------------[ cut here ]------------ WARNING: CPU: 0 PID: 13328 at net/mptcp/subflow.c:1516 subflow_data_ready+0x4b8/0x7e0 net/mptcp/subflow.c:1515 Modules linked in: CPU: 0 UID: 0 PID: 13328 Comm: syz.5.1824 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:subflow_data_ready+0x4b8/0x7e0 net/mptcp/subflow.c:1515 Code: 0f 0b 90 90 e9 bc fc ff ff e8 34 61 59 f6 48 89 df 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 6e 0e 00 00 e8 19 61 59 f6 90 <0f> 0b 90 e9 e5 fd ff ff 90 0f 0b 90 43 0f b6 04 2f 84 c0 0f 85 a1 RSP: 0018:ffffc9000c2c7440 EFLAGS: 00010287 RAX: ffffffff8b664a77 RBX: ffff88805547e600 RCX: 0000000000080000 RDX: ffffc9001e604000 RSI: 0000000000000bbc RDI: 0000000000000bbd RBP: 0000000000000000 R08: ffff88803b17dd2f R09: 1ffff1100762fba5 R10: dffffc0000000000 R11: ffffed100762fba6 R12: 0000000000000000 R13: dffffc0000000000 R14: ffff88803b17d400 R15: 0000000000000000 FS: 00007f64d2dd56c0(0000) GS:ffff888125c14000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2eb24220 CR3: 0000000055d36000 CR4: 00000000003526f0 Call Trace: tcp_data_queue+0x54b/0x6380 net/ipv4/tcp_input.c:5197 tcp_rcv_state_process+0x2767/0x4140 net/ipv4/tcp_input.c:6922 tcp_v4_do_rcv+0x3f2/0xce0 net/ipv4/tcp_ipv4.c:1947 sk_backlog_rcv include/net/sock.h:1157 [inline] __release_sock+0x21c/0x350 net/core/sock.c:3201 __tcp_close+0x6c5/0xde0 net/ipv4/tcp.c:3196 __mptcp_close_ssk+0x3d7/0xfd0 net/mptcp/protocol.c:2425 mptcp_destroy_common+0x152/0x320 net/mptcp/protocol.c:3350 mptcp_destroy+0x84/0x120 net/mptcp/protocol.c:3368 __mptcp_destroy_sock+0x153/0x350 net/mptcp/protocol.c:2993 __mptcp_close+0x76a/0xb00 net/mptcp/protocol.c:3094 mptcp_close+0x28/0x1a0 net/mptcp/protocol.c:3109 inet_release+0x141/0x190 net/ipv4/af_inet.c:435 __sock_release net/socket.c:649 [inline] sock_close+0xc3/0x240 net/socket.c:1439 __fput+0x449/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 get_signal+0x11ed/0x1340 kernel/signal.c:2807 arch_do_signal_or_restart+0x9a/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x75/0x110 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f64d4b8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f64d2dd5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: fffffffffffffe00 RBX: 00007f64d4dc6180 RCX: 00007f64d4b8ebe9 RDX: 0000000000000001 RSI: 0000200000002300 RDI: 0000000000000005 RBP: 00007f64d4c11e19 R08: 0000000000000000 R09: 0000000000000000 R10: 000000002000c000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f64d4dc6218 R14: 00007f64d4dc6180 R15: 00007ffc82814b28