BUG: stack guard page was hit in mptcp_sendmsg

Status: moderation: reported on 2026/08/22 00:11
Subsystems: net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+2b120190d9e54ad8c65d@syzkaller.appspotmail.com
First crash: 7d16h, last: 7d16h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
f235a36d repro-c 🏃 BUG: stack guard page was hit in mptcp_sendmsg 2026/08/25 10:19 2026/08/25 10:22 614e416a
f7b28ae1 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ BUG: stack guard page was hit in mptcp_sendmsg 2026/08/19 01:09 2026/08/19 01:09 2026/08/19 02:11 1e72964b

Sample crash report:
BUG: TASK stack guard page was hit at ffffc900058affd8 (stack is ffffc900058b0000..ffffc900058b8000)
Oops: stack guard page: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 14460 Comm: syz.2.2242 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:__lock_acquire+0x81/0x2cf0 kernel/locking/lockdep.c:-1
Code: c9 44 0f 44 c1 31 ff 48 3d 10 05 31 94 41 0f 45 f8 8b 0d 02 db d5 18 85 c9 0f 95 c0 83 fe 08 0f 92 c2 08 c2 0f 84 4d 01 00 00 <89> 7c 24 08 83 fe 01 77 0c 89 f0 49 8b 44 c3 08 48 85 c0 75 2d 31
RSP: 0018:ffffc900058affe0 EFLAGS: 00010002
RAX: ffffffff9a7cbd00 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002
R13: 0000000000000002 R14: ffff888023700000 R15: 0000000000000246
FS:  00007f881be196c0(0000) GS:ffff888124f4c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900058affd8 CR3: 000000003386c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495
 __unwind_start+0x514/0x660 arch/x86/kernel/unwind_orc.c:787
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4584 [inline]
 slab_alloc_node mm/slub.c:4917 [inline]
 kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931
 dst_alloc+0x105/0x170 net/core/dst.c:90
 rt_dst_alloc net/ipv4/route.c:1681 [inline]
 __mkroute_output net/ipv4/route.c:2684 [inline]
 ip_route_output_key_hash_rcu+0x14ac/0x2720 net/ipv4/route.c:2904
 ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2734
 __ip_route_output_key include/net/route.h:169 [inline]
 ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2961
 ipvlan_process_v4_outbound+0x2f8/0x740 drivers/net/ipvlan/ipvlan_core.c:449
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 ipvlan_process_v4_outbound+0x448/0x740 drivers/net/ipvlan/ipvlan_core.c:461
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:565 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:627 [inline]
 ipvlan_queue_xmit+0xabf/0x16b0 drivers/net/ipvlan/ipvlan_core.c:693
 ipvlan_start_xmit+0x4a/0x130 drivers/net/ipvlan/ipvlan_main.c:280
 __netdev_start_xmit include/linux/netdevice.h:5424 [inline]
 netdev_start_xmit include/linux/netdevice.h:5433 [inline]
 xmit_one net/core/dev.c:3914 [inline]
 dev_hard_start_xmit+0x2cd/0x830 net/core/dev.c:3930
 __dev_queue_xmit+0x14c0/0x3820 net/core/dev.c:4903
 dev_queue_xmit include/linux/netdevice.h:3456 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 NF_HOOK+0x605/0x660 include/linux/netfilter.h:325
 ip_vs_nat_send_or_cont+0x69c/0x8d0 net/netfilter/ipvs/ip_vs_xmit.c:688
 ip_vs_nat_xmit+0x76a/0xb40 net/netfilter/ipvs/ip_vs_xmit.c:860
 ip_vs_in_hook+0xe02/0x1c90 net/netfilter/ipvs/ip_vs_core.c:2254
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:280
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x2d18/0x47c0 net/ipv4/tcp_output.c:1717
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:4289 [inline]
 tcp_connect+0x3515/0x54e0 net/ipv4/tcp_output.c:4382
 tcp_v4_connect+0x1051/0x1950 net/ipv4/tcp_ipv4.c:345
 mptcp_connect+0x4d3/0x7a0 net/mptcp/protocol.c:4172
 __inet_stream_connect+0x258/0xe00 net/ipv4/af_inet.c:684
 tcp_sendmsg_fastopen+0x3af/0x5f0 net/ipv4/tcp.c:1085
 mptcp_sendmsg_fastopen+0x17b/0x540 net/mptcp/protocol.c:1907
 mptcp_sendmsg+0x1a69/0x1d10 net/mptcp/protocol.c:2008
 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:776
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2684
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2738
 __sys_sendmsg net/socket.c:2770 [inline]
 __do_sys_sendmsg net/socket.c:2775 [inline]
 __se_sys_sendmsg net/socket.c:2773 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2773
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f881af9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f881be19028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f881b225fa0 RCX: 00007f881af9e0d9
RDX: 0000000030004001 RSI: 0000200000000100 RDI: 0000000000000007
RBP: 00007f881b035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f881b226038 R14: 00007f881b225fa0 R15: 00007ffc7eab04a8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__lock_acquire+0x81/0x2cf0 kernel/locking/lockdep.c:-1
Code: c9 44 0f 44 c1 31 ff 48 3d 10 05 31 94 41 0f 45 f8 8b 0d 02 db d5 18 85 c9 0f 95 c0 83 fe 08 0f 92 c2 08 c2 0f 84 4d 01 00 00 <89> 7c 24 08 83 fe 01 77 0c 89 f0 49 8b 44 c3 08 48 85 c0 75 2d 31
RSP: 0018:ffffc900058affe0 EFLAGS: 00010002
RAX: ffffffff9a7cbd00 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: 0000000000000002
R13: 0000000000000002 R14: ffff888023700000 R15: 0000000000000246
FS:  00007f881be196c0(0000) GS:ffff888124f4c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900058affd8 CR3: 000000003386c000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	c9                   	leave
   1:	44 0f 44 c1          	cmove  %ecx,%r8d
   5:	31 ff                	xor    %edi,%edi
   7:	48 3d 10 05 31 94    	cmp    $0xffffffff94310510,%rax
   d:	41 0f 45 f8          	cmovne %r8d,%edi
  11:	8b 0d 02 db d5 18    	mov    0x18d5db02(%rip),%ecx        # 0x18d5db19
  17:	85 c9                	test   %ecx,%ecx
  19:	0f 95 c0             	setne  %al
  1c:	83 fe 08             	cmp    $0x8,%esi
  1f:	0f 92 c2             	setb   %dl
  22:	08 c2                	or     %al,%dl
  24:	0f 84 4d 01 00 00    	je     0x177
* 2a:	89 7c 24 08          	mov    %edi,0x8(%rsp) <-- trapping instruction
  2e:	83 fe 01             	cmp    $0x1,%esi
  31:	77 0c                	ja     0x3f
  33:	89 f0                	mov    %esi,%eax
  35:	49 8b 44 c3 08       	mov    0x8(%r11,%rax,8),%rax
  3a:	48 85 c0             	test   %rax,%rax
  3d:	75 2d                	jne    0x6c
  3f:	31                   	.byte 0x31

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/17 18:04 net-next e6a5d573d24c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce BUG: stack guard page was hit in mptcp_sendmsg
* Struck through repros no longer work on HEAD.