------------[ cut here ]------------
WARNING: net/ipv4/af_inet.c:157 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157, CPU#1: syz.0.422/7352
Modules linked in:
CPU: 1 UID: 0 PID: 7352 Comm: syz.0.422 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157
Code: 0f 0b 90 e9 58 fe ff ff e8 b0 ee e4 f7 90 0f 0b 90 e9 8b fe ff ff e8 a2 ee e4 f7 90 0f 0b 90 e9 b1 fe ff ff e8 94 ee e4 f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000a08d28 EFLAGS: 00010246
RAX: ffffffff89dc092c RBX: dffffc0000000000 RCX: ffff888033a75b80
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff8880327da3a7 R09: 1ffff110064fb474
R10: dffffc0000000000 R11: ffffed10064fb475 R12: ffff8880327da100
R13: dffffc0000000000 R14: ffff8880327da38c R15: ffffffff8f3e2c00
FS: 00007fc5bd1e26c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33563fff CR3: 00000000734f6000 CR4: 00000000003526f0
Call Trace:
__sk_destruct+0x85/0x880 net/core/sock.c:2350
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xc8e/0x1720 kernel/rcu/tree.c:2857
handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x60/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:get_random_u32+0x49d/0x8d0 drivers/char/random.c:554
Code: e3 00 02 00 00 75 67 e8 71 8e a3 fc 48 8b 5c 24 28 4d 85 ff 75 07 e8 62 8e a3 fc eb 06 e8 5b 8e a3 fc fb 8b 84 24 c0 00 00 00 <48> c7 44 24 40 0e 36 e0 45 42 c7 04 23 00 00 00 00 4a c7 44 23 0c
RSP: 0018:ffffc90002ed77a0 EFLAGS: 00000293
RAX: 000000007fc9b6ae RBX: 1ffff920005daefc RCX: ffff888033a75b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002ed78c8 R08: ffffffff8f822377 R09: 1ffffffff1f0446e
R10: dffffc0000000000 R11: fffffbfff1f0446f R12: dffffc0000000000
R13: 0000000000000000 R14: ffff8880b87369b0 R15: 0000000000000200
__get_random_u32_below+0x14/0x90 drivers/char/random.c:568
get_random_u32_below include/linux/random.h:63 [inline]
bpf_jit_binary_pack_alloc+0x1ee/0x340 kernel/bpf/core.c:1163
bpf_int_jit_compile+0x831/0x14b0 arch/x86/net/bpf_jit_comp.c:3828
bpf_prog_select_runtime+0x4a3/0x820 kernel/bpf/core.c:2542
bpf_prog_load+0x13e9/0x1a10 kernel/bpf/syscall.c:3092
__sys_bpf+0x507/0x860 kernel/bpf/syscall.c:6164
__do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc5bc38f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc5bd1e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fc5bc5e5fa0 RCX: 00007fc5bc38f749
RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005
RBP: 00007fc5bc413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc5bc5e6038 R14: 00007fc5bc5e5fa0 R15: 00007ffc165b5038
----------------
Code disassembly (best guess):
0: e3 00 jrcxz 0x2
2: 02 00 add (%rax),%al
4: 00 75 67 add %dh,0x67(%rbp)
7: e8 71 8e a3 fc call 0xfca38e7d
c: 48 8b 5c 24 28 mov 0x28(%rsp),%rbx
11: 4d 85 ff test %r15,%r15
14: 75 07 jne 0x1d
16: e8 62 8e a3 fc call 0xfca38e7d
1b: eb 06 jmp 0x23
1d: e8 5b 8e a3 fc call 0xfca38e7d
22: fb sti
23: 8b 84 24 c0 00 00 00 mov 0xc0(%rsp),%eax
* 2a: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) <-- trapping instruction
31: e0 45
33: 42 c7 04 23 00 00 00 movl $0x0,(%rbx,%r12,1)
3a: 00
3b: 4a rex.WX
3c: c7 .byte 0xc7
3d: 44 rex.R
3e: 23 .byte 0x23
3f: 0c .byte 0xc