------------[ cut here ]------------
WARNING: CPU: 1 PID: 10603 at net/mptcp/subflow.c:1519 subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1519
Modules linked in:
CPU: 1 UID: 0 PID: 10603 Comm: syz.1.975 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1519
Code: 89 ee e8 a8 cb 72 f6 40 84 ed 75 21 e8 be d0 72 f6 44 89 fe bf 07 00 00 00 e8 f1 cb 72 f6 41 83 ff 07 74 09 e8 a6 d0 72 f6 90 <0f> 0b 90 e8 9d d0 72 f6 48 89 df e8 e5 ad ff ff 31 ff 89 c5 89 c6
RSP: 0018:ffffc90000a08550 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888025ca5940 RCX: ffffffff8b4986df
RDX: ffff8880283e5ac0 RSI: ffffffff8b4986ea RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000004 R11: 00000028000000f0 R12: ffff888041b18c00
R13: 1ffff920001410aa R14: ffff88805c6f1c00 R15: 0000000000000004
FS: 0000000000000000(0000) GS:ffff888124b0d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31103a98 CR3: 000000003156c000 CR4: 00000000003526f0
Call Trace:
tcp_data_ready+0x110/0x550 net/ipv4/tcp_input.c:5355
tcp_data_queue+0x1aa6/0x5000 net/ipv4/tcp_input.c:5445
tcp_rcv_state_process+0xfb6/0x6490 net/ipv4/tcp_input.c:7159
tcp_v4_do_rcv+0x68e/0x10a0 net/ipv4/tcp_ipv4.c:1954
tcp_v4_rcv+0x3077/0x4db0 net/ipv4/tcp_ipv4.c:2374
ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x3f2/0x720 net/ipv4/ip_input.c:239
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:260
dst_input include/net/dst.h:474 [inline]
ip_rcv_finish net/ipv4/ip_input.c:453 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_rcv+0x2e0/0x600 net/ipv4/ip_input.c:573
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6079
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
process_backlog+0x439/0x15e0 net/core/dev.c:6544
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x97f/0xef0 net/core/dev.c:7784
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
common_interrupt+0xbf/0xe0 arch/x86/kernel/irq.c:318
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7256
Code: df 55 65 48 8b 2d ac 32 42 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 cf 1f 2a f6 e8 ea 5a 65 f6 fb bf 01 00 00 00 af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 bd aa 29
RSP: 0018:ffffc900194d6718 EFLAGS: 00000202
RAX: 0000000000022e61 RBX: ffffed100507cb58 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8da29682 RDI: 0000000000000001
RBP: ffff8880283e5ac0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff908253d7 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
irqentry_exit+0x36/0x90 kernel/entry/common.c:211
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5872
Code: dd 08 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 a2 00 ea 0e 0f 82 74 02 00 00 8b 35 fa 30 ea 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 b9 dc 08 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc900194d67e0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e58a2e0 RCX: ffffffff93adf660
RDX: 0000000000000000 RSI: ffffffff8da03cd1 RDI: ffffffff8bf07940
RBP: 0000000000000000 R08: ce141928764d200e R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
fs_reclaim_acquire mm/page_alloc.c:4281 [inline]
fs_reclaim_acquire+0xca/0x150 mm/page_alloc.c:4272
might_alloc include/linux/sched/mm.h:318 [inline]
prepare_alloc_pages+0x162/0x610 mm/page_alloc.c:4946
__alloc_frozen_pages_noprof+0x18b/0x2470 mm/page_alloc.c:5167
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2435
shmem_alloc_folio+0x135/0x160 mm/shmem.c:1870
shmem_alloc_and_add_folio+0x494/0xc20 mm/shmem.c:1912
shmem_get_folio_gfp+0x67f/0x1610 mm/shmem.c:2535
shmem_get_folio mm/shmem.c:2641 [inline]
shmem_write_begin+0x160/0x300 mm/shmem.c:3291
generic_perform_write+0x3c4/0x900 mm/filemap.c:4255
shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3466
__kernel_write_iter+0x31a/0xb10 fs/read_write.c:619
dump_emit_page fs/coredump.c:1298 [inline]
dump_user_range+0x413/0xb70 fs/coredump.c:1372
elf_core_dump+0x29c3/0x3c00 fs/binfmt_elf.c:2111
coredump_write fs/coredump.c:1049 [inline]
vfs_coredump+0x2b9f/0x5670 fs/coredump.c:1170
get_signal+0x22e1/0x26d0 kernel/signal.c:3019
arch_do_signal_or_restart+0x8f/0x790 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:40 [inline]
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
irqentry_exit_to_user_mode+0x176/0x310 kernel/entry/common.c:73
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fa2c8c4f6b7
Code: 88 15 42 60 ec 00 88 05 3f 60 ec 00 c3 50 48 8d 35 e9 48 1c 00 48 8d 3d ef 48 1c 00 31 c0 e8 20 f7 ff ff 53 89 fb 48 83 ec 10 <64> 8b 04 25 94 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8
RSP: 002b:00007fa2c9b610e0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 0003ffff00000000
RDX: 00007fa2c9b61100 RSI: 00007fa2c9b61230 RDI: 000000000000000b
RBP: 00007fa2c8e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fa2c8fe6218 R14: 00007fa2c8fe6180 R15: 00007fff44e4afc8
----------------
Code disassembly (best guess):
0: df 55 65 fists 0x65(%rbp)
3: 48 8b 2d ac 32 42 08 mov 0x84232ac(%rip),%rbp # 0x84232b6
a: 53 push %rbx
b: 48 89 eb mov %rbp,%rbx
e: 48 c1 eb 03 shr $0x3,%rbx
12: 48 01 c3 add %rax,%rbx
15: bf 01 00 00 00 mov $0x1,%edi
1a: e8 cf 1f 2a f6 call 0xf62a1fee
1f: e8 ea 5a 65 f6 call 0xf6655b0e
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 af 99 ff ff call 0xffff99de <-- trapping instruction
2f: 9c pushf
30: 58 pop %rax
31: fa cli
32: f6 c4 02 test $0x2,%ah
35: 75 1e jne 0x55
37: bf 01 00 00 00 mov $0x1,%edi
3c: e8 .byte 0xe8
3d: bd .byte 0xbd
3e: aa stos %al,%es:(%rdi)
3f: 29 .byte 0x29