syzbot


WARNING in inet_sock_destruct (2)

Status: upstream: reported C repro on 2026/01/10 00:38
Reported-by: syzbot+c1ff5aa334cbeba54710@syzkaller.appspotmail.com
First crash: 3d01h, last: 1d12h
Similar bugs (14)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 WARNING in inet_sock_destruct -1 C 728 2693d 2468d 0/3 public: reported C repro on 2019/04/12 00:00
linux-6.1 WARNING in inet_sock_destruct (2) origin:lts-only -1 C inconclusive 16 126d 349d 0/3 upstream: reported C repro on 2025/01/28 09:26
android-44 WARNING in inet_sock_destruct -1 12 2701d 2913d 0/2 auto-closed as invalid on 2019/02/22 12:37
upstream WARNING in inet_sock_destruct (4) net -1 C done 6683 132d 934d 29/29 fixed on 2025/09/04 16:57
upstream WARNING in inet_sock_destruct (3) net -1 C 87 953d 1055d 22/29 fixed on 2023/06/08 14:41
upstream WARNING in inet_sock_destruct (5) net -1 C error 8 88d 125d 29/29 fixed on 2025/10/29 21:02
linux-6.6 WARNING in inet_sock_destruct origin:lts-only -1 C done 3 119d 119d 2/2 fixed on 2025/10/22 03:03
linux-5.15 WARNING in inet_sock_destruct -1 C error 2061 112d 980d 0/3 auto-obsoleted due to no activity on 2025/12/01 05:33
linux-6.1 WARNING in inet_sock_destruct origin:upstream missing-backport -1 C done 631 393d 1007d 3/3 fixed on 2025/01/27 09:36
android-6-12 WARNING in inet_sock_destruct origin:upstream -1 C 58 137d 199d 0/1 auto-obsoleted due to no activity on 2025/10/18 01:19
upstream WARNING in inet_sock_destruct (2) net -1 C unreliable unreliable 1259 1251d 1882d 0/29 closed as invalid on 2022/10/12 18:26
upstream WARNING in inet_sock_destruct net -1 5893 2995d 2990d 0/29 closed as invalid on 2018/01/30 22:53
linux-4.14 WARNING in inet_sock_destruct -1 C inconclusive 1 2051d 2111d 0/1 upstream: reported C repro on 2020/04/02 03:04
linux-5.15 WARNING in inet_sock_destruct (2) origin:lts-only -1 C 3 17h42m 39d 0/3 upstream: reported C repro on 2025/12/04 18:03

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 0 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Code: ff ff e8 4a 53 8c f8 0f 0b e9 48 fe ff ff e8 3e 53 8c f8 0f 0b 41 80 3c 1c 00 0f 85 74 fe ff ff e9 77 fe ff ff e8 27 53 8c f8 <0f> 0b e9 dd fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 fc ff
RSP: 0018:ffffc900001f0b48 EFLAGS: 00010246
RAX: ffffffff88f93d99 RBX: dffffc0000000000 RCX: ffff88801b67bc00
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff88802e3026b7 R09: 1ffff11005c604d6
R10: dffffc0000000000 R11: ffffed1005c604d7 R12: ffff88802e302440
R13: dffffc0000000000 R14: ffff88802e302668 R15: ffffffff8e082180
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff8fb4bbf98 CR3: 000000000cb30000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 __sk_destruct+0x83/0x660 net/core/sock.c:2196
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 23 bb 40 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 55 41 57 41 56
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c2
RAX: f06fe0eec5dd3600 RBX: ffffffff8161881b RCX: f06fe0eec5dd3600
RDX: 0000000000000001 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffffc90000187f20 R08: ffff8880b8f36b2b R09: 1ffff110171e6d65
R10: dffffc0000000000 R11: ffffed10171e6d66 R12: ffffffff8e4a2128
R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110036cf780
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1eb/0x510 kernel/sched/idle.c:282
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:380
 start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	cc                   	int3
   3:	cc                   	int3
   4:	cc                   	int3
   5:	cc                   	int3
   6:	cc                   	int3
   7:	f3 0f 1e fa          	endbr64
   b:	0f 0b                	ud2
   d:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  14:	00 00 00
  17:	f3 0f 1e fa          	endbr64
  1b:	66 90                	xchg   %ax,%ax
  1d:	0f 00 2d 23 bb 40 00 	verw   0x40bb23(%rip)        # 0x40bb47
  24:	f3 0f 1e fa          	endbr64
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	ret <-- trapping instruction
  2b:	cc                   	int3
  2c:	cc                   	int3
  2d:	cc                   	int3
  2e:	cc                   	int3
  2f:	cc                   	int3
  30:	cc                   	int3
  31:	cc                   	int3
  32:	cc                   	int3
  33:	cc                   	int3
  34:	cc                   	int3
  35:	cc                   	int3
  36:	cc                   	int3
  37:	66 0f 1f 00          	nopw   (%rax)
  3b:	55                   	push   %rbp
  3c:	41 57                	push   %r15
  3e:	41 56                	push   %r14

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/11 09:35 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/11 05:03 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 23:44 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/11 14:02 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 20:03 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 15:00 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 10:23 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 05:28 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2026/01/10 00:37 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
* Struck through repros no longer work on HEAD.