------------[ cut here ]------------
WARNING: net/mptcp/subflow.c:1527 at subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527, CPU#0: kworker/u8:1/13
Modules linked in:
CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: krdsd rds_send_worker
RIP: 0010:subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527
Code: 89 ee e8 38 a9 6a f6 40 84 ed 75 21 e8 de ae 6a f6 44 89 fe bf 07 00 00 00 e8 81 a9 6a f6 41 83 ff 07 74 09 e8 c6 ae 6a f6 90 <0f> 0b 90 e8 bd ae 6a f6 48 89 df e8 35 ae ff ff 31 ff 89 c5 89 c6
RSP: 0018:ffffc900000069e8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888055d24f80 RCX: ffffffff8b538aef
RDX: ffff88801de80000 RSI: ffffffff8b538afa RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000004 R11: 0000000061379a64 R12: ffff888032424b00
R13: 1ffff92000000d3d R14: ffff88807a69f800 R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff888124956000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0a457e6080 CR3: 000000004edf1000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 tcp_data_ready+0x114/0x5a0 net/ipv4/tcp_input.c:5371
 tcp_data_queue+0x1aa6/0x5000 net/ipv4/tcp_input.c:5461
 tcp_rcv_state_process+0xfb6/0x6490 net/ipv4/tcp_input.c:7185
 tcp_v6_do_rcv+0x7b8/0x1dc0 net/ipv6/tcp_ipv6.c:1630
 tcp_v6_rcv+0x2ab5/0x48f0 net/ipv6/tcp_ipv6.c:1877
 ip6_protocol_deliver_rcu+0x188/0x1520 net/ipv6/ip6_input.c:438
 ip6_input_finish+0x1e4/0x4b0 net/ipv6/ip6_input.c:489
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:500
 dst_input include/net/dst.h:474 [inline]
 ip6_rcv_finish+0x1ac/0x580 net/ipv6/ip6_input.c:79
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xbe/0x200 net/netfilter/core.c:623
 nf_hook.constprop.0+0x424/0x750 include/linux/netfilter.h:273
 NF_HOOK include/linux/netfilter.h:316 [inline]
 ipv6_rcv+0xa4/0x650 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6137
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6250
 netif_receive_skb_internal net/core/dev.c:6336 [inline]
 netif_receive_skb+0x137/0x760 net/core/dev.c:6395
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0x12fe/0x1f00 net/bridge/br_input.c:222
 br_nf_hook_thresh+0x307/0x410 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x76a/0xfc0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x3cd/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xb28/0x14e0 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0x6b3/0x35b0 net/core/dev.c:6024
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6135
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6250
 process_backlog+0x4a2/0x1650 net/core/dev.c:6602
 __napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7666
 napi_poll net/core/dev.c:7729 [inline]
 net_rx_action+0x9f9/0xfa0 net/core/dev.c:7881
 handle_softirqs+0x219/0x8b0 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline]
 __dev_queue_xmit+0x797/0x4650 net/core/dev.c:4844
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 neigh_resolve_output net/core/neighbour.c:1594 [inline]
 neigh_resolve_output+0x53a/0x940 net/core/neighbour.c:1574
 neigh_output include/net/neighbour.h:556 [inline]
 ip6_finish_output2+0xad1/0x1cf0 net/ipv6/ip6_output.c:136
 __ip6_finish_output+0x3cd/0x1010 net/ipv6/ip6_output.c:209
 ip6_finish_output net/ipv6/ip6_output.c:220 [inline]
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x253/0x710 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:464 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ip6_xmit+0x1512/0x23f0 net/ipv6/ip6_output.c:371
 inet6_csk_xmit+0x444/0x7f0 net/ipv6/inet6_connection_sock.c:120
 __tcp_transmit_skb+0x1d67/0x48b0 net/ipv4/tcp_output.c:1631
 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]
 tcp_write_xmit+0x12a9/0x86e0 net/ipv4/tcp_output.c:3002
 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3185
 tcp_push+0x225/0x700 net/ipv4/tcp.c:775
 tcp_sendmsg_locked+0x18a0/0x42a0 net/ipv4/tcp.c:1375
 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1412
 inet6_sendmsg+0xb9/0x140 net/ipv6/af_inet6.c:659
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 sock_sendmsg+0x2b3/0x470 net/socket.c:765
 rds_tcp_xmit+0x352/0xc40 net/rds/tcp_send.c:125
 rds_send_xmit+0xfa0/0x25c0 net/rds/send.c:366
 rds_send_worker+0x8f/0x2e0 net/rds/threads.c:200
 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>