------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:163 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:163, CPU#0: kworker/0:2/793
Modules linked in:
CPU: 0 UID: 0 PID: 793 Comm: kworker/0:2 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events delayed_fput
RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:163
Code: f1 4e ff e9 06 fd ff ff e8 7a 81 ff f7 90 0f 0b 90 e9 35 fe ff ff e8 6c 81 ff f7 90 0f 0b 90 e9 c5 fe ff ff e8 5e 81 ff f7 90 <0f> 0b 90 e9 04 ff ff ff e8 50 81 ff f7 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000007d98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88807c869100 RCX: ffffffff8a095ee7
RDX: ffff888026e60000 RSI: ffffffff8a095fe2 RDI: ffff888026e60000
RBP: 0000000000000f70 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000f70 R11: ffffffff8b9080f3 R12: ffff88807c869100
R13: ffff88807c869190 R14: ffffffff81eea6fd R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88812433f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000029000 CR3: 0000000062f91000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __sk_destruct+0x85/0xbb0 net/core/sock.c:2350
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7238
Code: 00 00 00 fc ff df 48 89 eb 48 c1 eb 03 48 01 d3 f6 c4 02 75 47 bf 01 00 00 00 e8 80 18 44 f6 e8 9b 17 7f f6 fb bf 01 00 00 00 <e8> e0 96 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 9e b6 43
RSP: 0018:ffffc90004087768 EFLAGS: 00000206
RAX: 00000000000d47e7 RBX: ffffed1004dcc000 RCX: 0000000000000040
RDX: 0000000000000000 RSI: ffffffff8de788ab RDI: 0000000000000001
RBP: ffff888026e60000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 irqentry_exit+0x17b/0x670 kernel/entry/common.c:239
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lockdep_unregister_key+0x12b/0x1d0 kernel/locking/lockdep.c:6616
Code: e8 da dd ff ff 48 83 2d 1a 2d 49 14 01 89 c3 e8 2b e0 ff ff 9c 58 f6 c4 02 0f 85 8a 00 00 00 f7 c5 00 02 00 00 74 01 fb 84 db <75> 40 5b 5d 41 5c e9 0a 95 09 00 9c 58 f6 c4 02 0f 84 16 ff ff ff
RSP: 0018:ffffc90004087860 EFLAGS: 00000246
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8df6a2ae RDI: ffffffff8c1b1220
RBP: 0000000000000246 R08: 00000000000138bb R09: ffffffff96305d96
R10: 0000000000000200 R11: 0000000000000000 R12: ffffffff9792ec78
R13: ffff888079524000 R14: ffff8880795244d0 R15: 0000000000000100
 qdisc_lock_uninit include/net/pkt_sched.h:332 [inline]
 __qdisc_destroy+0x172/0x560 net/sched/sch_generic.c:1077
 qdisc_put+0xb0/0xf0 net/sched/sch_generic.c:1103
 shutdown_scheduler_queue+0xa5/0x160 net/sched/sch_generic.c:1156
 netdev_for_each_tx_queue include/linux/netdevice.h:2684 [inline]
 dev_shutdown+0xb3/0x440 net/sched/sch_generic.c:1461
 unregister_netdevice_many_notify+0xd56/0x2580 net/core/dev.c:12402
 unregister_netdevice_many net/core/dev.c:12477 [inline]
 unregister_netdevice_queue net/core/dev.c:12291 [inline]
 unregister_netdevice_queue+0x30b/0x3c0 net/core/dev.c:12281
 unregister_netdevice include/linux/netdevice.h:3409 [inline]
 __tun_detach+0x1173/0x1480 drivers/net/tun.c:621
 tun_detach drivers/net/tun.c:637 [inline]
 tun_chr_close+0xc2/0x220 drivers/net/tun.c:3436
 __fput+0x3ff/0xb40 fs/file_table.c:469
 delayed_fput+0x72/0x90 fs/file_table.c:492
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 fc                	add    %bh,%ah
   4:	ff                   	lcall  (bad)
   5:	df 48 89             	fisttps -0x77(%rax)
   8:	eb 48                	jmp    0x52
   a:	c1 eb 03             	shr    $0x3,%ebx
   d:	48 01 d3             	add    %rdx,%rbx
  10:	f6 c4 02             	test   $0x2,%ah
  13:	75 47                	jne    0x5c
  15:	bf 01 00 00 00       	mov    $0x1,%edi
  1a:	e8 80 18 44 f6       	call   0xf644189f
  1f:	e8 9b 17 7f f6       	call   0xf67f17bf
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 e0 96 ff ff       	call   0xffff970f <-- trapping instruction
  2f:	9c                   	pushf
  30:	58                   	pop    %rax
  31:	fa                   	cli
  32:	f6 c4 02             	test   $0x2,%ah
  35:	75 1e                	jne    0x55
  37:	bf 01 00 00 00       	mov    $0x1,%edi
  3c:	e8                   	.byte 0xe8
  3d:	9e                   	sahf
  3e:	b6 43                	mov    $0x43,%dh