------------[ cut here ]------------
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162, CPU#1: syz-executor/6020
Modules linked in:
CPU: 1 UID: 0 PID: 6020 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:inet_sock_destruct+0x62d/0x740 net/ipv4/af_inet.c:162
Code: 0f 0b 90 e9 58 fe ff ff e8 10 a8 9d f7 90 0f 0b 90 e9 8b fe ff ff e8 02 a8 9d f7 90 0f 0b 90 e9 b1 fe ff ff e8 f4 a7 9d f7 90 <0f> 0b 90 e9 d7 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 95 fc
RSP: 0018:ffffc90000a08d20 EFLAGS: 00010246
RAX: ffffffff8a281ccc RBX: dffffc0000000000 RCX: ffff88802fe48000
RDX: 0000000000000100 RSI: 0000000000000090 RDI: 0000000000000000
RBP: 0000000000000090 R08: ffff88807cf28b27 R09: 1ffff1100f9e5164
R10: dffffc0000000000 R11: ffffed100f9e5165 R12: ffff88807cf28880
R13: ffff88807cf28d88 R14: ffff88807cf28b0c R15: ffffffff8feb2d40
FS:  000055558e11c500(0000) GS:ffff888125376000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055558e11c7d0 CR3: 000000007e714000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __sk_destruct+0x8d/0x9d0 net/core/sock.c:2352
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
 handle_softirqs+0x22a/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:memcg1_commit_charge+0x202/0x290 mm/memcontrol-v1.c:604
Code: 40 84 ed 75 5f 41 f7 c5 00 02 00 00 74 05 e8 25 fa 95 ff 9c 58 a9 00 02 00 00 75 38 41 f7 c5 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc ba 01 00 00 00 4c
RSP: 0018:ffffc9000252f840 EFLAGS: 00000292
RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000000000046
RDX: 0000000000000007 RSI: ffffffff8dfb6879 RDI: ffffffff8c28b760
RBP: 00000000000005c4 R08: ffffffff903135f7 R09: 1ffffffff20626be
R10: dffffc0000000000 R11: fffffbfff20626bf R12: 1ffff1100fe23a10
R13: 0000000000000246 R14: 00fff00000000000 R15: ffff88807f11d080
 charge_memcg+0x216/0x2b0 mm/memcontrol.c:5021
 __mem_cgroup_charge+0x25/0x80 mm/memcontrol.c:5032
 mem_cgroup_charge include/linux/memcontrol.h:644 [inline]
 folio_prealloc mm/memory.c:1214 [inline]
 wp_page_copy mm/memory.c:3875 [inline]
 do_wp_page+0x11b5/0x4cc0 mm/memory.c:4336
 handle_pte_fault mm/memory.c:6443 [inline]
 __handle_mm_fault mm/memory.c:6565 [inline]
 handle_mm_fault+0x151f/0x3170 mm/memory.c:6734
 do_user_addr_fault+0x75b/0x1340 arch/x86/mm/fault.c:1385
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:__put_user_4+0xd/0x20 arch/x86/lib/putuser.S:94
Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc9000252fe48 EFLAGS: 00050202
RAX: 0000000000000090 RBX: 0000000000000000 RCX: 000055558e11c7d0
RDX: 0000000000000000 RSI: ffffffff8e22b5d6 RDI: ffff88802fe48000
RBP: ffffc9000252ff38 R08: ffffffff818fa368 R09: ffffffff8e95cca0
R10: dffffc0000000000 R11: fffffbfff20626bf R12: 1ffff11005fc90e0
R13: dffffc0000000000 R14: ffff88802fe48000 R15: dffffc0000000000
 schedule_tail+0x9d/0xc0 kernel/sched/core.c:5320
 ret_from_fork+0x83/0xb70 arch/x86/kernel/process.c:154
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	40 84 ed             	test   %bpl,%bpl
   3:	75 5f                	jne    0x64
   5:	41 f7 c5 00 02 00 00 	test   $0x200,%r13d
   c:	74 05                	je     0x13
   e:	e8 25 fa 95 ff       	call   0xff95fa38
  13:	9c                   	pushf
  14:	58                   	pop    %rax
  15:	a9 00 02 00 00       	test   $0x200,%eax
  1a:	75 38                	jne    0x54
  1c:	41 f7 c5 00 02 00 00 	test   $0x200,%r13d
  23:	74 01                	je     0x26
  25:	fb                   	sti
  26:	48 83 c4 08          	add    $0x8,%rsp
* 2a:	5b                   	pop    %rbx <-- trapping instruction
  2b:	41 5c                	pop    %r12
  2d:	41 5d                	pop    %r13
  2f:	41 5e                	pop    %r14
  31:	41 5f                	pop    %r15
  33:	5d                   	pop    %rbp
  34:	c3                   	ret
  35:	cc                   	int3
  36:	cc                   	int3
  37:	cc                   	int3
  38:	cc                   	int3
  39:	cc                   	int3
  3a:	ba 01 00 00 00       	mov    $0x1,%edx
  3f:	4c                   	rex.WR