------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162, CPU#0: syz.3.3488/19267
Modules linked in:
CPU: 0 UID: 0 PID: 19267 Comm: syz.3.3488 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162
Code: 0f 0b 90 e9 58 fe ff ff e8 c0 5c 9f f7 90 0f 0b 90 e9 8b fe ff ff e8 b2 5c 9f f7 90 0f 0b 90 e9 b1 fe ff ff e8 a4 5c 9f f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000007d48 EFLAGS: 00010246
RAX: ffffffff8a26445c RBX: dffffc0000000000 RCX: ffff88802bd41e80
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff8880213fbe27 R09: 1ffff1100427f7c4
R10: dffffc0000000000 R11: ffffed100427f7c5 R12: ffff8880213fbb80
R13: dffffc0000000000 R14: ffff8880213fbe0c R15: ffffffff8fca5580
FS: 00007ff9a73746c0(0000) GS:ffff888125461000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1a32de92f8 CR3: 0000000080bf6000 CR4: 00000000003526f0
Call Trace:
__sk_destruct+0x85/0x880 net/core/sock.c:2350
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_release+0x2d7/0x3d0 kernel/locking/lockdep.c:5893
Code: 78 7a 11 00 00 00 00 eb b5 e8 35 d5 0d 0a f7 c3 00 02 00 00 74 b9 65 48 8b 05 b5 32 7a 11 48 3b 44 24 28 75 44 fb 48 83 c4 30 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 1a bb 10 0a cc 48 8d 3d 22 e4 72
RSP: 0018:ffffc900034673a0 EFLAGS: 00000286
RAX: 171ca0033da89100 RBX: 0000000000000202 RCX: 0000000000000046
RDX: 0000000000000002 RSI: ffffffff8e195add RDI: ffffffff8c27c180
RBP: ffff88802bd42a28 R08: ffffc90003467ed0 R09: 0000000000000000
R10: ffffc900034674f8 R11: fffff5200068cea1 R12: 0000000000000002
R13: 0000000000000002 R14: ffffffff8e75e520 R15: ffff88802bd41e80
rcu_lock_release include/linux/rcupdate.h:322 [inline]
rcu_read_unlock include/linux/rcupdate.h:881 [inline]
class_rcu_destructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0x1aaa/0x23c0 arch/x86/kernel/unwind_orc.c:695
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3131 [inline]
call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
kernfs_put+0x18e/0x470 fs/kernfs/dir.c:591
kernfs_remove_by_name_ns+0xb7/0x130 fs/kernfs/dir.c:1723
kernfs_remove_by_name include/linux/kernfs.h:633 [inline]
remove_files fs/sysfs/group.c:28 [inline]
sysfs_remove_group+0xfc/0x2e0 fs/sysfs/group.c:328
sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:352
destroy_port drivers/infiniband/core/sysfs.c:1233 [inline]
ib_free_port_attrs+0x281/0x3b0 drivers/infiniband/core/sysfs.c:1363
remove_one_compat_dev drivers/infiniband/core/device.c:1010 [inline]
rdma_dev_exit_net+0x1de/0x350 drivers/infiniband/core/device.c:1148
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x49f/0x940 net/core/net_namespace.c:252
setup_net+0x2f0/0x340 net/core/net_namespace.c:462
copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581
create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:226
ksys_unshare+0x51d/0x930 kernel/fork.c:3173
__do_sys_unshare kernel/fork.c:3244 [inline]
__se_sys_unshare kernel/fork.c:3242 [inline]
__x64_sys_unshare+0x38/0x50 kernel/fork.c:3242
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9a659c799
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff9a7374028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007ff9a6815fa0 RCX: 00007ff9a659c799
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000
RBP: 00007ff9a6632c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff9a6816038 R14: 00007ff9a6815fa0 R15: 00007ffcba57e348
----------------
Code disassembly (best guess):
0: 78 7a js 0x7c
2: 11 00 adc %eax,(%rax)
4: 00 00 add %al,(%rax)
6: 00 eb add %ch,%bl
8: b5 e8 mov $0xe8,%ch
a: 35 d5 0d 0a f7 xor $0xf70a0dd5,%eax
f: c3 ret
10: 00 02 add %al,(%rdx)
12: 00 00 add %al,(%rax)
14: 74 b9 je 0xffffffcf
16: 65 48 8b 05 b5 32 7a mov %gs:0x117a32b5(%rip),%rax # 0x117a32d3
1d: 11
1e: 48 3b 44 24 28 cmp 0x28(%rsp),%rax
23: 75 44 jne 0x69
25: fb sti
26: 48 83 c4 30 add $0x30,%rsp
* 2a: 5b pop %rbx <-- trapping instruction
2b: 41 5c pop %r12
2d: 41 5d pop %r13
2f: 41 5e pop %r14
31: 41 5f pop %r15
33: 5d pop %rbp
34: e9 1a bb 10 0a jmp 0xa10bb53
39: cc int3
3a: 48 rex.W
3b: 8d .byte 0x8d
3c: 3d .byte 0x3d
3d: 22 e4 and %ah,%ah
3f: 72 .byte 0x72