------------[ cut here ]------------
WARNING: CPU: 0 PID: 5778 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Modules linked in:
CPU: 0 PID: 5778 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Code: ff ff e8 4a 53 8c f8 0f 0b e9 48 fe ff ff e8 3e 53 8c f8 0f 0b 41 80 3c 1c 00 0f 85 74 fe ff ff e9 77 fe ff ff e8 27 53 8c f8 <0f> 0b e9 dd fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 fc ff
RSP: 0018:ffffc90000007b48 EFLAGS: 00010246
RAX: ffffffff88f93d99 RBX: dffffc0000000000 RCX: ffff888079e25a00
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff88807d2fbc77 R09: 1ffff1100fa5f78e
R10: dffffc0000000000 R11: ffffed100fa5f78f R12: ffff88807d2fba00
R13: dffffc0000000000 R14: ffff88807d2fbc28 R15: ffffffff8e082180
FS:  000055557ba47500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff2efd27cc CR3: 000000007e183000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 __sk_destruct+0x83/0x660 net/core/sock.c:2196
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_switch+0xb2/0x120 kernel/kcov.c:350
Code: 77 4e 8b 54 ce 10 65 44 8b 1d b2 1f 7e 7e 41 81 e3 00 01 ff 00 74 13 41 81 fb 00 01 00 00 75 d9 41 83 b8 1c 16 00 00 00 74 cf <45> 8b 98 f8 15 00 00 41 83 fb 03 75 c2 4d 8b 98 00 16 00 00 45 8b
RSP: 0018:ffffc9000470f150 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff8ed93748 RCX: 0000000000000003
RDX: ffffffff813aa995 RSI: ffffffff8cb9e740 RDI: 0000000000000002
RBP: ffffc9000470f298 R08: ffff888079e25a00 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc9000470f248
R13: dffffc0000000000 R14: 0000000000000002 R15: ffffffff8ed9374d
 unwind_next_frame+0x655/0x2970 arch/x86/kernel/unwind_orc.c:505
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 save_stack+0xf7/0x1f0 mm/page_owner.c:128
 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 kmem_cache_alloc_node+0x150/0x330 mm/slub.c:3540
 __alloc_skb+0x108/0x2c0 net/core/skbuff.c:643
 alloc_skb_fclone include/linux/skbuff.h:1334 [inline]
 tcp_stream_alloc_skb+0x3d/0x330 net/ipv4/tcp.c:872
 tcp_sendmsg_locked+0xed2/0x4af0 net/ipv4/tcp.c:1154
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1344
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 sock_write_iter+0x2bb/0x3f0 net/socket.c:1160
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x43b/0x940 fs/read_write.c:584
 ksys_write+0x147/0x250 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe281f8e1c0
Code: 40 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 d3 22 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89
RSP: 002b:00007fffa440ef48 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000300a9580 RCX: 00007fe281f8e1c0
RDX: 0000000000000120 RSI: 00007fe28083fee0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000007 R09: 000000000003fde8
R10: c04973d23beb8f75 R11: 0000000000000202 R12: 0000000000000120
R13: 000055557ba5ebf0 R14: 00007fffa440f410 R15: 00007fe28083fee0
 </TASK>
----------------
Code disassembly (best guess):
   0:	77 4e                	ja     0x50
   2:	8b 54 ce 10          	mov    0x10(%rsi,%rcx,8),%edx
   6:	65 44 8b 1d b2 1f 7e 	mov    %gs:0x7e7e1fb2(%rip),%r11d        # 0x7e7e1fc0
   d:	7e
   e:	41 81 e3 00 01 ff 00 	and    $0xff0100,%r11d
  15:	74 13                	je     0x2a
  17:	41 81 fb 00 01 00 00 	cmp    $0x100,%r11d
  1e:	75 d9                	jne    0xfffffff9
  20:	41 83 b8 1c 16 00 00 	cmpl   $0x0,0x161c(%r8)
  27:	00
  28:	74 cf                	je     0xfffffff9
* 2a:	45 8b 98 f8 15 00 00 	mov    0x15f8(%r8),%r11d <-- trapping instruction
  31:	41 83 fb 03          	cmp    $0x3,%r11d
  35:	75 c2                	jne    0xfffffff9
  37:	4d 8b 98 00 16 00 00 	mov    0x1600(%r8),%r11
  3e:	45                   	rex.RB
  3f:	8b                   	.byte 0x8b