------------[ cut here ]------------
WARNING: CPU: 0 PID: 5156 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x6df/0x8a0 net/ipv4/af_inet.c:154
Modules linked in:
CPU: 0 PID: 5156 Comm: syz-executor.1 Not tainted 6.3.0-syzkaller-10620-g33afd4b76393 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:inet_sock_destruct+0x6df/0x8a0 net/ipv4/af_inet.c:154
Code: ff e8 25 d3 e2 f8 0f 0b e9 07 fe ff ff e8 19 d3 e2 f8 0f 0b e9 3f fe ff ff e8 0d d3 e2 f8 0f 0b e9 95 fd ff ff e8 01 d3 e2 f8 <0f> 0b e9 9f fe ff ff e8 a5 83 35 f9 e9 7a fc ff ff 4c 89 e7 e8 d8
RSP: 0018:ffffc90000007c48 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000ffff9000 RCX: 0000000000000100
RDX: ffff88801f424800 RSI: ffffffff88a103af RDI: 0000000000000005
RBP: ffff888013f3b100 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000ffff9000 R11: 0000000000000034 R12: ffff888013f3b128
R13: ffff888013f3b374 R14: ffff888013f3b180 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88802c600000(0063) knlGS:00000000568ac380
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f7ea55b6 CR3: 000000006f4ee000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x4d/0x770 net/core/sock.c:2130
 sk_destruct net/core/sock.c:2178 [inline]
 __sk_free+0x175/0x460 net/core/sock.c:2189
 sk_free+0x7c/0xa0 net/core/sock.c:2200
 sock_put include/net/sock.h:1968 [inline]
 tcp_write_timer+0x24b/0x2b0 net/ipv4/tcp_timer.c:644
 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
 expire_timers+0x29b/0x4b0 kernel/time/timer.c:1751
 __run_timers kernel/time/timer.c:2022 [inline]
 __run_timers kernel/time/timer.c:1995 [inline]
 run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
 __do_softirq+0x1d4/0x905 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x114/0x190 kernel/softirq.c:650
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:lock_is_held_type+0x103/0x140 kernel/locking/lockdep.c:5767
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 d8 b7 f4 75 83 f8 01 75 29 9c 58 f6 c4 02 75 3d 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 ed eb b9 0f 0b 48
RSP: 0018:ffffc90003d46de0 EFLAGS: 00000292
RAX: 0000000000000046 RBX: 0000000000000002 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88801d028198 R08: 0000000000000005 R09: 0000000000000300
R10: 0000000000000300 R11: 0000000000000000 R12: ffff88801f424800
R13: 0000000000000001 R14: 00000000ffffffff R15: ffff88801f425318
 lock_is_held include/linux/lockdep.h:288 [inline]
 mt_locked lib/maple_tree.c:817 [inline]
 mt_locked lib/maple_tree.c:815 [inline]
 mt_slot_locked lib/maple_tree.c:830 [inline]
 mas_slot_locked lib/maple_tree.c:843 [inline]
 mas_adopt_children lib/maple_tree.c:1745 [inline]
 mas_descend_adopt+0x12dd/0x1950 lib/maple_tree.c:2136
 mas_wmb_replace lib/maple_tree.c:2800 [inline]
 mas_split.isra.0+0xb05/0xd10 lib/maple_tree.c:3588
 mas_commit_b_node.isra.0+0x67f/0x8d0 lib/maple_tree.c:3639
 mas_wr_bnode+0x155/0x1e0 lib/maple_tree.c:4358
 mas_wr_modify+0x332/0x16d0 lib/maple_tree.c:4401
 mas_wr_store_entry.isra.0+0x4fb/0x1090 lib/maple_tree.c:4439
 mas_store+0x268/0x3a0 lib/maple_tree.c:5720
 vma_iter_bulk_store include/linux/mm.h:911 [inline]
 dup_mmap+0xaf7/0x1900 kernel/fork.c:753
 dup_mm kernel/fork.c:1683 [inline]
 copy_mm kernel/fork.c:1732 [inline]
 copy_process+0x4611/0x7580 kernel/fork.c:2498
 kernel_clone+0xeb/0x890 kernel/fork.c:2908
 __do_compat_sys_ia32_clone+0x9e/0xd0 arch/x86/kernel/sys_ia32.c:254
 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
 __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
 entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f56579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ffa32f60 EFLAGS: 00000206 ORIG_RAX: 0000000000000078
RAX: ffffffffffffffda RBX: 0000000001200011 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000568ac3e8
RBP: 00000000f734e000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
   7:	65 0f c1 05 d8 b7 f4 	xadd   %eax,%gs:0x75f4b7d8(%rip)        # 0x75f4b7e7
   e:	75
   f:	83 f8 01             	cmp    $0x1,%eax
  12:	75 29                	jne    0x3d
  14:	9c                   	pushfq
  15:	58                   	pop    %rax
  16:	f6 c4 02             	test   $0x2,%ah
  19:	75 3d                	jne    0x58
  1b:	48 f7 04 24 00 02 00 	testq  $0x200,(%rsp)
  22:	00
  23:	74 01                	je     0x26
  25:	fb                   	sti
  26:	48 83 c4 08          	add    $0x8,%rsp
* 2a:	44 89 e8             	mov    %r13d,%eax <-- trapping instruction
  2d:	5b                   	pop    %rbx
  2e:	5d                   	pop    %rbp
  2f:	41 5c                	pop    %r12
  31:	41 5d                	pop    %r13
  33:	41 5e                	pop    %r14
  35:	41 5f                	pop    %r15
  37:	c3                   	retq
  38:	45 31 ed             	xor    %r13d,%r13d
  3b:	eb b9                	jmp    0xfffffff6
  3d:	0f 0b                	ud2
  3f:	48                   	rex.W