------------[ cut here ]------------
WARNING: CPU: 1 PID: 7885 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x6e7/0x7f0
Modules linked in:
CPU: 1 PID: 7885 Comm: syz.0.784 Not tainted 6.1.111-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:inet_sock_destruct+0x6e7/0x7f0 net/ipv4/af_inet.c:154
Code: ff ff e8 3c bc 53 f8 0f 0b e9 21 fe ff ff e8 30 bc 53 f8 0f 0b 41 80 3c 2c 00 0f 85 4c fe ff ff e9 4f fe ff ff e8 19 bc 53 f8 <0f> 0b e9 bb fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0e fc ff
RSP: 0000:ffffc900001e0b30 EFLAGS: 00010246
RAX: ffffffff8936f327 RBX: 0000000000000100 RCX: ffff8880250d3b80
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff88802e93f2c0 R08: ffffffff8936f1dc R09: ffffed1005d27ea7
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff11005d27e5d
R13: ffff88802e93f7a8 R14: ffff88802e93f2e8 R15: ffff88802e93f2d2
FS:  000055555b989500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa874c53108 CR3: 000000005f401000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x50/0x5f0 net/core/sock.c:2139
 rcu_do_batch kernel/rcu/tree.c:2297 [inline]
 rcu_core+0xade/0x1820 kernel/rcu/tree.c:2557
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 __do_softirq kernel/softirq.c:605 [inline]
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
 sysvec_call_function_single+0x8e/0xb0 arch/x86/kernel/smp.c:262
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:661
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:29 [inline]
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs include/linux/context_tracking.h:122 [inline]
RIP: 0010:rcu_is_watching+0x56/0xb0 kernel/rcu/tree.c:721
Code: f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 50 c8 6e 00 48 c7 c3 a8 56 03 00 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 <84> c0 75 1e 8b 03 65 ff 0d f5 05 8f 7e 74 0c 83 e0 04 c1 e8 02 5b
RSP: 0000:ffffc900055df8e0 EFLAGS: 00000a02
RAX: 0000000000000000 RBX: ffff8880b8f356a8 RCX: ffffffff816a83db
RDX: 0000000000000000 RSI: ffffffff8b5d6da0 RDI: ffffffff8b5d6d60
RBP: ffffc900055dfa60 R08: dffffc0000000000 R09: fffffbfff1d33cae
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92000abbf28
R13: dffffc0000000000 R14: ffffffff8cd8b878 R15: dffffc0000000000
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0xfa/0x5a0 kernel/locking/lockdep.c:5633
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 percpu_ref_get_many include/linux/percpu-refcount.h:202 [inline]
 percpu_ref_get include/linux/percpu-refcount.h:222 [inline]
 obj_cgroup_get include/linux/memcontrol.h:784 [inline]
 memcg_slab_post_alloc_hook mm/slab.h:535 [inline]
 slab_post_alloc_hook+0x1bb/0x3a0 mm/slab.h:745
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
 vm_area_dup+0x23/0x1b0 kernel/fork.c:466
 __split_vma+0xcc/0x530 mm/mmap.c:2352
 mprotect_fixup+0x753/0x840 mm/mprotect.c:623
 do_mprotect_pkey+0x8b6/0xbe0 mm/mprotect.c:792
 __do_sys_mprotect mm/mprotect.c:819 [inline]
 __se_sys_mprotect mm/mprotect.c:816 [inline]
 __x64_sys_mprotect+0x7c/0x90 mm/mprotect.c:816
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f554c17dfb7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff44ceba48 EFLAGS: 00000206 ORIG_RAX: 000000000000000a
RAX: ffffffffffffffda RBX: 00007f554bf9c6c0 RCX: 00007f554c17dfb7
RDX: 0000000000000003 RSI: 0000000000020000 RDI: 00007f554bf7d000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000021000 R11: 0000000000000206 R12: 00007fff44cebba0
R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	f0 48 c1 e8 03       	lock shr $0x3,%rax
   5:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1)
   a:	74 08                	je     0x14
   c:	4c 89 f7             	mov    %r14,%rdi
   f:	e8 50 c8 6e 00       	call   0x6ec864
  14:	48 c7 c3 a8 56 03 00 	mov    $0x356a8,%rbx
  1b:	49 03 1e             	add    (%r14),%rbx
  1e:	48 89 d8             	mov    %rbx,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax
* 2a:	84 c0                	test   %al,%al <-- trapping instruction
  2c:	75 1e                	jne    0x4c
  2e:	8b 03                	mov    (%rbx),%eax
  30:	65 ff 0d f5 05 8f 7e 	decl   %gs:0x7e8f05f5(%rip)        # 0x7e8f062c
  37:	74 0c                	je     0x45
  39:	83 e0 04             	and    $0x4,%eax
  3c:	c1 e8 02             	shr    $0x2,%eax
  3f:	5b                   	pop    %rbx