------------[ cut here ]------------
kernel BUG at net/socket.c:733!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 1 UID: 0 PID: 8400 Comm: syz.1.907 Not tainted 6.11.0-rc5-syzkaller #0
Hardware name: ARM-Versatile Express
PC is at sock_sendmsg_nosec net/socket.c:733 [inline]
PC is at sock_sendmsg_nosec net/socket.c:728 [inline]
PC is at __sock_sendmsg+0x74/0x78 net/socket.c:745
LR is at __local_bh_enable_ip+0x50/0xd0 kernel/softirq.c:385
pc : [<814489e4>]    lr : [<8024bb78>]    psr: 60000013
sp : e87f5d98  ip : e87f5ac0  fp : e87f5db4
r10: 00000000  r9 : e87f5dd4  r8 : e87f5dd4
r7 : 00000000  r6 : 831a1b80  r5 : e87f5f38  r4 : fffffdef
r3 : fffffdef  r2 : 8511ec00  r1 : 00000000  r0 : fffffdef
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 84d40640  DAC: 00000000
Register r0 information: non-paged memory
Register r1 information: NULL pointer
Register r2 information: slab task_struct start 8511ec00 pointer offset 0 size 3072
Register r3 information: non-paged memory
Register r4 information: non-paged memory
Register r5 information: 2-page vmalloc region starting at 0xe87f4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r6 information: slab sock_inode_cache start 831a1b80 pointer offset 0 size 576
Register r7 information: NULL pointer
Register r8 information: 2-page vmalloc region starting at 0xe87f4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r9 information: 2-page vmalloc region starting at 0xe87f4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r10 information: NULL pointer
Register r11 information: 2-page vmalloc region starting at 0xe87f4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Register r12 information: 2-page vmalloc region starting at 0xe87f4000 allocated at kernel_clone+0xac/0x3e4 kernel/fork.c:2800
Process syz.1.907 (pid: 8400, stack limit = 0xe87f4000)
Stack: (0xe87f5d98 to 0xe87f6000)
5d80:                                                       e87f5f38 831a1b80
5da0: 00000000 00000000 e87f5e24 e87f5db8 81449924 8144897c e87f5e30 e87f5f48
5dc0: 00000000 00000000 e87f5e24 00000000 8144b7c0 00000000 00000000 00000000
5de0: 00000000 00000000 00000000 00000000 00000000 6d703a47 00000000 00000000
5e00: e87f5f38 831a1b80 00000000 00000000 20001100 e87f5e34 e87f5f24 e87f5e28
5e20: 8144b890 81449684 00000000 00000001 00000000 20002440 0000c3ec 00000000
5e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5e80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ea0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
5ee0: 00000000 00000000 00000000 00000000 00000000 6d703a47 80527ec8 00000000
5f00: 831a1b80 20001100 00000000 8020029c 8511ec00 00000128 e87f5fa4 e87f5f28
5f20: 8144bda8 8144b800 00000000 00000000 00000001 fffffff7 00000000 00000000
5f40: 00000000 00000000 00010000 0000c3ec 20002440 00000000 00000001 00000000
5f60: 00000000 00000001 00000000 00000000 00000000 00000000 00000000 00000000
5f80: 8020c920 6d703a47 00000000 00000000 002762f0 00000128 00000000 e87f5fa8
5fa0: 80200060 8144bd3c 00000000 00000000 00000003 20001100 00000000 00000000
5fc0: 00000000 00000000 002762f0 00000128 00000000 00006364 003d0f00 76bcf0bc
5fe0: 76bceec0 76bceeb0 000189a0 00132d80 60000010 00000003 00000000 00000000
Call trace: 
[<81448970>] (__sock_sendmsg) from [<81449924>] (____sys_sendmsg+0x2ac/0x2cc net/socket.c:2597)
 r7:00000000 r6:00000000 r5:831a1b80 r4:e87f5f38
[<81449678>] (____sys_sendmsg) from [<8144b890>] (___sys_sendmsg+0x9c/0xd0 net/socket.c:2651)
 r10:e87f5e34 r9:20001100 r8:00000000 r7:00000000 r6:831a1b80 r5:e87f5f38
 r4:00000000
[<8144b7f4>] (___sys_sendmsg) from [<8144bda8>] (__sys_sendmsg net/socket.c:2680 [inline])
[<8144b7f4>] (___sys_sendmsg) from [<8144bda8>] (__do_sys_sendmsg net/socket.c:2689 [inline])
[<8144b7f4>] (___sys_sendmsg) from [<8144bda8>] (sys_sendmsg+0x78/0xbc net/socket.c:2687)
 r10:00000128 r9:8511ec00 r8:8020029c r7:00000000 r6:20001100 r5:831a1b80
 r4:00000000
[<8144bd30>] (sys_sendmsg) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67)
Exception stack(0xe87f5fa8 to 0xe87f5ff0)
5fa0:                   00000000 00000000 00000003 20001100 00000000 00000000
5fc0: 00000000 00000000 002762f0 00000128 00000000 00006364 003d0f00 76bcf0bc
5fe0: 76bceec0 76bceeb0 000189a0 00132d80
 r7:00000128 r6:002762f0 r5:00000000 r4:00000000
Code: e1a01004 ebfffdcd e1a00004 e89da8f0 (e7f001f2) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	e1a01004 	mov	r1, r4
   4:	ebfffdcd 	bl	0xfffff740
   8:	e1a00004 	mov	r0, r4
   c:	e89da8f0 	ldm	sp, {r4, r5, r6, r7, fp, sp, pc}
* 10:	e7f001f2 	udf	#18 <-- trapping instruction