------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(!irqs_disabled())
WARNING: CPU: 0 PID: 5707 at kernel/locking/lockdep.c:150 lockdep_unlock+0x1e6/0x300 kernel/locking/lockdep.c:150
Modules linked in:
CPU: 0 PID: 5707 Comm: syz-executor.3 Not tainted 6.8.0-syzkaller-05236-g443574b03387 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:lockdep_unlock+0x1e6/0x300 kernel/locking/lockdep.c:150
Code: 0f b6 04 30 84 c0 0f 85 e4 00 00 00 83 3d 61 90 15 0e 00 75 19 90 48 c7 c7 c0 c0 aa 8b 48 c7 c6 00 c1 aa 8b e8 2b 78 e6 ff 90 <0f> 0b 90 90 90 e9 d2 fe ff ff 90 e8 8a a5 2f 03 85 c0 74 3a 48 c7
RSP: 0018:ffffc90005be6940 EFLAGS: 00010246
RAX: 5d56209e0ed73700 RBX: 1ffff92000b7cd2c RCX: 0000000000040000
RDX: ffffc900052e1000 RSI: 000000000000a141 RDI: 000000000000a142
RBP: ffffc90005be69d0 R08: ffffffff8157cc12 R09: 1ffff92000b7cc7c
R10: dffffc0000000000 R11: fffff52000b7cc7d R12: 1ffff92000b7cd28
R13: ffff88805c9f8b20 R14: dffffc0000000000 R15: ffffc90005be6960
FS:  00007f7398f146c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020010000 CR3: 00000000604aa000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 graph_unlock kernel/locking/lockdep.c:186 [inline]
 validate_chain+0x15a2/0x58e0 kernel/locking/lockdep.c:3873
 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378
 raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559
 raw_spin_rq_lock kernel/sched/sched.h:1385 [inline]
 rq_lock kernel/sched/sched.h:1699 [inline]
 __schedule+0x354/0x4a20 kernel/sched/core.c:6652
 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7058
 irqentry_exit+0x5e/0x90 kernel/entry/common.c:348
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__skb_flow_dissect+0x5bc/0x7d00 net/core/flow_dissector.c:1096
Code: 06 00 00 e8 26 55 51 f8 48 83 c3 30 e8 ad 5e 2c 02 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 87 9c b4 f8 4c 8b 2b <4d> 85 ed 0f 85 18 ff ff ff e8 f6 54 51 f8 e9 a3 06 00 00 e8 ec 54
RSP: 0018:ffffc90005be7340 EFLAGS: 00000246
RAX: 1ffff11005985822 RBX: ffff88802cc2c110 RCX: ffff88805c9f8000
RDX: ffffc900052e1000 RSI: 0000000000003789 RDI: 000000000000378a
RBP: ffffc90005be7978 R08: ffffffff8943980d R09: 0000000000000000
R10: ffffc90005be7aa0 R11: fffff52000b7cf55 R12: dffffc0000000000
R13: ffff888024273980 R14: ffffffff8f871d62 R15: ffffffff8f871d58
 skb_flow_dissect_flow_keys_basic include/linux/skbuff.h:1558 [inline]
 skb_probe_transport_header include/linux/skbuff.h:3024 [inline]
 tun_get_user+0x2571/0x4540 drivers/net/tun.c:1913
 tun_chr_write_iter+0x113/0x1f0 drivers/net/tun.c:2048
 call_write_iter include/linux/fs.h:2108 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0xa84/0xcb0 fs/read_write.c:590
 ksys_write+0x1a0/0x2c0 fs/read_write.c:643
 do_syscall_64+0xfb/0x240
 entry_SYSCALL_64_after_hwframe+0x6d/0x75
RIP: 0033:0x7f739827dea9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7398f140c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f73983ac050 RCX: 00007f739827dea9
RDX: 000000000000ffbf RSI: 0000000020000180 RDI: 0000000000000003
RBP: 00007f73982ca4a4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f73983ac050 R15: 00007fffa2f5b768
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	e8 26 55 51 f8       	call   0xf851552d
   7:	48 83 c3 30          	add    $0x30,%rbx
   b:	e8 ad 5e 2c 02       	call   0x22c5ebd
  10:	48 89 d8             	mov    %rbx,%rax
  13:	48 c1 e8 03          	shr    $0x3,%rax
  17:	42 80 3c 20 00       	cmpb   $0x0,(%rax,%r12,1)
  1c:	74 08                	je     0x26
  1e:	48 89 df             	mov    %rbx,%rdi
  21:	e8 87 9c b4 f8       	call   0xf8b49cad
  26:	4c 8b 2b             	mov    (%rbx),%r13
* 29:	4d 85 ed             	test   %r13,%r13 <-- trapping instruction
  2c:	0f 85 18 ff ff ff    	jne    0xffffff4a
  32:	e8 f6 54 51 f8       	call   0xf851552d
  37:	e9 a3 06 00 00       	jmp    0x6df
  3c:	e8                   	.byte 0xe8
  3d:	ec                   	in     (%dx),%al
  3e:	54                   	push   %rsp