------------[ cut here ]------------
WARNING: CPU: 0 PID: 6608 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Modules linked in:
CPU: 0 PID: 6608 Comm: syz.0.19 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Code: ff ff e8 da 82 85 f8 0f 0b e9 48 fe ff ff e8 ce 82 85 f8 0f 0b 41 80 3c 1c 00 0f 85 74 fe ff ff e9 77 fe ff ff e8 b7 82 85 f8 <0f> 0b e9 dd fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 fc ff
RSP: 0018:ffffc90000007b48 EFLAGS: 00010246
RAX: ffffffff89000d89 RBX: dffffc0000000000 RCX: ffff888029710000
RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000
RBP: 0000000000000fff R08: ffff88805fbda977 R09: 1ffff1100bf7b52e
R10: dffffc0000000000 R11: ffffed100bf7b52f R12: ffff88805fbda700
R13: 1ffff1100bf7b4e2 R14: ffff88805fbda928 R15: ffffffff8e0d59a0
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000023c0 CR3: 000000000cb30000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 __sk_destruct+0x83/0x640 net/core/sock.c:2191
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:tlb_flush_rmaps+0x0/0x2e0 mm/mmu_gather.c:74
Code: 4a 8e e8 23 db 10 00 48 89 1d c4 9c 7e 0c 48 c7 c7 00 f6 b4 8a 48 89 de e8 4d ca 96 08 e9 ba fe ff ff cc cc cc cc cc cc cc cc <66> 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 20 48 89 74 24
RSP: 0018:ffffc90003bf74b8 EFLAGS: 00000206
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffffc90003bf78c0 RSI: ffff88805fbb8000 RDI: ffffc90003bf78a0
RBP: ffffc90003bf76b0 R08: ffffc90003bf78bf R09: 0000000000000000
R10: ffffc90003bf78b0 R11: fffff5200077ef18 R12: 0000001b32964000
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000001b32964000
 zap_pte_range mm/memory.c:1520 [inline]
 zap_pmd_range mm/memory.c:1570 [inline]
 zap_pud_range mm/memory.c:1599 [inline]
 zap_p4d_range mm/memory.c:1620 [inline]
 unmap_page_range+0x2617/0x2fe0 mm/memory.c:1641
 unmap_vmas+0x25e/0x3a0 mm/memory.c:1731
 exit_mmap+0x200/0xb50 mm/mmap.c:3302
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 get_signal+0x12fc/0x1400 kernel/signal.c:2902
 arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7d8ab8eba9
Code: Unable to access opcode bytes at 0x7f7d8ab8eb7f.
RSP: 002b:00007f7d8b9ed0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f7d8add5fa8 RCX: 00007f7d8ab8eba9
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7d8add5fac
RBP: 00007f7d8add5fa0 R08: 0000000000745a54 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7d8add6038 R14: 00007fff4b202b30 R15: 00007fff4b202c18
 </TASK>
----------------
Code disassembly (best guess):
   0:	4a 8e e8             	rex.WX mov %rax,%gs
   3:	23 db                	and    %ebx,%ebx
   5:	10 00                	adc    %al,(%rax)
   7:	48 89 1d c4 9c 7e 0c 	mov    %rbx,0xc7e9cc4(%rip)        # 0xc7e9cd2
   e:	48 c7 c7 00 f6 b4 8a 	mov    $0xffffffff8ab4f600,%rdi
  15:	48 89 de             	mov    %rbx,%rsi
  18:	e8 4d ca 96 08       	call   0x896ca6a
  1d:	e9 ba fe ff ff       	jmp    0xfffffedc
  22:	cc                   	int3
  23:	cc                   	int3
  24:	cc                   	int3
  25:	cc                   	int3
  26:	cc                   	int3
  27:	cc                   	int3
  28:	cc                   	int3
  29:	cc                   	int3
* 2a:	66 0f 1f 00          	nopw   (%rax) <-- trapping instruction
  2e:	55                   	push   %rbp
  2f:	41 57                	push   %r15
  31:	41 56                	push   %r14
  33:	41 55                	push   %r13
  35:	41 54                	push   %r12
  37:	53                   	push   %rbx
  38:	48 83 ec 20          	sub    $0x20,%rsp
  3c:	48                   	rex.W
  3d:	89                   	.byte 0x89
  3e:	74 24                	je     0x64