x900 mm/filemap.c:4314
shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3490
__kernel_write_iter+0x31a/0xb10 fs/read_write.c:619
dump_emit_page fs/coredump.c:1298 [inline]
dump_user_range+0x413/0xb70 fs/coredump.c:1372
elf_core_dump+0x29c3/0x3c10 fs/binfmt_elf.c:2111
coredump_write fs/coredump.c:1049 [inline]
do_coredump fs/coredump.c:1126 [inline]
vfs_coredump+0x2b85/0x55e0 fs/coredump.c:1200
get_signal+0x22e1/0x26d0 kernel/signal.c:3019
arch_do_signal_or_restart+0x8f/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop kernel/entry/common.c:75 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
irqentry_exit+0x38a/0x8c0 kernel/entry/common.c:196
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x41000
Code: Unable to access opcode bytes at 0x40fd6.
RSP: 002b:0000000000000011 EFLAGS: 00010286
RAX: 0000000000000003 RBX: 00007f52b87e6090 RCX: 00007f52b858f7c9
RDX: 9999999999999999 RSI: 0000000000000009 RDI: 0000000000000401
RBP: 00007f52b8613f91 R08: 0000000000000009 R09: 0000000000000000
R10: ffffffff81000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f52b87e6128 R14: 00007f52b87e6090 R15: 00007fff984ae0b8
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: f3 0f 1e fa endbr64
a: 55 push %rbp
b: 53 push %rbx
c: 65 ff 05 73 95 0f 12 incl %gs:0x120f9573(%rip) # 0x120f9586
13: e8 7e d4 d2 09 call 0x9d2d496
18: 48 c7 c3 e8 79 b3 93 mov $0xffffffff93b379e8,%rbx
1f: 89 c5 mov %eax,%ebp
21: 83 f8 07 cmp $0x7,%eax
24: 0f 87 82 00 00 00 ja 0xac
* 2a: 48 8d 3c ed 20 3f d7 lea -0x7228c0e0(,%rbp,8),%rdi <-- trapping instruction
31: 8d
32: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
39: fc ff df
3c: 48 89 fa mov %rdi,%rdx
3f: 48 rex.W