------------[ cut here ]------------ WARNING: CPU: 0 PID: 8 at net/core/stream.c:205 sk_stream_kill_queues+0x2ee/0x3d0 net/core/stream.c:205 Modules linked in: CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.0-next-20211109-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker RIP: 0010:sk_stream_kill_queues+0x2ee/0x3d0 net/core/stream.c:205 Code: 5e 41 5f e9 e4 98 46 fa e8 df 98 46 fa 89 ee 48 89 df e8 95 9a fb ff e9 64 ff ff ff e8 cb 98 46 fa 0f 0b eb 9b e8 c2 98 46 fa <0f> 0b eb c7 e8 b9 98 46 fa 0f 0b e9 65 fe ff ff e8 6d 5f 8d fa e9 RSP: 0018:ffffc90000007c28 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000fff RCX: 0000000000000100 RDX: ffff88801191d7c0 RSI: ffffffff8731340e RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff873133d5 R11: 0000000000000000 R12: ffff888081969a18 R13: ffff8880819699a8 R14: ffff888081969828 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33123000 CR3: 000000007b6b6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: inet_csk_destroy_sock+0x1a5/0x440 net/ipv4/inet_connection_sock.c:1012 tcp_done+0x233/0x330 net/ipv4/tcp.c:4416 tcp_write_err net/ipv4/tcp_timer.c:74 [inline] tcp_probe_timer net/ipv4/tcp_timer.c:395 [inline] tcp_write_timer_handler+0x447/0xbc0 net/ipv4/tcp_timer.c:626 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:check_kcov_mode kernel/kcov.c:166 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x7/0x60 kernel/kcov.c:200 Code: 46 00 5d be 03 00 00 00 e9 96 95 5f 02 66 0f 1f 44 00 00 48 8b be b0 01 00 00 e8 b4 ff ff ff 31 c0 c3 90 65 8b 05 29 a3 8a 7e <89> c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b 14 25 40 70 02 00 a9 RSP: 0018:ffffc90000cd7c18 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88801191d7c0 RDX: 0000000000000000 RSI: ffff88801191d7c0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff88eb4b6b R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880813b9790 R14: ffff8880813b8c80 R15: 0000000000000072 rcu_read_unlock include/linux/rcupdate.h:720 [inline] batadv_nc_process_nc_paths.part.0+0x218/0x3c0 net/batman-adv/network-coding.c:703 batadv_nc_process_nc_paths net/batman-adv/network-coding.c:683 [inline] batadv_nc_worker+0xc46/0xfa0 net/batman-adv/network-coding.c:732 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 ---------------- Code disassembly (best guess): 0: 46 00 5d be rex.RX add %r11b,-0x42(%rbp) 4: 03 00 add (%rax),%eax 6: 00 00 add %al,(%rax) 8: e9 96 95 5f 02 jmpq 0x25f95a3 d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1) 13: 48 8b be b0 01 00 00 mov 0x1b0(%rsi),%rdi 1a: e8 b4 ff ff ff callq 0xffffffd3 1f: 31 c0 xor %eax,%eax 21: c3 retq 22: 90 nop 23: 65 8b 05 29 a3 8a 7e mov %gs:0x7e8aa329(%rip),%eax # 0x7e8aa353 * 2a: 89 c1 mov %eax,%ecx <-- trapping instruction 2c: 48 8b 34 24 mov (%rsp),%rsi 30: 81 e1 00 01 00 00 and $0x100,%ecx 36: 65 48 8b 14 25 40 70 mov %gs:0x27040,%rdx 3d: 02 00 3f: a9 .byte 0xa9