------------[ cut here ]------------
WARNING: CPU: 0 PID: 5888 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x6e7/0x7f0
Modules linked in:
CPU: 0 PID: 5888 Comm: syz-executor.2 Not tainted 6.1.86-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:inet_sock_destruct+0x6e7/0x7f0 net/ipv4/af_inet.c:154
Code: ff ff e8 cc cf 6e f8 0f 0b e9 21 fe ff ff e8 c0 cf 6e f8 0f 0b 41 80 3c 2c 00 0f 85 4c fe ff ff e9 4f fe ff ff e8 a9 cf 6e f8 <0f> 0b e9 bb fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0e fc ff
RSP: 0018:ffffc90000007b30 EFLAGS: 00010246
RAX: ffffffff891bbfa7 RBX: 0000000000000400 RCX: ffff88805cc95940
RDX: 0000000000000103 RSI: 0000000000000400 RDI: 0000000000000000
RBP: ffff88814b526600 R08: ffffffff891bbe5c R09: ffffed10296a4d0f
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110296a4cc5
R13: ffff88814b526ae8 R14: ffff88814b526628 R15: ffff88814b526612
FS: 00007ffac3f846c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffac33ad988 CR3: 0000000070b4f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__sk_destruct+0x50/0x5f0 net/core/sock.c:2138
rcu_do_batch kernel/rcu/tree.c:2296 [inline]
rcu_core+0xad5/0x1810 kernel/rcu/tree.c:2556
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:lock_acquire+0x26f/0x5a0 kernel/locking/lockdep.c:5666
Code: 2b 00 74 08 4c 89 f7 e8 6f 9f 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc9000a2cf2c0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92001459e64 RCX: 1ffff92001459e04
RDX: dffffc0000000000 RSI: ffffffff8aec1340 RDI: ffffffff8b3d42e0
RBP: ffffc9000a2cf420 R08: dffffc0000000000 R09: fffffbfff2093445
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001459e60
R13: dffffc0000000000 R14: ffffc9000a2cf320 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:883 [inline]
pfn_valid+0x113/0x440 include/linux/mmzone.h:1857
page_table_check_set+0x25/0x6f0 mm/page_table_check.c:105
page_table_check_pte_set include/linux/page_table_check.h:83 [inline]
set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline]
copy_present_pte mm/memory.c:1000 [inline]
copy_pte_range mm/memory.c:1091 [inline]
copy_pmd_range mm/memory.c:1177 [inline]
copy_pud_range mm/memory.c:1214 [inline]
copy_p4d_range mm/memory.c:1238 [inline]
copy_page_range+0x2d50/0x4660 mm/memory.c:1336
dup_mmap kernel/fork.c:696 [inline]
dup_mm kernel/fork.c:1540 [inline]
copy_mm+0xf42/0x1990 kernel/fork.c:1589
copy_process+0x19d5/0x4060 kernel/fork.c:2267
kernel_clone+0x222/0x920 kernel/fork.c:2682
__do_sys_clone kernel/fork.c:2823 [inline]
__se_sys_clone kernel/fork.c:2807 [inline]
__x64_sys_clone+0x231/0x280 kernel/fork.c:2807
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ffac327de69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffac3f84078 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffac33abf80 RCX: 00007ffac327de69
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffac32ca47a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007ffac33abf80 R15: 00007ffc88784028
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 6f 9f 77 00 call 0x779f7b
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 84 01 00 00 jne 0x19b
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25