------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162, CPU#0: syz-executor/5619
Modules linked in:
CPU: 0 UID: 0 PID: 5619 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162
Code: 42 4d ff e9 06 fd ff ff e8 da 1d ff f7 90 0f 0b 90 e9 35 fe ff ff e8 cc 1d ff f7 90 0f 0b 90 e9 c5 fe ff ff e8 be 1d ff f7 90 <0f> 0b 90 e9 04 ff ff ff e8 b0 1d ff f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000007d88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88806a5aaa80 RCX: ffffffff8a097707
RDX: ffff88802b6e9ec0 RSI: ffffffff8a097802 RDI: ffff88802b6e9ec0
RBP: 0000000000000090 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000090 R11: 0000000000000000 R12: ffff88806a5aaa80
R13: ffff88806a5aab10 R14: ffffffff81ee1b3d R15: 0000000000000000
FS:  000055555aaa5500(0000) GS:ffff888124371000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd0b7d85a80 CR3: 000000005bed2000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xab0 net/core/sock.c:2352
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:198
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 06 4a 58 f6 48 89 df e8 de 99 58 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 65 69 48 f6 65 8b 05 1e bf 7e 08 85 c0 74 16 5b
RSP: 0018:ffffc90003ae7130 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff88802c2abc80 RCX: 0000000000000040
RDX: 0000000000000000 RSI: ffffffff8df1ee30 RDI: ffffffff8c1c3880
RBP: 0000000000000282 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff888032f9a180
R13: ffff88802c2abc80 R14: dffffc0000000000 R15: ffff88802068e000
 sock_def_readable+0x154/0x610 net/core/sock.c:3614
 __netlink_sendskb net/netlink/af_netlink.c:1263 [inline]
 netlink_broadcast_deliver net/netlink/af_netlink.c:1399 [inline]
 do_one_broadcast net/netlink/af_netlink.c:1488 [inline]
 netlink_broadcast_filtered+0x958/0xe90 net/netlink/af_netlink.c:1533
 netlink_broadcast+0x39/0x50 net/netlink/af_netlink.c:1557
 uevent_net_broadcast_untagged lib/kobject_uevent.c:331 [inline]
 kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline]
 kobject_uevent_env+0xcdd/0x18b0 lib/kobject_uevent.c:611
 device_add+0x116e/0x1950 drivers/base/core.c:3672
 device_create_groups_vargs+0x1f8/0x270 drivers/base/core.c:4388
 device_create+0xed/0x130 drivers/base/core.c:4427
 mac80211_hwsim_new_radio+0x379/0x5aa0 drivers/net/wireless/virtual/mac80211_hwsim.c:5624
 hwsim_new_radio_nl+0xc5f/0x1370 drivers/net/wireless/virtual/mac80211_hwsim.c:6726
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 __sys_sendto+0x468/0x4b0 net/socket.c:2265
 __do_sys_sendto net/socket.c:2272 [inline]
 __se_sys_sendto net/socket.c:2268 [inline]
 __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2268
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc3f635d60e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc58390db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055555aaa5500 RCX: 00007fc3f635d60e
RDX: 0000000000000024 RSI: 00007fc3f7144670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc58390e34 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fc3f7144670 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	f5                   	cmc
   1:	53                   	push   %rbx
   2:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi
   7:	48 89 fb             	mov    %rdi,%rbx
   a:	48 83 c7 18          	add    $0x18,%rdi
   e:	e8 06 4a 58 f6       	call   0xf6584a19
  13:	48 89 df             	mov    %rbx,%rdi
  16:	e8 de 99 58 f6       	call   0xf65899f9
  1b:	f7 c5 00 02 00 00    	test   $0x200,%ebp
  21:	75 23                	jne    0x46
  23:	9c                   	pushf
  24:	58                   	pop    %rax
  25:	f6 c4 02             	test   $0x2,%ah
  28:	75 37                	jne    0x61
* 2a:	bf 01 00 00 00       	mov    $0x1,%edi <-- trapping instruction
  2f:	e8 65 69 48 f6       	call   0xf6486999
  34:	65 8b 05 1e bf 7e 08 	mov    %gs:0x87ebf1e(%rip),%eax        # 0x87ebf59
  3b:	85 c0                	test   %eax,%eax
  3d:	74 16                	je     0x55
  3f:	5b                   	pop    %rbx