------------[ cut here ]------------
!rcu_read_lock_held()
WARNING: ./include/net/dst.h:326 at skb_dst_force include/net/dst.h:326 [inline], CPU#0: kworker/0:0/10
WARNING: ./include/net/dst.h:326 at xfrm_output_one net/xfrm/xfrm_output.c:549 [inline], CPU#0: kworker/0:0/10
WARNING: ./include/net/dst.h:326 at xfrm_output_resume+0x54c6/0x7200 net/xfrm/xfrm_output.c:597, CPU#0: kworker/0:0/10
Modules linked in:
CPU: 0 UID: 0 PID: 10 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:skb_dst_force include/net/dst.h:326 [inline]
RIP: 0010:xfrm_output_one net/xfrm/xfrm_output.c:549 [inline]
RIP: 0010:xfrm_output_resume+0x54c6/0x7200 net/xfrm/xfrm_output.c:597
Code: fe ff ff e8 5c 10 b3 fa 31 ff 41 89 c4 89 c6 e8 40 31 86 f7 45 84 e4 0f 85 1b f0 ff ff 31 db e9 20 f0 ff ff e8 1b 37 86 f7 90 <0f> 0b 90 e9 cd ef ff ff c6 85 c0 fe ff ff 00 31 db 49 8d 46 4d e9
RSP: 0018:ffffc90000007a68 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880408cc900 RCX: 0000000000000101
RDX: ffff8880202e2580 RSI: ffffffff8a8849e5 RDI: 0000000000000005
RBP: ffffc90000007be0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888059872ec0 R14: ffff888028a91400 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880d4471000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582d0298ce8 CR3: 0000000034fa2000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 xfrm_output2 net/xfrm/xfrm_output.c:656 [inline]
 xfrm_output+0x33f/0x2040 net/xfrm/xfrm_output.c:837
 iptfs_output_queued net/xfrm/xfrm_iptfs.c:2325 [inline]
 iptfs_delay_timer+0x1ab7/0x3c20 net/xfrm/xfrm_iptfs.c:2362
 __run_hrtimer kernel/time/hrtimer.c:2079 [inline]
 __hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136
 hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 unlock_sock_fast include/net/sock.h:1777 [inline]
 unlock_sock_fast include/net/sock.h:1769 [inline]
 mptcp_subflow_send_ack net/mptcp/protocol.c:640 [inline]
 mptcp_send_ack+0x1be/0x230 net/mptcp/protocol.c:648
 __mptcp_retrans+0xf2c/0x1210 net/mptcp/protocol.c:3007
 mptcp_worker+0xa79/0x1250 net/mptcp/protocol.c:3160
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>