------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162, CPU#1: syz.4.1169/9850
Modules linked in:
CPU: 1 UID: 0 PID: 9850 Comm: syz.4.1169 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162
Code: 0f 0b 90 e9 58 fe ff ff e8 c0 5c 9f f7 90 0f 0b 90 e9 8b fe ff ff e8 b2 5c 9f f7 90 0f 0b 90 e9 b1 fe ff ff e8 a4 5c 9f f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000a08d48 EFLAGS: 00010246
RAX: ffffffff8a26445c RBX: dffffc0000000000 RCX: ffff88802ed2bd00
RDX: 0000000000000100 RSI: 0000000000000f70 RDI: 0000000000000000
RBP: 0000000000000f70 R08: ffff88801ab72d27 R09: 1ffff1100356e5a4
R10: dffffc0000000000 R11: ffffed100356e5a5 R12: ffff88801ab72a80
R13: dffffc0000000000 R14: ffff88801ab72d0c R15: ffffffff8fca5580
FS:  0000000000000000(0000) GS:ffff888125561000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31116ff8 CR3: 0000000077978000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0x880 net/core/sock.c:2350
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:arch_check_zapped_pte+0x83/0xb0 arch/x86/mm/pgtable.c:833
Code: cc cc e8 90 52 4d 00 83 e3 42 bf 40 00 00 00 48 89 de e8 60 57 4d 00 48 83 fb 40 74 17 e8 75 52 4d 00 eb 05 e8 6e 52 4d 00 5b <41> 5e 41 5f e9 04 2a 3a 0a cc e8 5e 52 4d 00 90 0f 0b 90 eb ea e8
RSP: 0018:ffffc90002e8f388 EFLAGS: 00000293
RAX: ffffffff81784ead RBX: 0000000000000000 RCX: ffff88802ed2bd00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002e8f670 R08: ffffea0001942e07 R09: 1ffffd40003285c0
R10: dffffc0000000000 R11: fffff940003285c1 R12: 1ffffd40003285c3
R13: dffffc0000000000 R14: 00000000180400fb R15: 0000000000000000
 zap_present_folio_ptes mm/memory.c:1660 [inline]
 zap_present_ptes mm/memory.c:1725 [inline]
 do_zap_pte_range mm/memory.c:1827 [inline]
 zap_pte_range mm/memory.c:1929 [inline]
 zap_pmd_range mm/memory.c:2021 [inline]
 zap_pud_range mm/memory.c:2049 [inline]
 zap_p4d_range mm/memory.c:2070 [inline]
 unmap_page_range+0x1b4c/0x48f0 mm/memory.c:2091
 unmap_single_vma mm/memory.c:2133 [inline]
 unmap_vmas+0x48f/0x6a0 mm/memory.c:2171
 exit_mmap+0x280/0xa10 mm/mmap.c:1302
 __mmput+0x118/0x430 kernel/fork.c:1175
 exit_mm+0x168/0x220 kernel/exit.c:581
 do_exit+0x6a2/0x23c0 kernel/exit.c:964
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
 get_signal+0x1284/0x1330 kernel/signal.c:3034
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f24fdf9c799
Code: Unable to access opcode bytes at 0x7f24fdf9c76f.
RSP: 002b:00007f24fede40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f24fe215fa8 RCX: 00007f24fdf9c799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f24fe215fa8
RBP: 00007f24fe215fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f24fe216038 R14: 00007ffc5deecbb0 R15: 00007ffc5deecc98
 </TASK>
----------------
Code disassembly (best guess):
   0:	cc                   	int3
   1:	cc                   	int3
   2:	e8 90 52 4d 00       	call   0x4d5297
   7:	83 e3 42             	and    $0x42,%ebx
   a:	bf 40 00 00 00       	mov    $0x40,%edi
   f:	48 89 de             	mov    %rbx,%rsi
  12:	e8 60 57 4d 00       	call   0x4d5777
  17:	48 83 fb 40          	cmp    $0x40,%rbx
  1b:	74 17                	je     0x34
  1d:	e8 75 52 4d 00       	call   0x4d5297
  22:	eb 05                	jmp    0x29
  24:	e8 6e 52 4d 00       	call   0x4d5297
  29:	5b                   	pop    %rbx
* 2a:	41 5e                	pop    %r14 <-- trapping instruction
  2c:	41 5f                	pop    %r15
  2e:	e9 04 2a 3a 0a       	jmp    0xa3a2a37
  33:	cc                   	int3
  34:	e8 5e 52 4d 00       	call   0x4d5297
  39:	90                   	nop
  3a:	0f 0b                	ud2
  3c:	90                   	nop
  3d:	eb ea                	jmp    0x29
  3f:	e8                   	.byte 0xe8