csum(0x0 start=0 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0)
hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0
priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8 at net/core/skbuff.c:1126 skb_release_data+0x993/0xba0 net/core/skbuff.c:1126
Modules linked in:
CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.13.0-rc3-syzkaller-00017-gf44d154d6e3d-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Workqueue: events mptcp_worker
RIP: 0010:skb_release_data+0x993/0xba0 net/core/skbuff.c:1126
Code: f8 48 89 ea e9 25 f7 ff ff 44 89 f9 80 e1 07 38 c1 0f 8c 60 fe ff ff 4c 89 ff e8 e8 2c 79 f8 e9 53 fe ff ff e8 be c4 12 f8 90 <0f> 0b 90 e9 08 fb ff ff 44 89 f9 80 e1 07 38 c1 0f 8c 25 fd ff ff
RSP: 0018:ffffc90000006d78 EFLAGS: 00010246
RAX: ffffffff898caf32 RBX: 0000000000000000 RCX: ffff88801cabda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff1100c64214e R08: ffffffff898cae6f R09: fffffbfff1cfa210
R10: dffffc0000000000 R11: fffffbfff1cfa210 R12: ffff88807ecba700
R13: ffff88807ecba840 R14: ffff888063210a74 R15: ffff888063210a7e
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00a90a020 CR3: 00000000636ba000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 skb_release_all net/core/skbuff.c:1200 [inline]
 __kfree_skb+0x55/0x70 net/core/skbuff.c:1214
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3436 [inline]
 tcp_ack+0x2442/0x6bc0 net/ipv4/tcp_input.c:4032
 tcp_rcv_state_process+0x8eb/0x44e0 net/ipv4/tcp_input.c:6805
 tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1939
 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2351
 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233
 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
 __netif_receive_skb_one_core net/core/dev.c:5672 [inline]
 __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5785
 process_backlog+0x662/0x15b0 net/core/dev.c:6117
 __napi_poll+0xcb/0x490 net/core/dev.c:6883
 napi_poll net/core/dev.c:6952 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7074
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:queue_work_on+0x269/0x380 kernel/workqueue.c:2395
Code: 75 19 e8 1a fc 37 00 eb 18 e8 13 fc 37 00 e8 4e 02 61 0a 48 83 7c 24 10 00 74 e7 e8 01 fc 37 00 fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 04 37 00 00 00 00 43 c7 44 37 09 00 00 00 00 66 43 c7 44 37
RSP: 0018:ffffc900000d72a0 EFLAGS: 00000293
RAX: ffffffff816777ef RBX: 0000000000000000 RCX: ffff88801cabda00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900000d7390 R08: ffffffff816777bf R09: 1ffffffff285432d
R10: dffffc0000000000 R11: fffffbfff285432e R12: 0000000000800001
R13: 0000000000000046 R14: 1ffff9200001ae58 R15: dffffc0000000000
 queue_work include/linux/workqueue.h:662 [inline]
 schedule_work include/linux/workqueue.h:723 [inline]
 mptcp_schedule_work+0x14a/0x280 net/mptcp/protocol.c:942
 subflow_sched_work_if_closed net/mptcp/subflow.c:1286 [inline]
 subflow_check_data_avail net/mptcp/subflow.c:1376 [inline]
 mptcp_subflow_data_available+0x3e35/0x4410 net/mptcp/subflow.c:1442
 subflow_state_change+0x670/0xd20 net/mptcp/subflow.c:1870
 tcp_rcv_state_process+0xeab/0x44e0 net/ipv4/tcp_input.c:6933
 tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1939
 sk_backlog_rcv include/net/sock.h:1121 [inline]
 __release_sock+0x214/0x350 net/core/sock.c:3083
 release_sock+0x61/0x1f0 net/core/sock.c:3637
 __mptcp_close_ssk+0x6ad/0x1080 net/mptcp/protocol.c:2479
 __mptcp_close_subflow net/mptcp/protocol.c:2577 [inline]
 mptcp_worker+0x807/0x1440 net/mptcp/protocol.c:2790
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	75 19                	jne    0x1b
   2:	e8 1a fc 37 00       	call   0x37fc21
   7:	eb 18                	jmp    0x21
   9:	e8 13 fc 37 00       	call   0x37fc21
   e:	e8 4e 02 61 0a       	call   0xa610261
  13:	48 83 7c 24 10 00    	cmpq   $0x0,0x10(%rsp)
  19:	74 e7                	je     0x2
  1b:	e8 01 fc 37 00       	call   0x37fc21
  20:	fb                   	sti
  21:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  28:	e0 45
* 2a:	4b c7 04 37 00 00 00 	movq   $0x0,(%r15,%r14,1) <-- trapping instruction
  31:	00
  32:	43 c7 44 37 09 00 00 	movl   $0x0,0x9(%r15,%r14,1)
  39:	00 00
  3b:	66                   	data16
  3c:	43                   	rex.XB
  3d:	c7                   	.byte 0xc7
  3e:	44 37                	rex.R (bad)