------------[ cut here ]------------ WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x554/0x650 net/ipv4/af_inet.c:162, CPU#1: syz.3.94/5277 Modules linked in: CPU: 1 UID: 0 PID: 5277 Comm: syz.3.94 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : inet_sock_destruct+0x554/0x650 net/ipv4/af_inet.c:162 lr : inet_sock_destruct+0x554/0x650 net/ipv4/af_inet.c:162 sp : ffff80008ebe7380 x29: ffff80008ebe7390 x28: ffff700011d7ced4 x27: ffff0000dbd8b400 x26: dfff800000000000 x25: ffff0000dbd8b400 x24: 1fffe0001b7b1692 x23: 1fffe0001b7b1682 x22: dfff800000000000 x21: ffff0000dbd8b412 x20: 0000000000000c38 x19: ffff0000dbd8b68c x18: 00000000ffffffff x17: ffff800125246000 x16: ffff80008ebe0000 x15: ffff800084cf1104 x14: 000000000061c875 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: ffff60001b7b16d5 x9 : 0000000000000101 x8 : 0000000000000000 x7 : ffff8000850373b4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008559440c x2 : 0000000000000c38 x1 : ffff0000c85f9d80 x0 : 0000000000000000 Call trace: inet_sock_destruct+0x554/0x650 net/ipv4/af_inet.c:162 (P) tcp4_destruct_sock+0x28/0x38 net/ipv4/tcp_ipv4.c:2389 espintcp_destruct+0x64/0x80 net/xfrm/espintcp.c:427 __sk_destruct+0x80/0x854 net/core/sock.c:2356 sk_destruct+0x8c/0xb8 net/core/sock.c:2418 __sk_free+0x2c4/0x3bc net/core/sock.c:2429 sk_free+0x60/0xc4 net/core/sock.c:2440 sock_put+0x60/0xc4 include/net/sock.h:2020 tcp_v4_rcv+0x1e9c/0x2624 net/ipv4/tcp_ipv4.c:2258 ip_protocol_deliver_rcu+0x20c/0x468 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x320/0x65c net/ipv4/ip_input.c:241 NF_HOOK+0x308/0x398 include/linux/netfilter.h:325 ip_local_deliver+0x128/0x188 net/ipv4/ip_input.c:262 dst_input include/net/dst.h:480 [inline] ip_rcv_finish+0x20c/0x230 net/ipv4/ip_input.c:492 NF_HOOK+0x308/0x398 include/linux/netfilter.h:325 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:612 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6264 __netif_receive_skb+0x34/0x128 net/core/dev.c:6377 process_backlog+0x5f4/0x16f8 net/core/dev.c:6728 __napi_poll+0xb4/0x328 net/core/dev.c:7787 napi_poll net/core/dev.c:7850 [inline] net_rx_action+0x5b0/0xc14 net/core/dev.c:8007 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 do_softirq+0x90/0xf8 kernel/softirq.c:546 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:473 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline] __dev_queue_xmit+0x14d4/0x2bc0 net/core/dev.c:4961 dev_queue_xmit include/linux/netdevice.h:3461 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xcd0/0x1274 net/ipv4/ip_output.c:236 __ip_finish_output+0x198/0x41c net/ipv4/ip_output.c:-1 ip_finish_output+0x44/0x2fc net/ipv4/ip_output.c:324 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x28c/0x400 net/ipv4/ip_output.c:437 dst_output include/net/dst.h:470 [inline] ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 __ip_queue_xmit+0xd58/0x16bc net/ipv4/ip_output.c:533 ip_queue_xmit+0x5c/0x7c net/ipv4/ip_output.c:547 __tcp_transmit_skb+0x1e9c/0x3860 net/ipv4/tcp_output.c:1716 tcp_transmit_skb net/ipv4/tcp_output.c:1734 [inline] tcp_write_xmit+0x1330/0x4794 net/ipv4/tcp_output.c:3062 __tcp_push_pending_frames+0x98/0x320 net/ipv4/tcp_output.c:3245 tcp_send_fin+0x624/0xa94 net/ipv4/tcp_output.c:3844 __tcp_close+0x3a4/0xd48 net/ipv4/tcp.c:3219 tcp_close+0x38/0x140 net/ipv4/tcp.c:3310 inet_release+0x154/0x1cc net/ipv4/af_inet.c:442 __sock_release+0xa0/0x1d4 net/socket.c:735 sock_close+0x24/0x38 net/socket.c:1526 __fput+0x338/0x74c fs/file_table.c:512 ____fput+0x20/0x30 fs/file_table.c:540 task_work_run+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 irq event stamp: 2629 hardirqs last enabled at (2628): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (2628): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (2629): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445 softirqs last enabled at (2522): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (2522): [] rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline] softirqs last enabled at (2522): [] __dev_queue_xmit+0x14cc/0x2bc0 net/core/dev.c:4961 softirqs last disabled at (2523): [] __do_softirq+0x14/0x20 kernel/softirq.c:679 ---[ end trace 0000000000000000 ]---