syzbot

------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2192!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 7712 Comm: syz-executor759 Not tainted 4.4.132-gc3c51ea #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cb108000 task.stack: ffff8801b2c88000
RIP: 0010:[<ffffffff82f3b04a>]  [<ffffffff82f3b04a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2192
RSP: 0000:ffff8801db307260  EFLAGS: 00010206
RAX: ffff8801cb108000 RBX: 0000000099babfd0 RCX: 1ffff1003713ddf9
RDX: 0000000000000100 RSI: ffffffff82f3b04a RDI: ffff8801b89eefc8
RBP: ffff8801db3072e0 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003c R11: ffff8801b96c9ddf R12: 0000000000000000
R13: 0000000000000224 R14: 0000000000000000 R15: ffff8801b89eefc0
FS:  00007f55c074a700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020deb000 CR3: 000000009c82c000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8129085c ffff8801d2270844 ffffffff838c36ec ffffffff8113f75d
 ffff8801d2270848 ffff8801b96c9b68 99babfd00000003c 000001e80000003c
 0000003c0000003c ffff8801d2270780 0000000000000000 ffff8801cda5f0c0
Call Trace:
 <IRQ> 
 [<ffffffff832e296f>] icmp_glue_bits+0x7f/0x1e0 net/ipv4/icmp.c:344
 [<ffffffff83212842>] __ip_append_data.isra.44+0x1e22/0x2920 net/ipv4/ip_output.c:1043
 [<ffffffff83213424>] ip_append_data.part.46+0xe4/0x150 net/ipv4/ip_output.c:1192
 [<ffffffff8321b878>] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1181
 [<ffffffff832e257e>] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362
 [<ffffffff832e6f1a>] icmp_send+0xaca/0x13d0 net/ipv4/icmp.c:727
 [<ffffffff832173ba>] ip_fragment.constprop.50+0x1aa/0x200 net/ipv4/ip_output.c:509
 [<ffffffff83217ad4>] ip_finish_output+0x6c4/0xbc0 net/ipv4/ip_output.c:286
 [<ffffffff8321b569>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff8321b569>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff832184ab>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff832184ab>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff832197ae>] ip_queue_xmit+0x88e/0x1ab0 net/ipv4/ip_output.c:461
 [<ffffffff8327f352>] tcp_transmit_skb+0x1642/0x2bf0 net/ipv4/tcp_output.c:1029
 [<ffffffff83289dac>] __tcp_retransmit_skb+0x5fc/0x1860 net/ipv4/tcp_output.c:2647
 [<ffffffff8328b703>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2664
 [<ffffffff83290fed>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff832928f1>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff83292eaa>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff8129085c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff81291582>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81291582>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838c36ec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff8113f75d>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113f75d>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838c2e51>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff838c2e51>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838c1d90>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff811a4447>] ___might_sleep+0x1c7/0x260 kernel/sched/core.c:7960
 [<ffffffff8149f0ee>] clear_huge_page+0x8e/0x470 mm/memory.c:3860
 [<ffffffff815087df>] __do_huge_pmd_anonymous_page mm/huge_memory.c:739 [inline]
 [<ffffffff815087df>] do_huge_pmd_anonymous_page+0x21f/0x9d0 mm/huge_memory.c:867
 [<ffffffff8149cf82>] create_huge_pmd mm/memory.c:3259 [inline]
 [<ffffffff8149cf82>] __handle_mm_fault mm/memory.c:3378 [inline]
 [<ffffffff8149cf82>] handle_mm_fault+0x2852/0x30b0 mm/memory.c:3472
 [<ffffffff810d7aa0>] __do_page_fault+0x360/0xa10 arch/x86/mm/fault.c:1245
 [<ffffffff810d8177>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308
 [<ffffffff838c1608>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1037
Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 1b ff ff ff 8b 5d b4 e8 a6 61 41 fe 8b 45 bc 85 c0 0f 84 7f fe ff ff e8 96 61 41 fe <0f> 0b 8b 5d b4 e9 70 fe ff ff c7 45 b0 00 00 00 00 e9 8c fa ff 
RIP  [<ffffffff82f3b04a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2192
 RSP <ffff8801db307260>
---[ end trace 4567effcfd8fa14e ]---