flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea000220fc08 ffffea0002994808 0000000000000000
raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:519!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7759 Comm: syz-executor372 Not tainted 4.19.35 #3
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:put_page include/linux/mm.h:942 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2795 [inline]
RIP: 0010:skb_release_data+0x5ab/0x7c0 net/core/skbuff.c:568
Code: f6 fe ff e9 b6 fb ff ff e8 b2 83 09 fc 4c 8d 63 ff e9 c8 fc ff ff e8 a4 83 09 fc 48 c7 c6 00 b2 dc 87 4c 89 e7 e8 b5 86 31 fc <0f> 0b e8 8e 83 09 fc 4d 8d 66 0e 48 b8 00 00 00 00 00 fc ff df 4c
RSP: 0018:ffff8880a4a9f8a8 EFLAGS: 00010293
RAX: ffff88808cbd0640 RBX: ffffea0002999234 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81934797 RDI: ffffea0002999238
RBP: ffff8880a4a9f910 R08: 000000000000003e R09: ffff88808cbd0f80
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0002999200
R13: ffff8880932ee2f0 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020014000 CR3: 000000000866d000 CR4: 00000000001406e0
Call Trace:
 skb_release_all+0x4d/0x60 net/core/skbuff.c:631
 __kfree_skb+0x16/0x30 net/core/skbuff.c:645
 sk_wmem_free_skb include/net/sock.h:1457 [inline]
 tcp_write_queue_purge+0x253/0x7d0 net/ipv4/tcp.c:2520
 tcp_v4_destroy_sock+0xe7/0x7e0 net/ipv4/tcp_ipv4.c:1977
 inet_csk_destroy_sock+0x1a7/0x450 net/ipv4/inet_connection_sock.c:838
 tcp_close+0xa5e/0x10c0 net/ipv4/tcp.c:2476
 tls_sk_proto_close+0x6b1/0xaa0 net/tls/tls_main.c:313
 inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428
 __sock_release+0x1fe/0x2b0 net/socket.c:579
 sock_release+0x18/0x20 net/socket.c:599
 smc_release+0x2c7/0x810 net/smc/af_smc.c:156
 __sock_release+0xd3/0x2b0 net/socket.c:579
 sock_close+0x1b/0x30 net/socket.c:1140
 __fput+0x2df/0x8b0 fs/file_table.c:278
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x14a/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x933/0x2fa0 kernel/exit.c:876
 do_group_exit+0x135/0x370 kernel/exit.c:979
 __do_sys_exit_group kernel/exit.c:990 [inline]
 __se_sys_exit_group kernel/exit.c:988 [inline]
 __x64_sys_exit_group+0x44/0x50 kernel/exit.c:988
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x43eeb8
Code: Bad RIP value.
RSP: 002b:00007ffc5471c228 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043eeb8
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004be6c8 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000028 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d0180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace b8f1210f0d732120 ]---
RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline]
RIP: 0010:put_page include/linux/mm.h:942 [inline]
RIP: 0010:__skb_frag_unref include/linux/skbuff.h:2795 [inline]
RIP: 0010:skb_release_data+0x5ab/0x7c0 net/core/skbuff.c:568
Code: f6 fe ff e9 b6 fb ff ff e8 b2 83 09 fc 4c 8d 63 ff e9 c8 fc ff ff e8 a4 83 09 fc 48 c7 c6 00 b2 dc 87 4c 89 e7 e8 b5 86 31 fc <0f> 0b e8 8e 83 09 fc 4d 8d 66 0e 48 b8 00 00 00 00 00 fc ff df 4c
RSP: 0018:ffff8880a4a9f8a8 EFLAGS: 00010293
RAX: ffff88808cbd0640 RBX: ffffea0002999234 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81934797 RDI: ffffea0002999238
RBP: ffff8880a4a9f910 R08: 000000000000003e R09: ffff88808cbd0f80
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea0002999200
R13: ffff8880932ee2f0 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000043ee8e CR3: 000000000866d000 CR4: 00000000001406e0