------------[ cut here ]------------ WARNING: CPU: 1 PID: 4236 at net/ipv4/af_inet.c:157 inet_sock_destruct+0x64d/0x740 Modules linked in: CPU: 1 PID: 4236 Comm: sed Not tainted 5.15.167-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:inet_sock_destruct+0x64d/0x740 net/ipv4/af_inet.c:157 Code: 01 e8 a7 01 9a f8 0f 0b e9 61 fe ff ff e8 9b 01 9a f8 0f 0b e9 96 fe ff ff e8 8f 01 9a f8 0f 0b e9 be fe ff ff e8 83 01 9a f8 <0f> 0b e9 e6 fe ff ff 89 d9 80 e1 07 fe c1 38 c1 0f 8c 5b fd ff ff RSP: 0018:ffffc90000dd0b68 EFLAGS: 00010246 RAX: ffffffff88e658ed RBX: 0000000000000100 RCX: ffff888025430000 RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 RBP: 0000000000000007 R08: ffffffff88e657cd R09: ffffed102972dd10 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88814b96e600 R13: ffff88814b96eb08 R14: dffffc0000000000 R15: ffff88814b96e612 FS: 00007f88925a8380(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555eb3d7e028 CR3: 0000000058fae000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __sk_destruct+0x54/0x840 net/core/sock.c:1955 rcu_do_batch kernel/rcu/tree.c:2523 [inline] rcu_core+0xa15/0x1650 kernel/rcu/tree.c:2763 handle_softirqs+0x3a7/0x930 kernel/softirq.c:558 __do_softirq kernel/softirq.c:592 [inline] invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x157/0x240 kernel/softirq.c:641 irq_exit_rcu+0x5/0x20 kernel/softirq.c:653 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:unwind_next_frame+0x301/0x1fa0 arch/x86/kernel/unwind_orc.c:449 Code: 31 bc 49 f4 8d 4c 39 e1 0f 83 80 0b 00 00 48 c7 c0 bc 49 f4 8d 49 29 c4 48 c7 c6 90 0c 5b 8e 49 c1 fc 02 4f 8d 34 64 4d 01 f6 <49> 01 f6 0f 85 fd 00 00 00 e9 d7 00 00 00 4c 89 ef e8 09 83 3c 00 RSP: 0018:ffffc9000118f468 EFLAGS: 00000216 RAX: ffffffff8e5886f4 RBX: ffffffff8e5886f8 RCX: ffffffff8e5886fc RDX: dffffc0000000000 RSI: ffffffff8ef16858 RDI: ffffffff8e5886ec RBP: ffffffff8e5886f8 R08: 0000000000000004 R09: ffffc9000118f610 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000003 R13: ffffffff8a4000c9 R14: 0000000000000012 R15: ffffc9000118f520 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x80 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xf1/0x270 mm/slub.c:4559 tomoyo_path_perm+0x555/0x6b0 security/tomoyo/file.c:842 security_inode_getattr+0xcf/0x120 security/security.c:1348 vfs_getattr+0x26/0x360 fs/stat.c:157 vfs_statx+0x18f/0x3b0 fs/stat.c:225 vfs_fstatat fs/stat.c:243 [inline] __do_sys_newfstatat fs/stat.c:411 [inline] __se_sys_newfstatat fs/stat.c:405 [inline] __x64_sys_newfstatat+0x12c/0x1b0 fs/stat.c:405 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f88926fc5f4 Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8 RSP: 002b:00007ffdad76d168 EFLAGS: 00000206 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 00007f88927d4460 RCX: 00007f88926fc5f4 RDX: 00007ffdad76d170 RSI: 00007f8892799130 RDI: 0000000000000003 RBP: 0000555eb3d7c2a0 R08: 0000000000000008 R09: 0000000000000001 R10: 0000000000001000 R11: 0000000000000206 R12: 00007ffdad76d598 R13: 0000555eb3d7c2a0 R14: 00007f8892890934 R15: 00007ffdad76d2b0 ---------------- Code disassembly (best guess): 0: 31 bc 49 f4 8d 4c 39 xor %edi,0x394c8df4(%rcx,%rcx,2) 7: e1 0f loope 0x18 9: 83 80 0b 00 00 48 c7 addl $0xffffffc7,0x4800000b(%rax) 10: c0 bc 49 f4 8d 49 29 sarb $0xc4,0x29498df4(%rcx,%rcx,2) 17: c4 18: 48 c7 c6 90 0c 5b 8e mov $0xffffffff8e5b0c90,%rsi 1f: 49 c1 fc 02 sar $0x2,%r12 23: 4f 8d 34 64 lea (%r12,%r12,2),%r14 27: 4d 01 f6 add %r14,%r14 * 2a: 49 01 f6 add %rsi,%r14 <-- trapping instruction 2d: 0f 85 fd 00 00 00 jne 0x130 33: e9 d7 00 00 00 jmp 0x10f 38: 4c 89 ef mov %r13,%rdi 3b: e8 09 83 3c 00 call 0x3c8349