------------[ cut here ]------------
WARNING: CPU: 0 PID: 2936 at net/mptcp/subflow.c:1519 subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1519
Modules linked in:
CPU: 0 UID: 0 PID: 2936 Comm: syz.6.4026 Tainted: G U W L XTNJ syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1519
Code: 89 ee e8 a8 cb 72 f6 40 84 ed 75 21 e8 be d0 72 f6 44 89 fe bf 07 00 00 00 e8 f1 cb 72 f6 41 83 ff 07 74 09 e8 a6 d0 72 f6 90 <0f> 0b 90 e8 9d d0 72 f6 48 89 df e8 e5 ad ff ff 31 ff 89 c5 89 c6
RSP: 0018:ffffc90000007550 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888091cab300 RCX: ffffffff8b4986df
RDX: ffff88802ad61e40 RSI: ffffffff8b4986ea RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000004 R11: 0000000000000001 R12: ffff88807fafc800
R13: 1ffff92000000eaa R14: ffff8880314b2c00 R15: 0000000000000004
FS: 00007fd3a83406c0(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3414264f98 CR3: 0000000060470000 CR4: 00000000003526f0
Call Trace:
tcp_data_ready+0x110/0x550 net/ipv4/tcp_input.c:5355
tcp_data_queue+0x1aa6/0x5000 net/ipv4/tcp_input.c:5445
tcp_rcv_state_process+0xfb6/0x6490 net/ipv4/tcp_input.c:7159
tcp_v4_do_rcv+0x68e/0x10a0 net/ipv4/tcp_ipv4.c:1954
tcp_v4_rcv+0x3077/0x4db0 net/ipv4/tcp_ipv4.c:2374
ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x3f2/0x720 net/ipv4/ip_input.c:239
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:260
dst_input include/net/dst.h:474 [inline]
ip_rcv_finish net/ipv4/ip_input.c:453 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_rcv+0x2e0/0x600 net/ipv4/ip_input.c:573
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6079
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
process_backlog+0x439/0x15e0 net/core/dev.c:6544
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x97f/0xef0 net/core/dev.c:7784
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_read_unlock_sched include/linux/rcupdate.h:981 [inline]
RIP: 0010:pfn_valid+0x26f/0x4d0 include/linux/mmzone.h:2197
Code: ff 89 c3 89 c6 e8 81 b3 8c ff 85 db 0f 85 b6 01 00 00 e8 34 b8 8c ff 48 c7 c7 20 45 3c 8e 48 8d 35 00 00 00 00 e8 c1 ac 68 ff 01 00 00 00 e8 e7 08 59 ff 31 ff 65 8b 1d ae 90 71 11 89 de e8
RSP: 0018:ffffc9000b776938 EFLAGS: 00000282
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffc9000b7768fc
RDX: 0000000000000006 RSI: ffffffff8da03cc9 RDI: ffffffff8bf07940
RBP: ffff88813fffa540 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000008 R14: dffffc0000000000 R15: 0000000000000000
page_table_check_set+0x25/0x750 mm/page_table_check.c:105
__page_table_check_ptes_set+0x318/0x420 mm/page_table_check.c:209
page_table_check_ptes_set include/linux/page_table_check.h:76 [inline]
set_ptes include/linux/pgtable.h:292 [inline]
set_pte_range+0x4e8/0x740 mm/memory.c:5444
filemap_map_order0_folio mm/filemap.c:3796 [inline]
filemap_map_pages+0x6af/0x1e30 mm/filemap.c:3861
do_fault_around mm/memory.c:5674 [inline]
do_read_fault mm/memory.c:5707 [inline]
do_fault mm/memory.c:5850 [inline]
do_pte_missing+0xe33/0x3ba0 mm/memory.c:4362
handle_pte_fault mm/memory.c:6195 [inline]
__handle_mm_fault+0x1556/0x2aa0 mm/memory.c:6336
handle_mm_fault+0x589/0xd10 mm/memory.c:6505
faultin_page mm/gup.c:1126 [inline]
__get_user_pages+0x54e/0x3530 mm/gup.c:1428
__get_user_pages_locked mm/gup.c:1692 [inline]
get_dump_page+0x257/0x3d0 mm/gup.c:2192
dump_user_range+0x195/0xb70 fs/coredump.c:1366
elf_core_dump+0x29c3/0x3c00 fs/binfmt_elf.c:2111
coredump_write fs/coredump.c:1049 [inline]
vfs_coredump+0x2b9f/0x5670 fs/coredump.c:1170
get_signal+0x22e1/0x26d0 kernel/signal.c:3019
arch_do_signal_or_restart+0x8f/0x790 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:40 [inline]
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
irqentry_exit_to_user_mode+0x176/0x310 kernel/entry/common.c:73
asm_exc_general_protection+0x26/0x30 arch/x86/include/asm/idtentry.h:612
RIP: 0033:0x7fd3a758f7d1
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:0000200000000210 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fd3a77e6180 RCX: 00007fd3a758f7c9
RDX: 0000200000000240 RSI: 0000200000000210 RDI: 0000000028000000
RBP: 00007fd3a7613f91 R08: 0000200000000880 R09: 0000200000000880
R10: 0000200000000280 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fd3a77e6218 R14: 00007fd3a77e6180 R15: 00007ffdd89d58b8
----------------
Code disassembly (best guess):
0: ff 89 c3 89 c6 e8 decl -0x1739763d(%rcx)
6: 81 b3 8c ff 85 db 0f xorl $0x1b6850f,-0x247a0074(%rbx)
d: 85 b6 01
10: 00 00 add %al,(%rax)
12: e8 34 b8 8c ff call 0xff8cb84b
17: 48 c7 c7 20 45 3c 8e mov $0xffffffff8e3c4520,%rdi
1e: 48 8d 35 00 00 00 00 lea 0x0(%rip),%rsi # 0x25
25: e8 c1 ac 68 ff call 0xff68aceb
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 e7 08 59 ff call 0xff59091b
34: 31 ff xor %edi,%edi
36: 65 8b 1d ae 90 71 11 mov %gs:0x117190ae(%rip),%ebx # 0x117190eb
3d: 89 de mov %ebx,%esi
3f: e8 .byte 0xe8