------------[ cut here ]------------
WARNING: CPU: 0 PID: 2910 at net/ipv4/af_inet.c:157 inet_sock_destruct+0x681/0x790 net/ipv4/af_inet.c:157
Modules linked in:
CPU: 0 UID: 0 PID: 2910 Comm: syz-executor Not tainted 6.12.30-syzkaller-ge2bf362ee23b #0 e1c904518e9113895a28c59b25a6002cdacb68bf
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:inet_sock_destruct+0x681/0x790 net/ipv4/af_inet.c:157
Code: a3 e8 d3 e6 c8 fc 0f 0b e9 53 fe ff ff e8 c7 e6 c8 fc 0f 0b e9 92 fe ff ff e8 bb e6 c8 fc 0f 0b e9 c4 fe ff ff e8 af e6 c8 fc <0f> 0b e9 f6 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 65 fc ff
RSP: 0018:ffffc900000079c0 EFLAGS: 00010246
RAX: ffffffff84bcbc81 RBX: 0000000080003000 RCX: ffff888115f5a600
RDX: 0000000000000100 RSI: 0000000080003000 RDI: 0000000000000000
RBP: ffffc90000007a08 R08: ffff88812606337f R09: 1ffff11024c0c66f
R10: dffffc0000000000 R11: ffffed1024c0c670 R12: ffff888126063200
R13: ffff888126063200 R14: ffff888126063364 R15: 1ffff11024c0c642
FS: 000055556ca55500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2578171d60 CR3: 0000000119762000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sk_destruct+0x68/0x6a0 net/core/sock.c:2277
sk_destruct net/core/sock.c:2325 [inline]
__sk_free+0x313/0x410 net/core/sock.c:2336
sk_free+0x58/0xb0 net/core/sock.c:2347
tcp_wfree+0x299/0x500 net/ipv4/tcp_output.c:1240
skb_release_head_state+0x112/0x260 net/core/skbuff.c:1187
skb_release_all net/core/skbuff.c:1198 [inline]
__kfree_skb+0x29/0x210 net/core/skbuff.c:1214
sk_skb_reason_drop+0xd8/0x310 net/core/skbuff.c:1252
kfree_skb_reason include/linux/skbuff.h:1271 [inline]
__skb_queue_purge_reason include/linux/skbuff.h:3314 [inline]
__skb_queue_purge include/linux/skbuff.h:3319 [inline]
neigh_invalidate+0x3d7/0x490 net/core/neighbour.c:1064
neigh_timer_handler+0x90b/0xf20 net/core/neighbour.c:1148
call_timer_fn+0x4c/0x300 kernel/time/timer.c:1797
expire_timers kernel/time/timer.c:1848 [inline]
__run_timers kernel/time/timer.c:2422 [inline]
__run_timer_base+0x6b3/0x9a0 kernel/time/timer.c:2434
run_timer_base kernel/time/timer.c:2443 [inline]
run_timer_softirq+0x35/0x70 kernel/time/timer.c:2453
handle_softirqs+0x1ae/0x630 kernel/softirq.c:603
__do_softirq kernel/softirq.c:641 [inline]
invoke_softirq kernel/softirq.c:458 [inline]
__irq_exit_rcu+0x48/0xc0 kernel/softirq.c:690
irq_exit_rcu+0xd/0x30 kernel/softirq.c:702
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x82/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:last_frame arch/x86/kernel/unwind_frame.c:82 [inline]
RIP: 0010:is_last_frame arch/x86/kernel/unwind_frame.c:87 [inline]
RIP: 0010:is_last_task_frame arch/x86/kernel/unwind_frame.c:156 [inline]
RIP: 0010:unwind_next_frame+0xd7/0x750 arch/x86/kernel/unwind_frame.c:276
Code: e8 1e ad 97 00 48 ba 00 00 00 00 00 fc ff df 4c 89 6d c0 4c 89 7d b8 4c 89 75 d0 4c 8b 7b 38 4c 8d 73 28 4c 89 f0 48 c1 e8 03 <48> 89 45 a0 80 3c 10 00 74 12 4c 89 f7 e8 e7 ac 97 00 48 ba 00 00
RSP: 0018:ffffc900103b7328 EFLAGS: 00000a02
RAX: 1ffff92002076e7a RBX: ffffc900103b73a8 RCX: 00000000103b7300
RDX: dffffc0000000000 RSI: ffffffff81d777c4 RDI: ffffc900103b73a8
RBP: ffffc900103b7398 R08: ffffc900103b7470 R09: ffffc900103b7468
R10: 0000000000000003 R11: ffffffff817403e0 R12: 0000000000000000
R13: 1ffff92002076e80 R14: ffffc900103b73d0 R15: ffffc900103b7768
arch_stack_walk+0x139/0x170 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9d/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x73/0x90 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4164 [inline]
slab_alloc_node mm/slub.c:4213 [inline]
kmem_cache_alloc_lru_noprof+0x134/0x3a0 mm/slub.c:4234
__d_alloc+0x42/0x8e0 fs/dcache.c:1636
d_alloc_anon fs/dcache.c:1734 [inline]
d_alloc_cursor+0x45/0xd0 fs/dcache.c:1740
dcache_dir_open+0x3f/0x80 fs/libfs.c:87
do_dentry_open+0x978/0x1510 fs/open.c:960
vfs_open+0x86/0x230 fs/open.c:1090
do_open fs/namei.c:3774 [inline]
path_openat+0x2b6c/0x34b0 fs/namei.c:3933
do_filp_open+0x1c6/0x3e0 fs/namei.c:3960
do_sys_openat2+0x12c/0x1c0 fs/open.c:1438
do_sys_open fs/open.c:1453 [inline]
__do_sys_openat fs/open.c:1469 [inline]
__se_sys_openat fs/open.c:1464 [inline]
__x64_sys_openat+0x13a/0x170 fs/open.c:1464
x64_sys_call+0xe69/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x58/0xf0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f96cc78d211
Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 3a 93 1f 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 93 00 00 00 48 8b 54 24 28 64 48 2b 14 25
RSP: 002b:00007fff86f45990 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96cc78d211
RDX: 0000000000000000 RSI: 00007fff86f45ac0 RDI: 00000000ffffff9c
RBP: 00007fff86f45ac0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff86f46b50
R13: 00007f96cc810925 R14: 000055556ca554a8 R15: 0000000000000005
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: e8 1e ad 97 00 call 0x97ad23
5: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
c: fc ff df
f: 4c 89 6d c0 mov %r13,-0x40(%rbp)
13: 4c 89 7d b8 mov %r15,-0x48(%rbp)
17: 4c 89 75 d0 mov %r14,-0x30(%rbp)
1b: 4c 8b 7b 38 mov 0x38(%rbx),%r15
1f: 4c 8d 73 28 lea 0x28(%rbx),%r14
23: 4c 89 f0 mov %r14,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 48 89 45 a0 mov %rax,-0x60(%rbp) <-- trapping instruction
2e: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1)
32: 74 12 je 0x46
34: 4c 89 f7 mov %r14,%rdi
37: e8 e7 ac 97 00 call 0x97ad23
3c: 48 rex.W
3d: ba .byte 0xba