------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:157 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157, CPU#0: syz.0.3133/18306
Modules linked in:
CPU: 0 UID: 0 PID: 18306 Comm: syz.0.3133 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157
Code: 0f 0b 90 e9 58 fe ff ff e8 30 7d ac f7 90 0f 0b 90 e9 8b fe ff ff e8 22 7d ac f7 90 0f 0b 90 e9 b1 fe ff ff e8 14 7d ac f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000007d48 EFLAGS: 00010246
RAX: ffffffff8a17bdbc RBX: dffffc0000000000 RCX: ffff888047c6dac0
RDX: 0000000000000100 RSI: 0000000000000f70 RDI: 0000000000000000
RBP: 0000000000000f70 R08: ffff88801bb613a7 R09: 1ffff1100376c274
R10: dffffc0000000000 R11: ffffed100376c275 R12: ffff88801bb61100
R13: dffffc0000000000 R14: ffff88801bb6138c R15: ffffffff8fc9b780
FS: 00007f42be79c6c0(0000) GS:ffff8881254b0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa39b3e96c0 CR3: 00000000527c8000 CR4: 00000000003526f0
Call Trace:
__sk_destruct+0x85/0x880 net/core/sock.c:2350
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x221/0x330 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 a1 e5 fd 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 1b a3 76 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 00 ca 00 0a cc 48 8d 3d c8 7f 73
RSP: 0018:ffffc900038262b8 EFLAGS: 00000286
RAX: 1008f41dfb524000 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 00000000a01eff0a RSI: ffffffff8e151802 RDI: ffffffff8c276500
RBP: ffffffff81759275 R08: ffffffff81759275 R09: ffffffff8e75e0a0
R10: ffffc90003826418 R11: ffffffff81af7870 R12: 0000000000000002
R13: ffffffff8e75e0a0 R14: 0000000000000000 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2670 [inline]
slab_free mm/slub.c:6082 [inline]
kfree+0x1c1/0x610 mm/slub.c:6399
kobject_uevent_env+0x36f/0x9e0 lib/kobject_uevent.c:639
netdev_queue_add_kobject net/core/net-sysfs.c:2013 [inline]
netdev_queue_update_kobjects+0x346/0x6c0 net/core/net-sysfs.c:2056
register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
register_netdevice+0x12c0/0x1cf0 net/core/dev.c:11406
veth_newlink+0x67b/0xb70 drivers/net/veth.c:1889
rtnl_newlink_create+0x329/0xb70 net/core/rtnetlink.c:3840
__rtnl_newlink net/core/rtnetlink.c:3957 [inline]
rtnl_newlink+0x1666/0x1be0 net/core/rtnetlink.c:4072
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f42bd99bf79
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f42be79c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f42bdc15fa0 RCX: 00007f42bd99bf79
RDX: 0000000004000080 RSI: 0000200000001240 RDI: 0000000000000006
RBP: 00007f42bda327e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f42bdc16038 R14: 00007f42bdc15fa0 R15: 00007fffdb8163b8
----------------
Code disassembly (best guess), 2 bytes skipped:
0: ff ljmp (bad)
1: e8 a1 e5 fd 09 call 0x9fde5a7
6: f7 44 24 08 00 02 00 testl $0x200,0x8(%rsp)
d: 00
e: 0f 84 3a ff ff ff je 0xffffff4e
14: 65 48 8b 05 1b a3 76 mov %gs:0x1176a31b(%rip),%rax # 0x1176a337
1b: 11
1c: 48 3b 44 24 58 cmp 0x58(%rsp),%rax
21: 75 33 jne 0x56
23: fb sti
24: 48 83 c4 60 add $0x60,%rsp
* 28: 5b pop %rbx <-- trapping instruction
29: 41 5c pop %r12
2b: 41 5d pop %r13
2d: 41 5e pop %r14
2f: 41 5f pop %r15
31: 5d pop %rbp
32: e9 00 ca 00 0a jmp 0xa00ca37
37: cc int3
38: 48 rex.W
39: 8d .byte 0x8d
3a: 3d .byte 0x3d
3b: c8 .byte 0xc8
3c: 7f 73 jg 0xb1