------------[ cut here ]------------
WARNING: CPU: 1 PID: 4527 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x6e7/0x7f0
Modules linked in:
CPU: 1 PID: 4527 Comm: syz.4.175 Not tainted 6.1.110-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:inet_sock_destruct+0x6e7/0x7f0 net/ipv4/af_inet.c:154
Code: ff ff e8 3c c1 53 f8 0f 0b e9 21 fe ff ff e8 30 c1 53 f8 0f 0b 41 80 3c 2c 00 0f 85 4c fe ff ff e9 4f fe ff ff e8 19 c1 53 f8 <0f> 0b e9 bb fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0e fc ff
RSP: 0000:ffffc900001e0b30 EFLAGS: 00010246
RAX: ffffffff8936ee27 RBX: 0000000000000100 RCX: ffff88802cb19dc0
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff888077635940 R08: ffffffff8936ecdc R09: ffffed100eec6b77
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1100eec6b2d
R13: ffff888077635e28 R14: ffff888077635968 R15: ffff888077635952
FS:  00007f097d1806c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0972f1b000 CR3: 0000000026649000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x50/0x5f0 net/core/sock.c:2139
 rcu_do_batch kernel/rcu/tree.c:2297 [inline]
 rcu_core+0xade/0x1820 kernel/rcu/tree.c:2557
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 __do_softirq kernel/softirq.c:605 [inline]
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:lock_acquire+0x26f/0x5a0 kernel/locking/lockdep.c:5666
Code: 2b 00 74 08 4c 89 f7 e8 df ab 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0000:ffffc90004597a60 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920008b2f58 RCX: 1ffff920008b2ef8
RDX: dffffc0000000000 RSI: ffffffff8b0c14c0 RDI: ffffffff8b5d6dc0
RBP: ffffc90004597ba8 R08: dffffc0000000000 R09: fffffbfff223b845
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920008b2f54
R13: dffffc0000000000 R14: ffffc90004597ac0 R15: 0000000000000246
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock_sched include/linux/rcupdate.h:883 [inline]
 pfn_valid+0x113/0x440 include/linux/mmzone.h:1857
 page_table_check_set+0x25/0x6d0 mm/page_table_check.c:108
 page_table_check_pte_set include/linux/page_table_check.h:83 [inline]
 set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline]
 do_anonymous_page mm/memory.c:4214 [inline]
 handle_pte_fault mm/memory.c:5010 [inline]
 __handle_mm_fault mm/memory.c:5154 [inline]
 handle_mm_fault+0x5207/0x5340 mm/memory.c:5275
 do_user_addr_fault arch/x86/mm/fault.c:1340 [inline]
 handle_page_fault arch/x86/mm/fault.c:1431 [inline]
 exc_page_fault+0x26f/0x620 arch/x86/mm/fault.c:1487
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7f097c241cb6
Code: f0 72 6e 48 63 cd 48 01 c1 49 39 4f 08 72 4c 8d 4d ff 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 <47> 0f b6 0c 08 45 84 c9 74 08 45 88 0c 00 49 8b 47 10 48 83 c0 01
RSP: 002b:00007f097d17f4a0 EFLAGS: 00010206
RAX: 0000000000d24001 RBX: 00007f097d17f540 RCX: 0000000000000007
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00007f097d17f5e0
RBP: 0000000000000102 R08: 00007f09721f7000 R09: 0000000000d24000
R10: 0000000000000000 R11: 00007f097d17f550 R12: 0000000000000001
R13: 00007f097c404ec0 R14: 0000000000000000 R15: 00007f097d17f5e0
 </TASK>
----------------
Code disassembly (best guess):
   0:	2b 00                	sub    (%rax),%eax
   2:	74 08                	je     0xc
   4:	4c 89 f7             	mov    %r14,%rdi
   7:	e8 df ab 77 00       	call   0x77abeb
   c:	f6 44 24 61 02       	testb  $0x2,0x61(%rsp)
  11:	0f 85 84 01 00 00    	jne    0x19b
  17:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 40 0e 36 	movq   $0x45e0360e,0x40(%rsp)
  28:	e0 45
* 2a:	4b c7 44 25 00 00 00 	movq   $0x0,0x0(%r13,%r12,1) <-- trapping instruction
  31:	00 00
  33:	43 c7 44 25 09 00 00 	movl   $0x0,0x9(%r13,%r12,1)
  3a:	00 00
  3c:	43                   	rex.XB
  3d:	c7                   	.byte 0xc7
  3e:	44                   	rex.R
  3f:	25                   	.byte 0x25