------------[ cut here ]------------ WARNING: net/ipv4/af_inet.c:157 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157, CPU#1: syz.0.422/7352 Modules linked in: CPU: 1 UID: 0 PID: 7352 Comm: syz.0.422 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157 Code: 0f 0b 90 e9 58 fe ff ff e8 b0 ee e4 f7 90 0f 0b 90 e9 8b fe ff ff e8 a2 ee e4 f7 90 0f 0b 90 e9 b1 fe ff ff e8 94 ee e4 f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc RSP: 0018:ffffc90000a08d28 EFLAGS: 00010246 RAX: ffffffff89dc092c RBX: dffffc0000000000 RCX: ffff888033a75b80 RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000 RBP: 0000000000000090 R08: ffff8880327da3a7 R09: 1ffff110064fb474 R10: dffffc0000000000 R11: ffffed10064fb475 R12: ffff8880327da100 R13: dffffc0000000000 R14: ffff8880327da38c R15: ffffffff8f3e2c00 FS: 00007fc5bd1e26c0(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33563fff CR3: 00000000734f6000 CR4: 00000000003526f0 Call Trace: __sk_destruct+0x85/0x880 net/core/sock.c:2350 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xc8e/0x1720 kernel/rcu/tree.c:2857 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:get_random_u32+0x49d/0x8d0 drivers/char/random.c:554 Code: e3 00 02 00 00 75 67 e8 71 8e a3 fc 48 8b 5c 24 28 4d 85 ff 75 07 e8 62 8e a3 fc eb 06 e8 5b 8e a3 fc fb 8b 84 24 c0 00 00 00 <48> c7 44 24 40 0e 36 e0 45 42 c7 04 23 00 00 00 00 4a c7 44 23 0c RSP: 0018:ffffc90002ed77a0 EFLAGS: 00000293 RAX: 000000007fc9b6ae RBX: 1ffff920005daefc RCX: ffff888033a75b80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90002ed78c8 R08: ffffffff8f822377 R09: 1ffffffff1f0446e R10: dffffc0000000000 R11: fffffbfff1f0446f R12: dffffc0000000000 R13: 0000000000000000 R14: ffff8880b87369b0 R15: 0000000000000200 __get_random_u32_below+0x14/0x90 drivers/char/random.c:568 get_random_u32_below include/linux/random.h:63 [inline] bpf_jit_binary_pack_alloc+0x1ee/0x340 kernel/bpf/core.c:1163 bpf_int_jit_compile+0x831/0x14b0 arch/x86/net/bpf_jit_comp.c:3828 bpf_prog_select_runtime+0x4a3/0x820 kernel/bpf/core.c:2542 bpf_prog_load+0x13e9/0x1a10 kernel/bpf/syscall.c:3092 __sys_bpf+0x507/0x860 kernel/bpf/syscall.c:6164 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline] __se_sys_bpf kernel/bpf/syscall.c:6272 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6272 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc5bc38f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc5bd1e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007fc5bc5e5fa0 RCX: 00007fc5bc38f749 RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 RBP: 00007fc5bc413f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc5bc5e6038 R14: 00007fc5bc5e5fa0 R15: 00007ffc165b5038 ---------------- Code disassembly (best guess): 0: e3 00 jrcxz 0x2 2: 02 00 add (%rax),%al 4: 00 75 67 add %dh,0x67(%rbp) 7: e8 71 8e a3 fc call 0xfca38e7d c: 48 8b 5c 24 28 mov 0x28(%rsp),%rbx 11: 4d 85 ff test %r15,%r15 14: 75 07 jne 0x1d 16: e8 62 8e a3 fc call 0xfca38e7d 1b: eb 06 jmp 0x23 1d: e8 5b 8e a3 fc call 0xfca38e7d 22: fb sti 23: 8b 84 24 c0 00 00 00 mov 0xc0(%rsp),%eax * 2a: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp) <-- trapping instruction 31: e0 45 33: 42 c7 04 23 00 00 00 movl $0x0,(%rbx,%r12,1) 3a: 00 3b: 4a rex.WX 3c: c7 .byte 0xc7 3d: 44 rex.R 3e: 23 .byte 0x23 3f: 0c .byte 0xc