------------[ cut here ]------------
WARNING: net/mptcp/subflow.c:1527 at subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527, CPU#0: syz.3.742/9601
Modules linked in:
CPU: 0 UID: 0 PID: 9601 Comm: syz.3.742 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:subflow_data_ready+0x40b/0x790 net/mptcp/subflow.c:1527
Code: 89 ee e8 58 7f 69 f6 40 84 ed 75 21 e8 fe 84 69 f6 44 89 fe bf 07 00 00 00 e8 a1 7f 69 f6 41 83 ff 07 74 09 e8 e6 84 69 f6 90 <0f> 0b 90 e8 dd 84 69 f6 48 89 df e8 35 ae ff ff 31 ff 89 c5 89 c6
RSP: 0018:ffffc90000007548 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888057a7e600 RCX: ffffffff8b54bfcf
RDX: ffff88801d721e80 RSI: ffffffff8b54bfda RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
R10: 0000000000000004 R11: ffff88801d7229b0 R12: ffff888078970000
R13: 1ffff92000000ea9 R14: ffff88805899e000 R15: 0000000000000004
FS: 00007f2ff69e76c0(0000) GS:ffff888124947000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000c00000 CR3: 00000000771e6000 CR4: 00000000003526f0
Call Trace:
tcp_data_ready+0x114/0x5a0 net/ipv4/tcp_input.c:5371
tcp_data_queue+0x1aa6/0x5000 net/ipv4/tcp_input.c:5461
tcp_rcv_state_process+0xfb6/0x6490 net/ipv4/tcp_input.c:7185
tcp_v4_do_rcv+0x68e/0x10a0 net/ipv4/tcp_ipv4.c:1904
tcp_v4_rcv+0x3077/0x4db0 net/ipv4/tcp_ipv4.c:2324
ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3f2/0x720 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:474 [inline]
ip_rcv_finish net/ipv4/ip_input.c:453 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ip_rcv+0x2e0/0x600 net/ipv4/ip_input.c:573
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6250
process_backlog+0x4a2/0x1650 net/core/dev.c:6602
__napi_poll.constprop.0+0xb3/0x540 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x9f9/0xfa0 net/core/dev.c:7881
handle_softirqs+0x219/0x950 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:debug_lockdep_rcu_enabled+0x0/0x40 kernel/rcu/update.c:319
Code: 00 00 00 eb b6 e8 80 fa ff ff eb b6 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 8b 05 66 e6 1e 05 85 c0 74 20 8b 05 f0 15 1f 05 85 c0
RSP: 0018:ffffc900038a70d0 EFLAGS: 00000287
RAX: ffffc900038a8001 RBX: ffffc900038a7b00 RCX: ffffc900038a8001
RDX: ffffc900038a7b08 RSI: ffffc900038a7ad0 RDI: ffffc900038a7158
RBP: 0000000000000001 R08: 0000000000000001 R09: 000000000f5f7a5a
R10: 0000000000000002 R11: 00000000000101ae R12: ffffc900038a7198
R13: ffffc900038a7148 R14: ffffc900038a7b00 R15: ffffc900038a717c
rcu_read_unlock include/linux/rcupdate.h:895 [inline]
class_rcu_destructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0x3de/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x160/0x1f0 mm/page_owner.c:165
__set_page_owner+0x91/0x560 mm/page_owner.c:341
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1af/0x220 mm/page_alloc.c:1846
prep_new_page mm/page_alloc.c:1854 [inline]
get_page_from_freelist+0xd0b/0x31a0 mm/page_alloc.c:3915
__alloc_frozen_pages_noprof+0x25f/0x2430 mm/page_alloc.c:5210
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2486
folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2505
shmem_alloc_folio+0x135/0x160 mm/shmem.c:1888
shmem_alloc_and_add_folio+0x494/0xc20 mm/shmem.c:1930
shmem_get_folio_gfp+0x67f/0x1610 mm/shmem.c:2554
shmem_get_folio mm/shmem.c:2660 [inline]
shmem_write_begin+0x160/0x300 mm/shmem.c:3309
generic_perform_write+0x3c4/0x900 mm/filemap.c:4314
shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3484
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x7d3/0x11d0 fs/read_write.c:686
ksys_write+0x12a/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2ff5b8f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2ff69e7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f2ff5de5fa0 RCX: 00007f2ff5b8f7c9
RDX: 0000000040000001 RSI: 0000200000000280 RDI: 0000000000000003
RBP: 00007f2ff5c13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ff5de6038 R14: 00007f2ff5de5fa0 R15: 00007ffd38efbe28
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: eb b6 jmp 0xffffffba
4: e8 80 fa ff ff call 0xfffffa89
9: eb b6 jmp 0xffffffc1
b: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
12: 00 00 00
15: 0f 1f 40 00 nopl 0x0(%rax)
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 90 nop
21: 90 nop
22: 90 nop
23: 90 nop
24: 90 nop
25: 90 nop
26: 90 nop
27: 90 nop
28: 90 nop
* 29: f3 0f 1e fa endbr64 <-- trapping instruction
2d: 8b 05 66 e6 1e 05 mov 0x51ee666(%rip),%eax # 0x51ee699
33: 85 c0 test %eax,%eax
35: 74 20 je 0x57
37: 8b 05 f0 15 1f 05 mov 0x51f15f0(%rip),%eax # 0x51f162d
3d: 85 c0 test %eax,%eax