------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x62b/0x740 net/ipv4/af_inet.c:162, CPU#0: syz.3.1460/11620
Modules linked in:
CPU: 0 UID: 0 PID: 11620 Comm: syz.3.1460 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:inet_sock_destruct+0x62b/0x740 net/ipv4/af_inet.c:162
Code: 0f 0b 90 e9 58 fe ff ff e8 52 60 7a f7 90 0f 0b 90 e9 8b fe ff ff e8 44 60 7a f7 90 0f 0b 90 e9 b1 fe ff ff e8 36 60 7a f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000007d28 EFLAGS: 00010246
RAX: ffffffff8a4c120a RBX: dffffc0000000000 RCX: ffff888023790000
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff88802a177127 R09: 1ffff1100542ee24
R10: dffffc0000000000 R11: ffffed100542ee25 R12: ffff88802a176e80
R13: dffffc0000000000 R14: ffff88802a17710c R15: ffffffff9010d380
FS:  00007f3cb45d16c0(0000) GS:ffff888124f5e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000068e030 CR3: 000000002aae0000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __sk_destruct+0x89/0x9d0 net/core/sock.c:2357
 rcu_do_batch kernel/rcu/tree.c:2645 [inline]
 rcu_core+0x78b/0x10a0 kernel/rcu/tree.c:2897
 handle_softirqs+0x225/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 89 fb e8 23 00 00 00 48 8b 3d 14 2e 89 0c 48 89 de 5b e9 13 03 62 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d b8 ad a5 11 65 8b 15 d9 ad a5
RSP: 0018:ffffc90003c2f138 EFLAGS: 00000246
RAX: ffffffff84d0565c RBX: ffffc90003c2fd28 RCX: ffff888023790000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003c2f2b0 R08: ffffffff821b447f R09: 0000000000000000
R10: 0000000000000000 R11: ffff88807f307678 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff92000785fa2
 iterate_and_advance2 include/linux/iov_iter.h:298 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0x30e/0x1810 lib/iov_iter.c:197
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0xf8/0x980 net/core/datagram.c:402
 skb_copy_datagram_iter+0xb5/0x240 net/core/datagram.c:535
 skb_copy_datagram_msg include/linux/skbuff.h:4244 [inline]
 tcp_recvmsg_locked+0xf79/0x3800 net/ipv4/tcp.c:2840
 tcp_recvmsg+0x203/0x7f0 net/ipv4/tcp.c:2944
 sock_recvmsg_nosec+0x95/0x170 net/socket.c:1127
 ____sys_recvmsg+0x3e3/0x4a0 net/socket.c:2902
 ___sys_recvmsg+0x213/0x5a0 net/socket.c:2946
 do_recvmmsg+0x31a/0x7f0 net/socket.c:3041
 __sys_recvmmsg net/socket.c:3115 [inline]
 __do_sys_recvmmsg net/socket.c:3138 [inline]
 __se_sys_recvmmsg net/socket.c:3131 [inline]
 __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3131
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3cb379de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3cb45d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f3cb3a26180 RCX: 00007f3cb379de59
RDX: 03fffffffffffde9 RSI: 0000200000008bc0 RDI: 000000000000000a
RBP: 00007f3cb3833e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3cb3a26218 R14: 00007f3cb3a26180 R15: 00007fff768dce48
 </TASK>
----------------
Code disassembly (best guess):
   0:	89 fb                	mov    %edi,%ebx
   2:	e8 23 00 00 00       	call   0x2a
   7:	48 8b 3d 14 2e 89 0c 	mov    0xc892e14(%rip),%rdi        # 0xc892e22
   e:	48 89 de             	mov    %rbx,%rsi
  11:	5b                   	pop    %rbx
  12:	e9 13 03 62 00       	jmp    0x62032a
  17:	cc                   	int3
  18:	cc                   	int3
  19:	cc                   	int3
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	90                   	nop
  1f:	90                   	nop
  20:	90                   	nop
  21:	90                   	nop
  22:	90                   	nop
  23:	90                   	nop
  24:	90                   	nop
  25:	90                   	nop
  26:	90                   	nop
  27:	90                   	nop
  28:	90                   	nop
  29:	90                   	nop
* 2a:	f3 0f 1e fa          	endbr64 <-- trapping instruction
  2e:	48 8b 04 24          	mov    (%rsp),%rax
  32:	65 48 8b 0d b8 ad a5 	mov    %gs:0x11a5adb8(%rip),%rcx        # 0x11a5adf2
  39:	11
  3a:	65                   	gs
  3b:	8b                   	.byte 0x8b
  3c:	15                   	.byte 0x15
  3d:	d9                   	.byte 0xd9
  3e:	ad                   	lods   %ds:(%rsi),%eax
  3f:	a5                   	movsl  %ds:(%rsi),%es:(%rdi)