------------[ cut here ]------------
WARNING: CPU: 1 PID: 4190 at net/ipv4/af_inet.c:157 inet_sock_destruct+0x639/0x730 net/ipv4/af_inet.c:157
Modules linked in:
CPU: 1 PID: 4190 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:inet_sock_destruct+0x639/0x730 net/ipv4/af_inet.c:157
Code: 01 e8 4b 92 fe f8 0f 0b e9 64 fe ff ff e8 3f 92 fe f8 0f 0b e9 99 fe ff ff e8 33 92 fe f8 0f 0b e9 c1 fe ff ff e8 27 92 fe f8 <0f> 0b e9 e9 fe ff ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c 5b fd ff
RSP: 0018:ffffc90000dd0b48 EFLAGS: 00010246
RAX: ffffffff887a9139 RBX: dffffc0000000000 RCX: ffff88807c751dc0
RDX: 0000000000000100 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000080000000 R08: ffff888019b8dc7f R09: 1ffff11003371b8f
R10: dffffc0000000000 R11: ffffed1003371b90 R12: ffff888019b8da00
R13: ffff888019b8da00 R14: ffff888019b8dc20 R15: 1ffff11003371b42
FS: 0000555580484500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0056ba6c8 CR3: 00000000639c7000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sk_destruct+0x4f/0x840 net/core/sock.c:1960
sock_put include/net/sock.h:1990 [inline]
sctp_endpoint_destroy_rcu+0x9d/0xe0 net/sctp/endpointola.c:193
rcu_do_batch kernel/rcu/tree.c:2523 [inline]
rcu_core+0x96e/0x1650 kernel/rcu/tree.c:2763
handle_softirqs+0x336/0x830 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:test_bit include/asm-generic/bitops/instrumented-non-atomic.h:135 [inline]
RIP: 0010:test_ti_thread_flag include/linux/thread_info.h:118 [inline]
RIP: 0010:need_resched include/linux/sched.h:2126 [inline]
RIP: 0010:copy_pte_range mm/memory.c:1051 [inline]
RIP: 0010:copy_pmd_range mm/memory.c:1167 [inline]
RIP: 0010:copy_pud_range mm/memory.c:1204 [inline]
RIP: 0010:copy_p4d_range mm/memory.c:1228 [inline]
RIP: 0010:copy_page_range+0x107e/0x32c0 mm/memory.c:1301
Code: 48 8b 1d b5 f9 54 7e 48 89 df be 08 00 00 00 e8 e8 f3 10 00 48 89 d8 48 c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 <74> 08 48 89 df e8 38 f2 10 00 48 8b 1b 48 89 de 48 83 e6 08 31 ff
RSP: 0018:ffffc90002edf6c0 EFLAGS: 00000246
RAX: 1ffff1100f8ea3b8 RBX: ffff88807c751dc0 RCX: ffffffff81ad7618
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88807c751dc0
RBP: ffffc90002edf970 R08: ffff88807c751dc7 R09: 1ffff1100f8ea3b8
R10: dffffc0000000000 R11: ffffed100f8ea3b9 R12: ffff8880639cc158
R13: ffff88806342a360 R14: ffff888060b40360 R15: dffffc0000000000
dup_mmap kernel/fork.c:616 [inline]
dup_mm kernel/fork.c:1472 [inline]
copy_mm+0xc61/0x13d0 kernel/fork.c:1524
copy_process+0x17a7/0x3e70 kernel/fork.c:2292
kernel_clone+0x23f/0x990 kernel/fork.c:2682
__do_sys_clone kernel/fork.c:2799 [inline]
__se_sys_clone kernel/fork.c:2783 [inline]
__x64_sys_clone+0x19a/0x210 kernel/fork.c:2783
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa00492bc12
Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffc1bb0fe30 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffc1bb0fe30 RCX: 00007fa00492bc12
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc1bb0ffbc R08: 0000000000000000 R09: 0000000000000001
R10: 00005555804847d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 00000000000177c8 R15: 00007ffc1bb10010
----------------
Code disassembly (best guess):
0: 48 8b 1d b5 f9 54 7e mov 0x7e54f9b5(%rip),%rbx # 0x7e54f9bc
7: 48 89 df mov %rbx,%rdi
a: be 08 00 00 00 mov $0x8,%esi
f: e8 e8 f3 10 00 call 0x10f3fc
14: 48 89 d8 mov %rbx,%rax
17: 48 c1 e8 03 shr $0x3,%rax
1b: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
22: fc ff df
25: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 48 89 df mov %rbx,%rdi
2f: e8 38 f2 10 00 call 0x10f26c
34: 48 8b 1b mov (%rbx),%rbx
37: 48 89 de mov %rbx,%rsi
3a: 48 83 e6 08 and $0x8,%rsi
3e: 31 ff xor %edi,%edi