------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162, CPU#0: sed/21118
Modules linked in:
CPU: 0 UID: 0 PID: 21118 Comm: sed Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162
Code: 86 4d ff e9 06 fd ff ff e8 1a bf f8 f7 90 0f 0b 90 e9 35 fe ff ff e8 0c bf f8 f7 90 0f 0b 90 e9 c5 fe ff ff e8 fe be f8 f7 90 <0f> 0b 90 e9 04 ff ff ff e8 f0 be f8 f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000007d88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807bc12200 RCX: ffffffff8a10a9c7
RDX: ffff88802a06bd80 RSI: ffffffff8a10aac2 RDI: ffff88802a06bd80
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: 0000000000000000 R12: ffff88807bc12200
R13: ffff88807bc12290 R14: ffffffff81eef37d R15: 0000000000000007
FS: 0000000000000000(0000) GS:ffff8881242db000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6adb8f21d4 CR3: 000000003aa17000 CR4: 0000000000350ef0
Call Trace:
__sk_destruct+0x85/0xab0 net/core/sock.c:2352
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:srso_alias_safe_ret+0x0/0x7 arch/x86/lib/retpoline.S:210
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <48> 8d 64 24 08 c3 cc e8 f4 ff ff ff 0f 0b cc cc cc cc cc cc cc cc
RSP: 0018:ffffc900049cf660 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff82823aae RDI: fffffbfff1cfca8c
RBP: ffffffff8e7e5460 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
srso_alias_return_thunk+0x5/0xfbef5 arch/x86/lib/retpoline.S:220
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5842 [inline]
lock_acquire+0x12a/0x370 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
page_table_check_clear+0x2ae/0x8f0 mm/page_table_check.c:77
__page_table_check_pte_clear+0xf1/0x100 mm/page_table_check.c:155
page_table_check_pte_clear include/linux/page_table_check.h:55 [inline]
ptep_get_and_clear arch/x86/include/asm/pgtable.h:1247 [inline]
ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1265 [inline]
clear_full_ptes include/linux/pgtable.h:905 [inline]
zap_present_folio_ptes mm/memory.c:1645 [inline]
zap_present_ptes mm/memory.c:1714 [inline]
do_zap_pte_range mm/memory.c:1816 [inline]
zap_pte_range mm/memory.c:1918 [inline]
zap_pmd_range mm/memory.c:2004 [inline]
zap_pud_range mm/memory.c:2032 [inline]
zap_p4d_range mm/memory.c:2053 [inline]
__zap_vma_range+0x27a9/0x4bf0 mm/memory.c:2093
unmap_vmas+0x299/0x5f0 mm/memory.c:2162
exit_mmap+0x1ef/0xa10 mm/mmap.c:1300
__mmput+0x12a/0x410 kernel/fork.c:1178
mmput+0x67/0x80 kernel/fork.c:1201
exit_mm kernel/exit.c:581 [inline]
do_exit+0x833/0x2a60 kernel/exit.c:963
do_group_exit+0xd5/0x2a0 kernel/exit.c:1117
__do_sys_exit_group kernel/exit.c:1128 [inline]
__se_sys_exit_group kernel/exit.c:1126 [inline]
__x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1126
x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd2a29f36c5
Code: Unable to access opcode bytes at 0x7fd2a29f369b.
RSP: 002b:00007fff0a4e3138 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fd2a2af4fe8 RCX: 00007fd2a29f36c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd2a2af3680 R15: 00007fd2a2af5000
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: 48 8d 64 24 08 lea 0x8(%rsp),%rsp <-- trapping instruction
2f: c3 ret
30: cc int3
31: e8 f4 ff ff ff call 0x2a
36: 0f 0b ud2
38: cc int3
39: cc int3
3a: cc int3
3b: cc int3
3c: cc int3
3d: cc int3
3e: cc int3
3f: cc int3