------------[ cut here ]------------
WARNING: CPU: 1 PID: 5765 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Modules linked in:
CPU: 1 PID: 5765 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Code: ff ff e8 4a 53 8c f8 0f 0b e9 48 fe ff ff e8 3e 53 8c f8 0f 0b 41 80 3c 1c 00 0f 85 74 fe ff ff e9 77 fe ff ff e8 27 53 8c f8 <0f> 0b e9 dd fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 fc ff
RSP: 0018:ffffc900001f0b48 EFLAGS: 00010246
RAX: ffffffff88f93d99 RBX: dffffc0000000000 RCX: ffff88802f7f1e00
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff88805fb30277 R09: 1ffff1100bf6604e
R10: dffffc0000000000 R11: ffffed100bf6604f R12: ffff88805fb30000
R13: dffffc0000000000 R14: ffff88805fb30228 R15: ffffffff8e082180
FS:  000055558b8d9500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd32368ec0 CR3: 0000000073d16000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 __sk_destruct+0x83/0x660 net/core/sock.c:2196
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_kcov_mode kernel/kcov.c:182 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0x96/0x120 kernel/kcov.c:350
Code: 41 54 53 48 8b 54 24 20 65 4c 8b 05 c4 1f 7e 7e 45 31 c9 eb 08 49 ff c1 4c 39 c8 74 77 4e 8b 54 ce 10 65 44 8b 1d b2 1f 7e 7e <41> 81 e3 00 01 ff 00 74 13 41 81 fb 00 01 00 00 75 d9 41 83 b8 1c
RSP: 0018:ffffc90004387110 EFLAGS: 00000202
RAX: 0000000000000003 RBX: ffffffff8ed87afc RCX: 0000000000000003
RDX: ffffffff813aba19 RSI: ffffffff8cb9e7e0 RDI: 0000000000000001
RBP: ffffc90004387258 R08: ffff88802f7f1e00 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000080000001 R12: ffffc90004387208
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffff8ed87b00
 unwind_next_frame+0x16d9/0x2970 arch/x86/kernel/unwind_orc.c:641
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 save_stack+0xf7/0x1f0 mm/page_owner.c:128
 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 kmem_cache_alloc_node+0x150/0x330 mm/slub.c:3540
 kmalloc_reserve+0x95/0x240 net/core/skbuff.c:562
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb_fclone include/linux/skbuff.h:1334 [inline]
 tcp_stream_alloc_skb+0x3d/0x330 net/ipv4/tcp.c:872
 tcp_sendmsg_locked+0xed2/0x4af0 net/ipv4/tcp.c:1154
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1344
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 sock_write_iter+0x2bb/0x3f0 net/socket.c:1160
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x43b/0x940 fs/read_write.c:584
 ksys_write+0x147/0x250 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f902618e1c0
Code: 40 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 d3 22 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007ffdff7131a8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000205d85c0 RCX: 00007f902618e1c0
RDX: 0000000000000190 RSI: 00007f9024a3fe70 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000007 R09: 000000000003fde8
R10: 48cdf06dfae09f20 R11: 0000000000000202 R12: 0000000000000190
R13: 000055558b8f0bf0 R14: 00007ffdff713670 R15: 00007f9024a3fe70
 </TASK>
----------------
Code disassembly (best guess):
   0:	41 54                	push   %r12
   2:	53                   	push   %rbx
   3:	48 8b 54 24 20       	mov    0x20(%rsp),%rdx
   8:	65 4c 8b 05 c4 1f 7e 	mov    %gs:0x7e7e1fc4(%rip),%r8        # 0x7e7e1fd4
   f:	7e
  10:	45 31 c9             	xor    %r9d,%r9d
  13:	eb 08                	jmp    0x1d
  15:	49 ff c1             	inc    %r9
  18:	4c 39 c8             	cmp    %r9,%rax
  1b:	74 77                	je     0x94
  1d:	4e 8b 54 ce 10       	mov    0x10(%rsi,%r9,8),%r10
  22:	65 44 8b 1d b2 1f 7e 	mov    %gs:0x7e7e1fb2(%rip),%r11d        # 0x7e7e1fdc
  29:	7e
* 2a:	41 81 e3 00 01 ff 00 	and    $0xff0100,%r11d <-- trapping instruction
  31:	74 13                	je     0x46
  33:	41 81 fb 00 01 00 00 	cmp    $0x100,%r11d
  3a:	75 d9                	jne    0x15
  3c:	41                   	rex.B
  3d:	83                   	.byte 0x83
  3e:	b8                   	.byte 0xb8
  3f:	1c                   	.byte 0x1c