------------[ cut here ]------------
atomic_read(&sk->sk_rmem_alloc)
WARNING: net/ipv4/af_inet.c:159 at inet_sock_destruct+0x601/0x740 net/ipv4/af_inet.c:159, CPU#1: syz.7.1103/9682
Modules linked in:
CPU: 1 UID: 0 PID: 9682 Comm: syz.7.1103 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
RIP: 0010:inet_sock_destruct+0x601/0x740 net/ipv4/af_inet.c:159
Code: 00 41 0f b6 74 24 12 48 c7 c7 40 9f 0c 8d 4c 89 e2 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 15 22 db f6 e8 60 d4 79 f7 90 <0f> 0b 90 e9 58 fe ff ff e8 52 d4 79 f7 90 0f 0b 90 e9 8b fe ff ff
RSP: 0018:ffffc90000a086a8 EFLAGS: 00010246
RAX: ffffffff8a4c9d20 RBX: dffffc0000000000 RCX: ffff8880331fdd00
RDX: 0000000000000100 RSI: 0000000000000a60 RDI: 0000000000000000
RBP: 0000000000000a60 R08: ffff888079f05fc3 R09: 1ffff1100f3e0bf8
R10: dffffc0000000000 R11: ffffed100f3e0bf9 R12: ffff888079f05e80
R13: dffffc0000000000 R14: ffff888079f05fc0 R15: 1ffff1100f3e0bd2
FS:  00007fd8c85286c0(0000) GS:ffff888125054000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b34123ffc CR3: 0000000076ff5000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __sk_destruct+0x89/0x9d0 net/core/sock.c:2357
 sock_put include/net/sock.h:2020 [inline]
 tcp_v4_rcv+0x28f0/0x3170 net/ipv4/tcp_ipv4.c:2255
 ip_protocol_deliver_rcu+0x21d/0x440 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
 __netif_receive_skb_one_core net/core/dev.c:6212 [inline]
 __netif_receive_skb net/core/dev.c:6325 [inline]
 process_backlog+0xa34/0x1860 net/core/dev.c:6676
 __napi_poll+0xaa/0x330 net/core/dev.c:7735
 napi_poll net/core/dev.c:7798 [inline]
 net_rx_action+0x61d/0xf50 net/core/dev.c:7955
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 do_softirq+0x76/0xd0 kernel/softirq.c:523
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:914 [inline]
 __dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4913
 dev_queue_xmit include/linux/netdevice.h:3446 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0x29f/0x450 net/ipv4/ip_output.c:437
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:533
 __tcp_transmit_skb+0x2d18/0x47c0 net/ipv4/tcp_output.c:1717
 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline]
 tcp_write_xmit+0x1bfa/0x6400 net/ipv4/tcp_output.c:3062
 __tcp_push_pending_frames+0x96/0x380 net/ipv4/tcp_output.c:3245
 tcp_push_pending_frames include/net/tcp.h:2335 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:6078 [inline]
 tcp_rcv_established+0xecb/0x2910 net/ipv4/tcp_input.c:6661
 tcp_v4_do_rcv+0x727/0x13b0 net/ipv4/tcp_ipv4.c:1851
 sk_backlog_rcv include/net/sock.h:1192 [inline]
 __release_sock+0x25b/0x390 net/core/sock.c:3261
 release_sock+0x190/0x260 net/core/sock.c:3860
 mptcp_push_release net/mptcp/protocol.c:1584 [inline]
 __mptcp_push_pending+0x640/0x8d0 net/mptcp/protocol.c:1723
 mptcp_sendmsg+0x11ea/0x1d10 net/mptcp/protocol.c:2023
 sock_sendmsg_nosec+0x10e/0x180 net/socket.c:776
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd8c759de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd8c8528028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fd8c7825fa0 RCX: 00007fd8c759de99
RDX: 0000000000010002 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007fd8c7633eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd8c7826038 R14: 00007fd8c7825fa0 R15: 00007fff9eefd468
 </TASK>