WARNING in inet_sock_destruct

Status: fixed on 2025/10/22 03:03
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+760a14df6e917e1c4c61@syzkaller.appspotmail.com
Fix commit: a3967baad4d5 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
First crash: 317d, last: 317d
Fix bisection: fixed by (bisect log) :
commit 66bcb04a441fbf15d66834b7e3eefb313dd750c8
Author: Kuniyuki Iwashima <kuniyu@google.com>
Date: Tue Sep 9 23:26:12 2025 +0000

  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/09/15 linux-6.6.y (ToT) 60a9e718726f C [report] WARNING in inet_sock_destruct
2025/09/15 upstream (ToT) 46a51f4f5eda C Didn't crash
▶ ▼ Similar bugs (15)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 WARNING in inet_sock_destruct (2) origin:upstream -1 syz, C error 10 17d 201d 0/2 upstream: reported C repro on 2026/01/10 00:38
android-49 WARNING in inet_sock_destruct -1 syz, C 728 2891d 2666d 0/3 public: reported C repro on 2019/04/12 00:00
linux-6.1 WARNING in inet_sock_destruct (2) origin:lts-only -1 syz, C inconclusive 16 324d 547d 0/3 upstream: reported C repro on 2025/01/28 09:26
android-44 WARNING in inet_sock_destruct -1 12 2899d 3111d 0/2 auto-closed as invalid on 2019/02/22 12:37
upstream WARNING in inet_sock_destruct (4) net -1 syz, C done 6683 330d 1132d 29/29 fixed on 2025/09/04 16:57
upstream WARNING in inet_sock_destruct (3) net -1 syz, C 87 1151d 1253d 22/29 fixed on 2023/06/08 14:41
upstream WARNING in inet_sock_destruct (5) net -1 syz, C error 8 286d 323d 29/29 fixed on 2025/10/29 21:02
linux-5.15 WARNING in inet_sock_destruct -1 syz, C error 2061 310d 1178d 0/3 auto-obsoleted due to no activity on 2025/12/01 05:33
linux-6.1 WARNING in inet_sock_destruct origin:upstream missing-backport -1 syz, C done 631 591d 1205d 3/3 fixed on 2025/01/27 09:36
android-6-12 WARNING in inet_sock_destruct origin:upstream -1 syz, C 58 334d 397d 0/1 auto-obsoleted due to no activity on 2025/10/18 01:19
upstream WARNING in inet_sock_destruct (2) net -1 syz, C unreliable unreliable 1259 1449d 2080d 0/29 closed as invalid on 2022/10/12 18:26
upstream WARNING in inet_sock_destruct (6) prio:high net -1 syz, C error 639 6d15h 166d 0/29 upstream: reported C repro on 2026/02/13 20:08
upstream WARNING in inet_sock_destruct net -1 5893 3193d 3188d 0/29 closed as invalid on 2018/01/30 22:53
linux-4.14 WARNING in inet_sock_destruct -1 syz, C inconclusive 1 2249d 2309d 0/1 upstream: reported C repro on 2020/04/02 03:04
linux-5.15 WARNING in inet_sock_destruct (2) origin:lts-only -1 syz, C error 49 12d 237d 0/3 upstream: reported C repro on 2025/12/04 18:03

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Modules linked in:
CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:inet_sock_destruct+0x689/0x7a0 net/ipv4/af_inet.c:155
Code: ff ff e8 da 82 85 f8 0f 0b e9 48 fe ff ff e8 ce 82 85 f8 0f 0b 41 80 3c 1c 00 0f 85 74 fe ff ff e9 77 fe ff ff e8 b7 82 85 f8 <0f> 0b e9 dd fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 38 fc ff
RSP: 0018:ffffc900001579a8 EFLAGS: 00010246
RAX: ffffffff89000d89 RBX: dffffc0000000000 RCX: ffff88801be4da00
RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000
RBP: 0000000000000fff R08: ffff88802d27b677 R09: 1ffff11005a4f6ce
R10: dffffc0000000000 R11: ffffed1005a4f6cf R12: ffff88802d27b400
R13: 1ffff11005a4f682 R14: ffff88802d27b628 R15: ffffffff8e0d59a0
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555c59f5c8 CR3: 0000000018ecf000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 __sk_destruct+0x83/0x640 net/core/sock.c:2191
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 run_ksoftirqd+0x9c/0xf0 kernel/softirq.c:950
 smpboot_thread_fn+0x635/0xa00 kernel/smpboot.c:164
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/15 10:51 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2025/09/15 13:32 linux-6.6.y 60a9e718726f e2beed91 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
2025/09/15 08:27 linux-6.6.y 60a9e718726f e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in inet_sock_destruct
* Struck through repros no longer work on HEAD.