BUG: "hc->tx_t_ipi == 0" holds (exception!) at net/dccp/ccids/ccid3.c:101/ccid3_update_send_interval() CPU: 0 PID: 17872 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ccid3_update_send_interval.cold+0x87/0x93 net/dccp/ccids/ccid3.c:101 ccid3_hc_tx_update_s net/dccp/ccids/ccid3.c:178 [inline] ccid3_hc_tx_packet_sent+0x12e/0x160 net/dccp/ccids/ccid3.c:361 ccid_hc_tx_packet_sent net/dccp/ccid.h:178 [inline] dccp_xmit_packet+0x27e/0x760 net/dccp/output.c:289 dccp_write_xmit+0x16d/0x1d0 net/dccp/output.c:363 dccp_sendmsg+0x8de/0xc90 net/dccp/proto.c:816 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xc3/0x120 net/socket.c:661 __sys_sendto+0x21a/0x320 net/socket.c:1899 __do_sys_sendto net/socket.c:1911 [inline] __se_sys_sendto net/socket.c:1907 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f99c412e209 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f99c2a61168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f99c4241100 RCX: 00007f99c412e209 RDX: 000000000000000b RSI: 00000000200002c0 RDI: 0000000000000005 RBP: 00007f99c4188161 R08: 0000000020000300 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd84d9b9df R14: 00007f99c2a61300 R15: 0000000000022000 BUG: "hc->tx_t_ipi == 0" holds (exception!) at net/dccp/ccids/ccid3.c:101/ccid3_update_send_interval() CPU: 1 PID: 17872 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 ccid3_update_send_interval.cold+0x87/0x93 net/dccp/ccids/ccid3.c:101 ccid3_hc_tx_update_s net/dccp/ccids/ccid3.c:178 [inline] ccid3_hc_tx_packet_sent+0x12e/0x160 net/dccp/ccids/ccid3.c:361 ccid_hc_tx_packet_sent net/dccp/ccid.h:178 [inline] dccp_xmit_packet+0x27e/0x760 net/dccp/output.c:289 dccp_write_xmit+0x16d/0x1d0 net/dccp/output.c:363 dccp_sendmsg+0x8de/0xc90 net/dccp/proto.c:816 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xc3/0x120 net/socket.c:661 __sys_sendto+0x21a/0x320 net/socket.c:1899 __do_sys_sendto net/socket.c:1911 [inline] __se_sys_sendto net/socket.c:1907 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f99c412e209 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f99c2a61168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f99c4241100 RCX: 00007f99c412e209 RDX: 000000000000000b RSI: 00000000200002c0 RDI: 0000000000000005 RBP: 00007f99c4188161 R08: 0000000020000300 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd84d9b9df R14: 00007f99c2a61300 R15: 0000000000022000 serio: Serial port pts0 serio: Serial port pts0 serio: Serial port pts0 audit: type=1804 audit(1658634009.849:62): pid=18045 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir984381538/syzkaller.iuoygS/150/file1/bus" dev="loop2" ino=16 res=1 attempt to access beyond end of device loop2: rw=2049, want=92, limit=87 Buffer I/O error on dev loop2, logical block 45, lost async page write attempt to access beyond end of device loop2: rw=2049, want=94, limit=87 Buffer I/O error on dev loop2, logical block 46, lost async page write audit: type=1804 audit(1658634010.359:63): pid=18083 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir984381538/syzkaller.iuoygS/151/file1/bus" dev="loop2" ino=18 res=1 audit: type=1804 audit(1658634010.619:64): pid=18108 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1375240988/syzkaller.T7y4ze/146/file1/bus" dev="loop1" ino=20 res=1 attempt to access beyond end of device loop1: rw=2049, want=92, limit=87 Buffer I/O error on dev loop1, logical block 45, lost async page write attempt to access beyond end of device loop1: rw=2049, want=94, limit=87 audit: type=1804 audit(1658634010.959:65): pid=18123 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir984381538/syzkaller.iuoygS/152/file1/bus" dev="loop2" ino=22 res=1 Buffer I/O error on dev loop1, logical block 46, lost async page write attempt to access beyond end of device loop2: rw=2049, want=92, limit=87 Buffer I/O error on dev loop2, logical block 45, lost async page write attempt to access beyond end of device loop2: rw=2049, want=94, limit=87 Buffer I/O error on dev loop2, logical block 46, lost async page write audit: type=1800 audit(1658634011.539:66): pid=18192 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=14473 res=0 audit: type=1804 audit(1658634011.559:67): pid=18192 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1375240988/syzkaller.T7y4ze/147/file0" dev="sda1" ino=14473 res=1 audit: type=1804 audit(1658634011.879:68): pid=18194 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir984381538/syzkaller.iuoygS/153/cgroup.controllers" dev="sda1" ino=14469 res=1 ieee802154 phy0 wpan0: encryption failed: -22 audit: type=1800 audit(1658634012.349:69): pid=18244 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=13907 res=0 audit: type=1804 audit(1658634012.349:70): pid=18247 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir1375240988/syzkaller.T7y4ze/148/file0" dev="sda1" ino=13907 res=1 overlayfs: filesystem on './bus' not supported as upperdir ieee802154 phy0 wpan0: encryption failed: -22 EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value ieee802154 phy0 wpan0: encryption failed: -22 audit: type=1804 audit(1658634012.879:71): pid=18319 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir984381538/syzkaller.iuoygS/159/file1/bus" dev="loop2" ino=24 res=1 MTD: Attempt to mount non-MTD device "/dev/loop3" romfs: VFS: Can't find a romfs filesystem on dev loop3. EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value F2FS-fs (loop1): Found nat_bits in checkpoint EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value print_req_error: I/O error, dev loop7, sector 480 MTD: Attempt to mount non-MTD device "/dev/loop3" romfs: VFS: Can't find a romfs filesystem on dev loop3. EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value F2FS-fs (loop1): Mounted with checkpoint version = 15213550 print_req_error: I/O error, dev loop7, sector 0 Buffer I/O error on dev loop7, logical block 0, lost async page write print_req_error: I/O error, dev loop7, sector 4 Buffer I/O error on dev loop7, logical block 1, lost async page write print_req_error: I/O error, dev loop7, sector 8 Buffer I/O error on dev loop7, logical block 2, lost async page write print_req_error: I/O error, dev loop7, sector 12 Buffer I/O error on dev loop7, logical block 3, lost async page write print_req_error: I/O error, dev loop7, sector 16 print_req_error: I/O error, dev loop7, sector 20 print_req_error: I/O error, dev loop7, sector 24 print_req_error: I/O error, dev loop7, sector 28 print_req_error: I/O error, dev loop7, sector 32 EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value capability: warning: `syz-executor.0' uses deprecated v2 capabilities in a way that may be insecure MTD: Attempt to mount non-MTD device "/dev/loop3" EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value romfs: VFS: Can't find a romfs filesystem on dev loop3. F2FS-fs (loop1): Found nat_bits in checkpoint EXT4-fs (loop5): Unrecognized mount option "0x0000000000000003" or missing value F2FS-fs (loop1): Mounted with checkpoint version = 15213550 F2FS-fs (loop3): Found nat_bits in checkpoint