------------[ cut here ]------------
WARNING: CPU: 1 PID: 6189 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x6f2/0x8b0 net/ipv4/af_inet.c:156
Modules linked in:
CPU: 1 PID: 6189 Comm: syz-executor277 Not tainted 6.9.0-syzkaller-05151-g1b294a1f3561 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:inet_sock_destruct+0x6f2/0x8b0 net/ipv4/af_inet.c:156
Code: 0f 0b 90 e9 fa fd ff ff e8 ab 9d 33 f8 90 0f 0b 90 e9 30 fe ff ff e8 9d 9d 33 f8 90 0f 0b 90 e9 84 fd ff ff e8 8f 9d 33 f8 90 <0f> 0b 90 e9 8f fe ff ff e8 01 51 8f f8 e9 65 fc ff ff 48 89 ef e8
RSP: 0018:ffffc900008b0da0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88801f47ce00 RCX: ffffffff895a62a1
RDX: ffff88801fb08000 RSI: ffffffff895a6411 RDI: 0000000000000005
RBP: 0000000000000d00 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000d00 R11: 0000000000000001 R12: ffff88801f47ce28
R13: ffff88801f47ce90 R14: 0000000000000000 R15: 0000000000000002
FS:  000055555b0163c0(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1a72bf8090 CR3: 000000002a836000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x4d/0x730 net/core/sock.c:2175
 rcu_do_batch kernel/rcu/tree.c:2535 [inline]
 rcu_core+0x828/0x16b0 kernel/rcu/tree.c:2809
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:60 [inline]
RIP: 0010:stack_access_ok+0x1d6/0x270 arch/x86/kernel/unwind_orc.c:393
Code: ec 0f 83 3e ff ff ff e8 f8 da 50 00 48 39 eb 41 0f 93 c6 e9 30 ff ff ff e8 e7 da 50 00 4c 8b 3c 24 4c 39 fd 0f 83 d3 fe ff ff <e8> d5 da 50 00 48 8b 44 24 08 48 01 e8 49 39 c6 48 89 04 24 0f 83
RSP: 0018:ffffc900058af190 EFLAGS: 00000287
RAX: 0000000000000000 RBX: ffffc900058af258 RCX: ffffffff813d2586
RDX: ffff88801fb08000 RSI: ffffffff813d26b9 RDI: 0000000000000005
RBP: ffffc900058af5d8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000002 R12: ffffc900058af260
R13: ffffc900058af268 R14: ffffc900058a8000 R15: ffffc900058b0000
 deref_stack_reg arch/x86/kernel/unwind_orc.c:403 [inline]
 unwind_next_frame+0xd9b/0x23a0 arch/x86/kernel/unwind_orc.c:585
 arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3871 [inline]
 slab_alloc_node mm/slub.c:3918 [inline]
 kmem_cache_alloc_lru+0x142/0x700 mm/slub.c:3937
 __d_alloc+0x31/0xaa0 fs/dcache.c:1624
 d_alloc+0x4a/0x1e0 fs/dcache.c:1704
 d_alloc_parallel+0xe9/0x12b0 fs/dcache.c:2462
 __lookup_slow+0x194/0x460 fs/namei.c:1677
 lookup_slow fs/namei.c:1709 [inline]
 walk_component+0x350/0x5b0 fs/namei.c:2004
 link_path_walk.part.0.constprop.0+0x62b/0xcd0 fs/namei.c:2328
 link_path_walk fs/namei.c:2256 [inline]
 path_openat+0x22f/0x2990 fs/namei.c:3803
 do_filp_open+0x1dc/0x430 fs/namei.c:3834
 do_sys_openat2+0x17a/0x1e0 fs/open.c:1406
 do_sys_open fs/open.c:1421 [inline]
 __do_sys_openat fs/open.c:1437 [inline]
 __se_sys_openat fs/open.c:1432 [inline]
 __x64_sys_openat+0x175/0x210 fs/open.c:1432
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcf/0x260 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a72ba0821
Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 8a 98 08 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 93 00 00 00 48 8b 54 24 28 64 48 2b 14 25
RSP: 002b:00007ffd389da520 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000080001 RCX: 00007f1a72ba0821
RDX: 0000000000080001 RSI: 00007f1a72bf8095 RDI: 00000000ffffff9c
RBP: 00007f1a72bf8095 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd389da5c0
R13: 00007ffd389dab00 R14: 00007ffd389daaf0 R15: 00007f1a72c2b3e0
 </TASK>
----------------
Code disassembly (best guess):
   0:	ec                   	in     (%dx),%al
   1:	0f 83 3e ff ff ff    	jae    0xffffff45
   7:	e8 f8 da 50 00       	call   0x50db04
   c:	48 39 eb             	cmp    %rbp,%rbx
   f:	41 0f 93 c6          	setae  %r14b
  13:	e9 30 ff ff ff       	jmp    0xffffff48
  18:	e8 e7 da 50 00       	call   0x50db04
  1d:	4c 8b 3c 24          	mov    (%rsp),%r15
  21:	4c 39 fd             	cmp    %r15,%rbp
  24:	0f 83 d3 fe ff ff    	jae    0xfffffefd
* 2a:	e8 d5 da 50 00       	call   0x50db04 <-- trapping instruction
  2f:	48 8b 44 24 08       	mov    0x8(%rsp),%rax
  34:	48 01 e8             	add    %rbp,%rax
  37:	49 39 c6             	cmp    %rax,%r14
  3a:	48 89 04 24          	mov    %rax,(%rsp)
  3e:	0f                   	.byte 0xf
  3f:	83                   	.byte 0x83