------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162, CPU#3: syz-executor/5734
Modules linked in:
CPU: 3 UID: 0 PID: 5734 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:162
Code: 2f 4d ff e9 06 fd ff ff e8 ea 7d fd f7 90 0f 0b 90 e9 35 fe ff ff e8 dc 7d fd f7 90 0f 0b 90 e9 c5 fe ff ff e8 ce 7d fd f7 90 <0f> 0b 90 e9 04 ff ff ff e8 c0 7d fd f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc900006f8d88 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802cc89980 RCX: ffffffff8a0b31d7
RDX: ffff88802b52ca00 RSI: ffffffff8a0b32d2 RDI: ffff88802b52ca00
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: 0000000000000000 R12: ffff88802cc89980
R13: ffff88802cc89a10 R14: ffffffff81ee353d R15: 0000000000000004
FS:  0000555563e99500(0000) GS:ffff8880d666d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa18b9456b8 CR3: 0000000026da5000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xab0 net/core/sock.c:2352
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0xb/0x70 kernel/kcov.c:213
Code: 61 00 be 03 00 00 00 5b e9 52 02 f1 02 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 8b 05 85 7f 02 12 <48> 8b 34 24 65 48 8b 15 61 7f 02 12 a9 00 01 ff 00 74 1b f6 c4 01
RSP: 0018:ffffc90003837400 EFLAGS: 00000287
RAX: 0000000080000002 RBX: 000000000000000a RCX: ffffffff828267fe
RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff88802b52ca00
RBP: 0000000000001000 R08: 0000000000000006 R09: 0000000000001000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
 __nr_to_section+0x4c/0x100 include/linux/mmzone.h:2065
 __pfn_to_section include/linux/mmzone.h:2198 [inline]
 lookup_page_ext+0x46/0x100 mm/page_ext.c:255
 page_ext_iter_begin include/linux/page_ext.h:133 [inline]
 page_table_check_set+0x300/0x920 mm/page_table_check.c:113
 __page_table_check_ptes_set+0x27a/0x4e0 mm/page_table_check.c:212
 page_table_check_ptes_set include/linux/page_table_check.h:83 [inline]
 set_ptes include/linux/pgtable.h:413 [inline]
 __copy_present_ptes mm/memory.c:1118 [inline]
 copy_present_ptes mm/memory.c:1197 [inline]
 copy_pte_range mm/memory.c:1320 [inline]
 copy_pmd_range mm/memory.c:1408 [inline]
 copy_pud_range mm/memory.c:1445 [inline]
 copy_p4d_range mm/memory.c:1469 [inline]
 copy_page_range+0x217a/0x5b00 mm/memory.c:1555
 dup_mmap+0xd25/0x2180 mm/mmap.c:1840
 dup_mm kernel/fork.c:1534 [inline]
 copy_mm kernel/fork.c:1586 [inline]
 copy_process+0x6c78/0x7ed0 kernel/fork.c:2264
 kernel_clone+0x12e/0x9c0 kernel/fork.c:2721
 __do_sys_clone+0xd9/0x120 kernel/fork.c:2862
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa18abc58d2
Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffce7104e10 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffce7104e10 RCX: 00007fa18abc58d2
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffce7104f9c R08: 0000000000000000 R09: 0000000000000001
R10: 0000555563e997d0 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000000927c0 R14: 0000000000022471 R15: 00007ffce7104ff0
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 be 03 00 00 00    	add    %bh,0x3(%rsi)
   6:	5b                   	pop    %rbx
   7:	e9 52 02 f1 02       	jmp    0x2f1025e
   c:	66 90                	xchg   %ax,%ax
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	f3 0f 1e fa          	endbr64
  22:	65 8b 05 85 7f 02 12 	mov    %gs:0x12027f85(%rip),%eax        # 0x12027fae
* 29:	48 8b 34 24          	mov    (%rsp),%rsi <-- trapping instruction
  2d:	65 48 8b 15 61 7f 02 	mov    %gs:0x12027f61(%rip),%rdx        # 0x12027f96
  34:	12
  35:	a9 00 01 ff 00       	test   $0xff0100,%eax
  3a:	74 1b                	je     0x57
  3c:	f6 c4 01             	test   $0x1,%ah