------------[ cut here ]------------ WARNING: CPU: 0 PID: 7674 at net/bridge/br_netfilter_hooks.c:634 br_nf_local_in+0x479/0x4c0 net/bridge/br_netfilter_hooks.c:634 Modules linked in: CPU: 0 PID: 7674 Comm: syz.9.590 Not tainted 5.15.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:br_nf_local_in+0x479/0x4c0 net/bridge/br_netfilter_hooks.c:634 Code: e9 50 fc ff ff e8 b7 3e c7 f8 0f 0b 4c 89 f7 e8 5d 2b 00 00 e9 17 fd ff ff e8 a3 3e c7 f8 0f 0b e9 d8 fd ff ff e8 97 3e c7 f8 <0f> 0b e9 3f ff ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 55 fd RSP: 0018:ffffc9000423ee08 EFLAGS: 00010293 RAX: ffffffff88b082a9 RBX: 0000000000000000 RCX: ffff88801d748000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffff8b0368a8 R08: dffffc0000000000 R09: ffffed100efbee89 R10: ffffed100efbee89 R11: 1ffff1100efbee88 R12: ffff888077df7440 R13: ffff88805b5ba7e8 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fb227d586c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fddfb1404c0 CR3: 000000004d6cd000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xb9/0x200 net/netfilter/core.c:584 nf_hook include/linux/netfilter.h:257 [inline] NF_HOOK+0x21d/0x340 include/linux/netfilter.h:300 br_handle_frame_finish+0x1035/0x12c0 net/bridge/br_input.c:186 br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:-1 [inline] br_nf_pre_routing_finish+0x12c6/0x1d50 net/bridge/br_netfilter_hooks.c:429 NF_HOOK+0x590/0x610 include/linux/netfilter.h:302 br_nf_pre_routing+0xdc3/0x1390 net/bridge/br_netfilter_hooks.c:538 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_bridge_pre net/bridge/br_input.c:242 [inline] br_handle_frame+0x89b/0x1180 net/bridge/br_input.c:384 __netif_receive_skb_core+0xfb0/0x35d0 net/core/dev.c:5419 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5639 netif_receive_skb_internal net/core/dev.c:5725 [inline] netif_receive_skb+0x19e/0x6c0 net/core/dev.c:5784 tun_rx_batched+0x5a1/0x6d0 drivers/net/tun.c:-1 tun_get_user+0x23f0/0x38d0 drivers/net/tun.c:1989 tun_chr_write_iter+0x112/0x1e0 drivers/net/tun.c:2019 call_write_iter include/linux/fs.h:2172 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x712/0xd00 fs/read_write.c:594 ksys_write+0x14d/0x250 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fb229eef41f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007fb227d58000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fb22a117fa0 RCX: 00007fb229eef41f RDX: 000000000000002a RSI: 00002000000002c0 RDI: 00000000000000c8 RBP: 00007fb229f72ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000002a R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fb22a117fa0 R15: 00007fffa5e78b28