el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4509 at net/sched/act_ct.c:433 tcf_ct_flow_table_add net/sched/act_ct.c:433 [inline]
WARNING: CPU: 1 PID: 4509 at net/sched/act_ct.c:433 tcf_ct_flow_table_process_conn+0x38c/0x73c net/sched/act_ct.c:509
Modules linked in:
CPU: 1 PID: 4509 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : tcf_ct_flow_table_add net/sched/act_ct.c:433 [inline]
pc : tcf_ct_flow_table_process_conn+0x38c/0x73c net/sched/act_ct.c:509
lr : tcf_ct_flow_table_add net/sched/act_ct.c:433 [inline]
lr : tcf_ct_flow_table_process_conn+0x38c/0x73c net/sched/act_ct.c:509
sp : ffff800020f26fc0
x29: ffff800020f26fc0 x28: 0000000000000003 x27: 0000000000000000
x26: 0000000000000000 x25: dfff800000000000 x24: 1fffe0001ac202be
x23: ffff0000d61015f0 x22: 0000000000000008 x21: ffff0000d61015c0
x20: ffff0000d6101500 x19: ffff0000d6872800 x18: 000000006b3df0d0
x17: 0000000000000000 x16: ffff800011ba0e90 x15: 0000000000000000
x14: 0000000000000001 x13: 1ffff00002acb002 x12: 0000000000000000
x11: ff0080001010aaa0 x10: 0000000000000000 x9 : ffff80001010aaa0
x8 : ffff0000def75400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : 00000000ffffffff x4 : 0000000000000b20 x3 : 0000000000000b20
x2 : 00000000000000d8 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 tcf_ct_flow_table_add net/sched/act_ct.c:433 [inline]
 tcf_ct_flow_table_process_conn+0x38c/0x73c net/sched/act_ct.c:509
 tcf_ct_act+0x2ac8/0x4000 net/sched/act_ct.c:1253
 tcf_action_exec+0x164/0x544 net/sched/act_api.c:1098
 tcf_exts_exec include/net/pkt_cls.h:351 [inline]
 basic_classify+0x1ec/0x314 net/sched/cls_basic.c:52
 __tcf_classify net/sched/cls_api.c:1569 [inline]
 tcf_classify+0x1b4/0x9d4 net/sched/cls_api.c:1635
 sch_handle_ingress net/core/dev.c:5261 [inline]
 __netif_receive_skb_core+0x17b0/0x31a0 net/core/dev.c:5479
 __netif_receive_skb_one_core net/core/dev.c:5617 [inline]
 __netif_receive_skb+0x78/0x2b0 net/core/dev.c:5733
 netif_receive_skb_internal net/core/dev.c:5819 [inline]
 netif_receive_skb+0x1e8/0x928 net/core/dev.c:5878
 tun_rx_batched+0x4ac/0x600 drivers/net/tun.c:-1
 tun_get_user+0x1f94/0x32a8 drivers/net/tun.c:1998
 tun_chr_write_iter+0xfc/0x200 drivers/net/tun.c:2044
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3069
hardirqs last  enabled at (3068): [<ffff800011b9f074>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (3068): [<ffff800011b9f074>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (3069): [<ffff800011b9d0cc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3032): [<ffff80000c8df060>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (3034): [<ffff80000c8df02c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---