------------[ cut here ]------------
WARNING: CPU: 0 PID: 14775 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 0 PID: 14775 Comm: syz.4.2638 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__skb_flow_dissect+0xade/0x6d50 net/core/flow_dissector.c:1027
Code: c6 e8 06 ca 4d f9 85 db 0f 84 5b 06 00 00 80 3d a8 cb d7 05 01 0f 85 81 06 00 00 e8 8c c6 4d f9 e9 e7 f9 ff ff e8 82 c6 4d f9 <0f> 0b e8 db 21 fe 01 89 c3 31 ff 89 c6 e8 d0 c9 4d f9 85 db 74 18
RSP: 0018:ffffc900000067c0 EFLAGS: 00010246
RAX: ffffffff88346c5e RBX: 0000000000000000 RCX: ffff888047a19e00
RDX: 0000000000000100 RSI: ffffffff8adf6880 RDI: ffffffff8adf6840
RBP: ffffc90000006d88 R08: dffffc0000000000 R09: 1ffffffff2161e48
R10: dffffc0000000000 R11: fffffbfff2161e49 R12: ffffffff8e2125bc
R13: 1ffffffff1c424b8 R14: ffffffff8e2125c2 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fedb316b993 CR3: 000000007e72f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
skb_flow_dissect_flow_keys include/linux/skbuff.h:1531 [inline]
___skb_get_hash+0x55/0x6e0 net/core/flow_dissector.c:1713
__skb_get_hash+0xd2/0x270 net/core/flow_dissector.c:1778
skb_get_hash include/linux/skbuff.h:1573 [inline]
nft_trace_init+0x1e0/0x430 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1612/0x16d0 net/netfilter/nf_tables_core.c:243
nft_do_chain_inet+0x25c/0x340 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb9/0x200 net/netfilter/core.c:614
nf_hook+0x224/0x390 include/linux/netfilter.h:257
__ip_local_out+0x49c/0x5d0 net/ipv4/ip_output.c:115
ip_local_out+0x26/0x120 net/ipv4/ip_output.c:124
iptunnel_xmit+0x4a1/0x880 net/ipv4/ip_tunnel_core.c:82
udp_tunnel_xmit_skb+0x22b/0x380 net/ipv4/udp_tunnel_core.c:172
tipc_udp_xmit+0x85d/0xb40 net/tipc/udp_media.c:198
tipc_udp_send_msg+0x27a/0x3e0 net/tipc/udp_media.c:271
tipc_bearer_xmit_skb+0x2a9/0x3f0 net/tipc/bearer.c:578
tipc_disc_timeout+0x5e1/0x740 net/tipc/discover.c:340
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:_compound_head include/linux/page-flags.h:255 [inline]
RIP: 0010:free_swap_cache+0x39/0x5c0 mm/swap_state.c:282
Code: 00 00 00 00 00 fc ff df e8 64 72 b7 ff 4c 8d 73 08 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 0a b7 08 00 4d 8b 36 <4c> 89 f6 48 83 e6 01 31 ff e8 19 76 b7 ff 4c 89 f0 48 83 e0 01 0f
RSP: 0018:ffffc900039f73b8 EFLAGS: 00000246
RAX: 1ffffd40003acc69 RBX: ffffea0001d66340 RCX: ffff888047a19e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffea0001d66340
RBP: 0000000000000200 R08: ffffea0001d66307 R09: 1ffffd40003acc60
R10: dffffc0000000000 R11: fffff940003acc61 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000fe8
free_pages_and_swap_cache+0x5c/0x90 mm/swap_state.c:313
tlb_batch_pages_flush mm/mmu_gather.c:60 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:255 [inline]
tlb_flush_mmu+0x105/0x220 mm/mmu_gather.c:262
zap_pte_range mm/memory.c:1523 [inline]
zap_pmd_range mm/memory.c:1572 [inline]
zap_pud_range mm/memory.c:1601 [inline]
zap_p4d_range mm/memory.c:1622 [inline]
unmap_page_range+0x2037/0x25b0 mm/memory.c:1643
unmap_vmas+0x260/0x390 mm/memory.c:1728
exit_mmap+0x20d/0x970 mm/mmap.c:3250
__mmput+0x118/0x3a0 kernel/fork.c:1210
exit_mm+0x24d/0x350 kernel/exit.c:572
do_exit+0x958/0x2570 kernel/exit.c:874
do_group_exit+0x229/0x2e0 kernel/exit.c:1030
get_signal+0x1259/0x1340 kernel/signal.c:2884
arch_do_signal_or_restart+0xc4/0x1310 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fadf3d9e159
Code: Unable to access opcode bytes at 0x7fadf3d9e12f.
RSP: 002b:00007fadf4c050e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007fadf4026098 RCX: 00007fadf3d9e159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fadf402609c
RBP: 00007fadf4026090 R08: 0003ab9599675d70 R09: 0000000000000000
R10: 0000000000003000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fadf4026128 R14: 00007ffdb72c8940 R15: 00007ffdb72c8a28
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: 00 fc add %bh,%ah
6: ff lcall (bad)
7: df e8 fucomip %st(0),%st
9: 64 72 b7 fs jb 0xffffffc3
c: ff 4c 8d 73 decl 0x73(%rbp,%rcx,4)
10: 08 4c 89 f0 or %cl,-0x10(%rcx,%rcx,4)
14: 48 c1 e8 03 shr $0x3,%rax
18: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
1d: 74 08 je 0x27
1f: 4c 89 f7 mov %r14,%rdi
22: e8 0a b7 08 00 call 0x8b731
27: 4d 8b 36 mov (%r14),%r14
* 2a: 4c 89 f6 mov %r14,%rsi <-- trapping instruction
2d: 48 83 e6 01 and $0x1,%rsi
31: 31 ff xor %edi,%edi
33: e8 19 76 b7 ff call 0xffb77651
38: 4c 89 f0 mov %r14,%rax
3b: 48 83 e0 01 and $0x1,%rax
3f: 0f .byte 0xf