[v6.1] WARNING in __skb_flow_dissect

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bec0e10ee67e Linux 6.1.160
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=12ca3522580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b1adc0bfde2d8a4a
dashboard link: https://syzkaller.appspot.com/bug?extid=84112fa28f0a5cc0669f
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3a7476c8fb99/disk-bec0e10e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c8b56f72bf90/vmlinux-bec0e10e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/70f5a07b826a/Image-bec0e10e.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+84112f...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 10767 at net/core/flow_dissector.c:1027 __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
Modules linked in:
CPU: 0 PID: 10767 Comm: syz.4.1539 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
lr : __skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
sp : ffff800008006380
x29: ffff8000080069d0 x28: ffff800008006ae0 x27: 0000000000000002
x26: ffff0000f1dcb3c0 x25: ffff8000152053dc x24: dfff800000000000
x23: 0000000000000000 x22: 1ffff00002a40a7c x21: 1ffff00002a40a7c
x20: ffff8000152053e2 x19: ffff700001000cb4 x18: 00000000575c06f5
x17: ffff80018a400000 x16: ffff8000082d9364 x15: 0000000000000000
x14: 000000000000000a x13: 1ffff00002a400b1 x12: 0000000000ff0100
x11: ff0080000fda2dd8 x10: 0000000000000000 x9 : ffff80000fda2dd8
x8 : ffff0000fd4dd340 x7 : ffff80000fda9cb8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : ffff80001206b400 x0 : 0000000000000001
Call trace:
__skb_flow_dissect+0x95c/0x5988 net/core/flow_dissector.c:1022
skb_flow_dissect_flow_keys include/linux/skbuff.h:1499 [inline]
___skb_get_hash+0x7c/0x5b8 net/core/flow_dissector.c:1708
__skb_get_hash+0xb8/0x228 net/core/flow_dissector.c:1773
skb_get_hash include/linux/skbuff.h:1541 [inline]
nft_trace_init+0x188/0x358 net/netfilter/nf_tables_trace.c:292
nft_do_chain+0x1260/0x12e8 net/netfilter/nf_tables_core.c:243
nf_route_table_hook6+0x218/0x5ec net/netfilter/nft_chain_route.c:88
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb4/0x1f4 net/netfilter/core.c:614
nf_hook include/linux/netfilter.h:257 [inline]
__ip6_local_out+0x6b0/0x7cc net/ipv6/output_core.c:149
ip6_local_out+0x3c/0x15c net/ipv6/output_core.c:159
nf_send_reset6+0x7a8/0xc18 net/ipv6/netfilter/nf_reject_ipv6.c:395
nft_reject_inet_eval+0x268/0x550 net/netfilter/nft_reject_inet.c:48
expr_call_ops_eval net/netfilter/nf_tables_core.c:214 [inline]
nft_do_chain+0x44c/0x12e8 net/netfilter/nf_tables_core.c:264
nft_do_chain_inet+0x208/0x2e4 net/netfilter/nft_chain_filter.c:161
nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
nf_hook_slow+0xb4/0x1f4 net/netfilter/core.c:614
nf_hook include/linux/netfilter.h:257 [inline]
NF_HOOK+0x1d0/0x36c include/linux/netfilter.h:300
ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core net/core/dev.c:5581 [inline]
__netif_receive_skb+0xcc/0x2a8 net/core/dev.c:5695
process_backlog+0x408/0x710 net/core/dev.c:6023
__napi_poll+0xb4/0x3f0 net/core/dev.c:6590
napi_poll net/core/dev.c:6657 [inline]
net_rx_action+0x514/0xb18 net/core/dev.c:6771
handle_softirqs+0x318/0xc60 kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
do_softirq+0xf8/0x1a8 kernel/softirq.c:497
__local_bh_enable_ip+0x250/0x37c kernel/softirq.c:421
local_bh_enable+0x28/0x34 include/linux/bottom_half.h:33
rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline]
__dev_queue_xmit+0x1744/0x3134 net/core/dev.c:4373
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_hh_output include/net/neighbour.h:529 [inline]
neigh_output include/net/neighbour.h:543 [inline]
ip6_finish_output2+0xd28/0x1840 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x594/0x92c net/ipv6/ip6_output.c:216
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ip6_xmit+0x1164/0x1a24 net/ipv6/ip6_output.c:357
inet6_csk_xmit+0x374/0x5c0 net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x17d8/0x2b88 net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_send_syn_data net/ipv4/tcp_output.c:3901 [inline]
tcp_connect+0x23e8/0x3de0 net/ipv4/tcp_output.c:3940
tcp_v6_connect+0xde0/0x139c net/ipv6/tcp_ipv6.c:342
__inet_stream_connect+0x1f4/0xc3c net/ipv4/af_inet.c:668
tcp_sendmsg_fastopen+0x30c/0x558 net/ipv4/tcp.c:1207
tcp_sendmsg_locked+0x2cf0/0x31f0 net/ipv4/tcp.c:1255
tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1490
inet6_sendmsg+0xb4/0xd8 net/ipv6/af_inet6.c:668
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x324/0x440 net/socket.c:2152
__do_sys_sendto net/socket.c:2164 [inline]
__se_sys_sendto net/socket.c:2160 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2160
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 1285
hardirqs last enabled at (1284): [<ffff8000081ab564>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (1285): [<ffff800011a1d174>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (1252): [<ffff80000fdc4344>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (1253): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup