------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:157 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157, CPU#0: syz-executor/17647
Modules linked in:
CPU: 0 UID: 0 PID: 17647 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:157
Code: 0f 0b 90 e9 58 fe ff ff e8 90 2e b3 f7 90 0f 0b 90 e9 8b fe ff ff e8 82 2e b3 f7 90 0f 0b 90 e9 b1 fe ff ff e8 74 2e b3 f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000007d28 EFLAGS: 00010246
RAX: ffffffff8a1148dc RBX: dffffc0000000000 RCX: ffff8880267c5b80
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff888022aa4ce7 R09: 1ffff1100455499c
R10: dffffc0000000000 R11: ffffed100455499d R12: ffff888022aa4a40
R13: dffffc0000000000 R14: ffff888022aa4ccc R15: ffffffff8fa89340
FS:  000055556e897500(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555896199e8 CR3: 0000000031194000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0x880 net/core/sock.c:2350
 rcu_do_batch kernel/rcu/tree.c:2605 [inline]
 rcu_core+0xc9e/0x1750 kernel/rcu/tree.c:2857
 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__migrate_disable include/linux/sched.h:2407 [inline]
RIP: 0010:migrate_disable include/linux/sched.h:2423 [inline]
RIP: 0010:rcu_read_lock_dont_migrate include/linux/rcupdate.h:994 [inline]
RIP: 0010:bpf_inode_storage_free+0x109/0x5b0 kernel/bpf/bpf_inode_storage.c:65
Code: 0d d4 a8 ff 65 48 8b 05 0d c8 08 11 4c 8d b8 e0 66 f4 92 4c 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 6c 04 00 00 41 ff 07 <43> 0f b6 44 25 00 84 c0 0f 85 79 04 00 00 66 c7 03 01 00 bf 01 00
RSP: 0018:ffffc900046bfc08 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff8880267c6000 RCX: ffffffff99fe1400
RDX: ffff8880267c5b80 RSI: 0000000000000000 RDI: ffffffff81e9e813
RBP: 0000000000000000 R08: ffffffff8fef1a77 R09: 1ffffffff1fde34e
R10: dffffc0000000000 R11: ffffffff8209c7e0 R12: dffffc0000000000
R13: 1ffff11004cf8c00 R14: ffff88805a478b08 R15: ffff8880b863b6e0
 security_inode_free+0xdc/0x180 security/security.c:1224
 __destroy_inode+0x2da/0x670 fs/inode.c:371
 destroy_inode fs/inode.c:394 [inline]
 evict+0x8a7/0xb10 fs/inode.c:861
 do_unlinkat+0x354/0x590 fs/namei.c:5452
 __do_sys_unlink fs/namei.c:5483 [inline]
 __se_sys_unlink fs/namei.c:5481 [inline]
 __x64_sys_unlink+0x47/0x50 fs/namei.c:5481
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f97d2199fa7
Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffd22b50348 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f97d2199fa7
RDX: 00007ffd22b50370 RSI: 00007ffd22b50400 RDI: 00007ffd22b50400
RBP: 00007ffd22b50400 R08: 00007ffd22b51400 R09: 00000000ffffffff
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffd22b51490
R13: 00007f97d220471f R14: 0000000000084ba9 R15: 00007ffd22b514d0
 </TASK>
----------------
Code disassembly (best guess):
   0:	0d d4 a8 ff 65       	or     $0x65ffa8d4,%eax
   5:	48 8b 05 0d c8 08 11 	mov    0x1108c80d(%rip),%rax        # 0x1108c819
   c:	4c 8d b8 e0 66 f4 92 	lea    -0x6d0b9920(%rax),%r15
  13:	4c 89 f8             	mov    %r15,%rax
  16:	48 c1 e8 03          	shr    $0x3,%rax
  1a:	42 0f b6 04 20       	movzbl (%rax,%r12,1),%eax
  1f:	84 c0                	test   %al,%al
  21:	0f 85 6c 04 00 00    	jne    0x493
  27:	41 ff 07             	incl   (%r15)
* 2a:	43 0f b6 44 25 00    	movzbl 0x0(%r13,%r12,1),%eax <-- trapping instruction
  30:	84 c0                	test   %al,%al
  32:	0f 85 79 04 00 00    	jne    0x4b1
  38:	66 c7 03 01 00       	movw   $0x1,(%rbx)
  3d:	bf                   	.byte 0xbf
  3e:	01 00                	add    %eax,(%rax)