------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:163 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:163, CPU#1: kworker/1:3/6001
Modules linked in:
CPU: 1 UID: 0 PID: 6001 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: rcu_gp process_srcu
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:163
Code: e3 4e ff e9 06 fd ff ff e8 3a 48 ff f7 90 0f 0b 90 e9 35 fe ff ff e8 2c 48 ff f7 90 0f 0b 90 e9 c5 fe ff ff e8 1e 48 ff f7 90 <0f> 0b 90 e9 04 ff ff ff e8 10 48 ff f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc900006a0d98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888057ad3300 RCX: ffffffff8a09aec7
RDX: ffff8880336ec980 RSI: ffffffff8a09afc2 RDI: ffff8880336ec980
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: 0000000000000000 R12: ffff888057ad3300
R13: ffff888057ad3390 R14: ffffffff81eebbdd R15: 0000000000000004
FS:  0000000000000000(0000) GS:ffff8880d643c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c38a2db CR3: 000000003005c000 CR4: 0000000000352ef0
DR0: ffffffffffffffff DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xbb0 net/core/sock.c:2350
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rdtsc_ordered arch/x86/include/asm/tsc.h:57 [inline]
RIP: 0010:delay_tsc+0x49/0xc0 arch/x86/lib/delay.c:72
Code: 0f 01 f9 66 90 48 c1 e2 20 48 09 c2 48 89 d5 eb 16 f3 90 bf 01 00 00 00 e8 64 54 46 f6 e8 ff 77 01 00 44 39 e0 75 36 0f 01 f9 <66> 90 48 c1 e2 20 48 89 d3 48 09 c3 48 89 d8 48 29 e8 4c 39 e8 73
RSP: 0018:ffffc90004ae7ac0 EFLAGS: 00000246
RAX: 00000000e34aef0a RBX: 00000034e34aee6a RCX: 0000000000000001
RDX: 0000000000000034 RSI: ffffffff8c1b19a0 RDI: ffffffff8c1b19e0
RBP: 00000034e34adbba R08: 0000000000000000 R09: 0000000000000002
R10: ffffe8ffffd7f947 R11: 0000000000000000 R12: 0000000000000001
R13: 00000000000032c9 R14: ffff88802b7d1828 R15: dffffc0000000000
 udelay include/asm-generic/delay.h:64 [inline]
 try_check_zero+0x3e0/0x740 kernel/rcu/srcutree.c:1160
 srcu_advance_state kernel/rcu/srcutree.c:1864 [inline]
 process_srcu+0x74a/0x1fd0 kernel/rcu/srcutree.c:1973
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 01 f9             	rdtscp
   3:	66 90                	xchg   %ax,%ax
   5:	48 c1 e2 20          	shl    $0x20,%rdx
   9:	48 09 c2             	or     %rax,%rdx
   c:	48 89 d5             	mov    %rdx,%rbp
   f:	eb 16                	jmp    0x27
  11:	f3 90                	pause
  13:	bf 01 00 00 00       	mov    $0x1,%edi
  18:	e8 64 54 46 f6       	call   0xf6465481
  1d:	e8 ff 77 01 00       	call   0x17821
  22:	44 39 e0             	cmp    %r12d,%eax
  25:	75 36                	jne    0x5d
  27:	0f 01 f9             	rdtscp
* 2a:	66 90                	xchg   %ax,%ax <-- trapping instruction
  2c:	48 c1 e2 20          	shl    $0x20,%rdx
  30:	48 89 d3             	mov    %rdx,%rbx
  33:	48 09 c3             	or     %rax,%rbx
  36:	48 89 d8             	mov    %rbx,%rax
  39:	48 29 e8             	sub    %rbp,%rax
  3c:	4c 39 e8             	cmp    %r13,%rax
  3f:	73                   	.byte 0x73