------------[ cut here ]------------
WARNING: CPU: 1 PID: 5002 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x6e7/0x7f0
Modules linked in:
CPU: 1 PID: 5002 Comm: syz.3.268 Not tainted 6.1.111-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:inet_sock_destruct+0x6e7/0x7f0 net/ipv4/af_inet.c:154
Code: ff ff e8 3c bc 53 f8 0f 0b e9 21 fe ff ff e8 30 bc 53 f8 0f 0b 41 80 3c 2c 00 0f 85 4c fe ff ff e9 4f fe ff ff e8 19 bc 53 f8 <0f> 0b e9 bb fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0e fc ff
RSP: 0018:ffffc900001e0b30 EFLAGS: 00010246
RAX: ffffffff8936f327 RBX: 0000000000000100 RCX: ffff88802b598000
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff88805cc78000 R08: ffffffff8936f1dc R09: ffffed100b98f04f
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff1100b98f005
R13: ffff88805cc784e8 R14: ffff88805cc78028 R15: ffff88805cc78012
FS:  00007ff1d86e56c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb21dcea8 CR3: 000000005b955000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x50/0x5f0 net/core/sock.c:2139
 rcu_do_batch kernel/rcu/tree.c:2297 [inline]
 rcu_core+0xade/0x1820 kernel/rcu/tree.c:2557
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 __do_softirq kernel/softirq.c:605 [inline]
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:lock_acquire+0x26f/0x5a0 kernel/locking/lockdep.c:5666
Code: 2b 00 74 08 4c 89 f7 e8 3f ac 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc90004d772c0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920009aee64 RCX: 1ffff920009aee04
RDX: dffffc0000000000 RSI: ffffffff8b0c14c0 RDI: ffffffff8b5d6dc0
RBP: ffffc90004d77408 R08: dffffc0000000000 R09: fffffbfff223b845
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920009aee60
R13: dffffc0000000000 R14: ffffc90004d77320 R15: 0000000000000246
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 mapping_get_entry mm/filemap.c:1850 [inline]
 __filemap_get_folio+0x171/0xe80 mm/filemap.c:1915
 shmem_get_folio_gfp+0x356/0x3470 mm/shmem.c:1881
 shmem_fault+0x235/0x9c0 mm/shmem.c:2156
 __do_fault+0x136/0x4f0 mm/memory.c:4278
 do_read_fault mm/memory.c:4629 [inline]
 do_fault mm/memory.c:4758 [inline]
 handle_pte_fault mm/memory.c:5029 [inline]
 __handle_mm_fault mm/memory.c:5171 [inline]
 handle_mm_fault+0x3410/0x5340 mm/memory.c:5292
 faultin_page mm/gup.c:1009 [inline]
 __get_user_pages+0x4f3/0x1190 mm/gup.c:1233
 populate_vma_page_range+0x217/0x2b0 mm/gup.c:1590
 __mm_populate+0x275/0x440 mm/gup.c:1704
 mm_populate include/linux/mm.h:2801 [inline]
 vm_mmap_pgoff+0x22b/0x2d0 mm/util.c:525
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff1d797def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff1d86e5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007ff1d7b35f80 RCX: 00007ff1d797def9
RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000000020000000
RBP: 00007ff1d79f0b76 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff1d7b35f80 R15: 00007fff561ea238
 </TASK>
----------------
Code disassembly (best guess):
   0:	2b 00                	sub    (%rax),%eax
   2:	74 08                	je     0xc
   4:	4c 89 f7             	mov    %r14,%rdi
   7:	e8 3f ac 77 00       	call   0x77ac4b
   c:	f6 44 24 61 02       	testb  $0x2,0x61(%rsp)
  11:	0f 85 84 01 00 00    	jne    0x19b
  17:	41 f7 c7 00 02 00 00 	test   $0x200,%r15d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 40 0e 36 	movq   $0x45e0360e,0x40(%rsp)
  28:	e0 45
* 2a:	4b c7 44 25 00 00 00 	movq   $0x0,0x0(%r13,%r12,1) <-- trapping instruction
  31:	00 00
  33:	43 c7 44 25 09 00 00 	movl   $0x0,0x9(%r13,%r12,1)
  3a:	00 00
  3c:	43                   	rex.XB
  3d:	c7                   	.byte 0xc7
  3e:	44                   	rex.R
  3f:	25                   	.byte 0x25