------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162, CPU#2: syz.0.635/8276
Modules linked in:
CPU: 2 UID: 0 PID: 8276 Comm: syz.0.635 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162
Code: 2f 4d ff e9 06 fd ff ff e8 ea 7d fd f7 90 0f 0b 90 e9 35 fe ff ff e8 dc 7d fd f7 90 0f 0b 90 e9 c5 fe ff ff e8 ce 7d fd f7 90 <0f> 0b 90 e9 04 ff ff ff e8 c0 7d fd f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000648d88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88803e063b80 RCX: ffffffff8a0b31d7
RDX: ffff888028ba0000 RSI: ffffffff8a0b32d2 RDI: ffff888028ba0000
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: 0000000000000000 R12: ffff88803e063b80
R13: ffff88803e063c10 R14: ffffffff81ee353d R15: 0000000000000001
FS:  0000200000000800(0000) GS:ffff8880d656d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fee6714da08 CR3: 000000002d76c000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xab0 net/core/sock.c:2352
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:188 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:206
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 aa a2 56 f6 48 89 df e8 82 f2 56 f6 e8 2d 02 83 f6 fb bf 01 00 00 00 <e8> 12 bc 46 f6 65 8b 05 8b 3f 7d 08 85 c0 74 06 5b c3 cc cc cc cc
RSP: 0018:ffffc900078bea90 EFLAGS: 00000202
RAX: 00000000000040c1 RBX: ffff888055b4e3e0 RCX: 0000000000000040
RDX: 0000000000000000 RSI: ffffffff8df22fb5 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 000000000000050e
R13: ffffc900078beb08 R14: 0000000000000000 R15: 0000000000000000
 spin_unlock_irq include/linux/spinlock.h:402 [inline]
 shmem_add_to_page_cache+0x874/0xcd0 mm/shmem.c:928
 shmem_alloc_and_add_folio+0x558/0xd40 mm/shmem.c:2001
 shmem_get_folio_gfp+0x6ab/0x1900 mm/shmem.c:2564
 shmem_get_folio mm/shmem.c:2670 [inline]
 shmem_write_begin+0x1a4/0x420 mm/shmem.c:3303
 generic_perform_write+0x292/0xa40 mm/filemap.c:4325
 shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3478
 __kernel_write_iter+0x2ac/0x920 fs/read_write.c:621
 dump_emit_page fs/coredump.c:1304 [inline]
 dump_user_range+0x3f9/0xad0 fs/coredump.c:1378
 elf_core_dump+0x2d5f/0x3d10 fs/binfmt_elf.c:2109
 coredump_write fs/coredump.c:1053 [inline]
 do_coredump fs/coredump.c:1132 [inline]
 vfs_coredump+0x29a0/0x5770 fs/coredump.c:1206
 get_signal+0x2162/0x2210 kernel/signal.c:3022
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x410/0x7e0 kernel/entry/common.c:162
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x8daa
Code: Unable to access opcode bytes at 0x8d80.
RSP: 002b:0000200000000768 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f3d7d015fa0 RCX: 00007f3d7cd9ce59
RDX: 0000200000000780 RSI: 0000200000000760 RDI: 0000000004180000
RBP: 00007f3d7ce32d6f R08: 0000200000000800 R09: 0000200000000800
R10: 00002000000007c0 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f3d7d016038 R14: 00007f3d7d015fa0 R15: 00007ffd1fa30b58
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 aa a2 56 f6       	call   0xf656a2c1
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 82 f2 56 f6       	call   0xf656f2a1
  1f:	e8 2d 02 83 f6       	call   0xf6830251
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 12 bc 46 f6       	call   0xf646bc41 <-- trapping instruction
  2f:	65 8b 05 8b 3f 7d 08 	mov    %gs:0x87d3f8b(%rip),%eax        # 0x87d3fc1
  36:	85 c0                	test   %eax,%eax
  38:	74 06                	je     0x40
  3a:	5b                   	pop    %rbx
  3b:	c3                   	ret
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	cc                   	int3
  3f:	cc                   	int3