------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162, CPU#0: syz.0.81/6115
Modules linked in:
CPU: 0 UID: 0 PID: 6115 Comm: syz.0.81 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162
Code: 4e 4d ff e9 06 fd ff ff e8 9a 90 fd f7 90 0f 0b 90 e9 35 fe ff ff e8 8c 90 fd f7 90 0f 0b 90 e9 c5 fe ff ff e8 7e 90 fd f7 90 <0f> 0b 90 e9 04 ff ff ff e8 70 90 fd f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000007d88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802ca00880 RCX: ffffffff8a0b1f27
RDX: ffff88802b6f0000 RSI: ffffffff8a0b2022 RDI: ffff88802b6f0000
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: 0000000000000000 R12: ffff88802ca00880
R13: ffff88802ca00910 R14: ffffffff81ee353d R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff8880d636a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f58fc7fdff8 CR3: 000000002d3ec000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xab0 net/core/sock.c:2352
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 76 62 5c 00 48 89 df 5b e9 bd ec 61 00 be 03 00 00 00 5b e9 d2 05 f1 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 65 8b 05 85 af 02 12 48 8b 34 24 65 48 8b 15 61 af 02
RSP: 0018:ffffc9000646f488 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffea0001097a80 RCX: ffffffff824a101a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88802b6f0000
RBP: 1ffff92000c8de94 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0001097a88
R13: 0000000000000000 R14: ffff88802d3a6ac8 R15: 00000000425ea025
 instrument_atomic_read include/linux/instrumented.h:82 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 folio_test_unevictable include/linux/page-flags.h:637 [inline]
 lru_gen_inc_refs mm/swap.c:397 [inline]
 folio_mark_accessed+0x1a8/0x1040 mm/swap.c:466
 zap_present_folio_ptes mm/memory.c:1657 [inline]
 zap_present_ptes mm/memory.c:1730 [inline]
 do_zap_pte_range mm/memory.c:1832 [inline]
 zap_pte_range mm/memory.c:1934 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x13cd/0x4ba0 mm/memory.c:2109
 unmap_vmas+0x299/0x5f0 mm/memory.c:2178
 exit_mmap+0x1ef/0xa10 mm/mmap.c:1300
 __mmput+0x12a/0x410 kernel/fork.c:1178
 mmput+0x67/0x80 kernel/fork.c:1201
 exit_mm kernel/exit.c:582 [inline]
 do_exit+0x8b2/0x2af0 kernel/exit.c:964
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1119
 get_signal+0x20ff/0x2210 kernel/signal.c:3037
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x8b/0x4f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x706/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58fd19ce59
Code: Unable to access opcode bytes at 0x7f58fd19ce2f.
RSP: 002b:00007f58fc7fe0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f58fd416098 RCX: 00007f58fd19ce59
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f58fd416098
RBP: 00007f58fd416090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f58fd416128 R14: 00007ffd11d631b0 R15: 00007ffd11d63298
 </TASK>
----------------
Code disassembly (best guess):
   0:	76 62                	jbe    0x64
   2:	5c                   	pop    %rsp
   3:	00 48 89             	add    %cl,-0x77(%rax)
   6:	df 5b e9             	fistps -0x17(%rbx)
   9:	bd ec 61 00 be       	mov    $0xbe0061ec,%ebp
   e:	03 00                	add    (%rax),%eax
  10:	00 00                	add    %al,(%rax)
  12:	5b                   	pop    %rbx
  13:	e9 d2 05 f1 02       	jmp    0x2f105ea
  18:	66 90                	xchg   %ax,%ax
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
  28:	90                   	nop
  29:	90                   	nop
* 2a:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2e:	65 8b 05 85 af 02 12 	mov    %gs:0x1202af85(%rip),%eax        # 0x1202afba
  35:	48 8b 34 24          	mov    (%rsp),%rsi
  39:	65                   	gs
  3a:	48                   	rex.W
  3b:	8b                   	.byte 0x8b
  3c:	15                   	.byte 0x15
  3d:	61                   	(bad)
  3e:	af                   	scas   %es:(%rdi),%eax
  3f:	02                   	.byte 0x2