BUG: please report to dccp@vger.kernel.org => prev = 5, last = 5 at net/dccp/ccids/lib/packet_history.c:414/tfrc_rx_hist_sample_rtt()
CPU: 1 PID: 18038 Comm: syz-executor.2 Not tainted 6.8.0-rc1-syzkaller-00029-g615d30064886 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
 tfrc_rx_hist_sample_rtt+0x3dd/0x4a0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x443/0xf50 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids+0xe3/0x260 net/dccp/input.c:176
 dccp_rcv_established net/dccp/input.c:374 [inline]
 dccp_rcv_established+0x106/0x160 net/dccp/input.c:364
 dccp_v4_do_rcv+0x169/0x1b0 net/dccp/ipv4.c:675
 sk_backlog_rcv include/net/sock.h:1092 [inline]
 __sk_receive_skb+0x2af/0x840 net/core/sock.c:567
 dccp_v4_rcv+0x1281/0x1980 net/dccp/ipv4.c:898
 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x2e4/0x510 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1b8/0x2e0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0xaf/0xd0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5534
 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5648
 process_backlog+0x101/0x6b0 net/core/dev.c:5976
 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576
 napi_poll net/core/dev.c:6645 [inline]
 net_rx_action+0x956/0xe90 net/core/dev.c:6778
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:percpu_counter_add_batch+0xe6/0x1f0 lib/percpu_counter.c:103
Code: e8 5f af ef fc 48 85 db 75 42 e8 c5 b3 ef fc 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 43 af ef fc 48 85 db 0f 85 bd 00 00 00 <48> 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f e9 97 b3 ef fc e8 92 b3
RSP: 0000:ffffc90015337ae8 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff84986ef4
RDX: ffff888082f99dc0 RSI: ffffffff84986f02 RDI: 0000000000000007
RBP: ffff88807b667690 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000005 R12: 000000000000001e
R13: 0000000000000001 R14: 0000607f4647c4a8 R15: 0000000000000020
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 add_mm_counter include/linux/mm.h:2579 [inline]
 set_pte_range+0x3b0/0xa10 mm/memory.c:4526
 filemap_map_order0_folio mm/filemap.c:3513 [inline]
 filemap_map_pages+0x458/0x1290 mm/filemap.c:3559
 do_fault_around mm/memory.c:4696 [inline]
 do_read_fault mm/memory.c:4729 [inline]
 do_fault mm/memory.c:4868 [inline]
 do_pte_missing mm/memory.c:3745 [inline]
 handle_pte_fault mm/memory.c:5144 [inline]
 __handle_mm_fault+0x31cb/0x4900 mm/memory.c:5285
 handle_mm_fault+0x47a/0xa10 mm/memory.c:5450
 do_user_addr_fault+0x30b/0x1030 arch/x86/mm/fault.c:1364
 handle_page_fault arch/x86/mm/fault.c:1507 [inline]
 exc_page_fault+0x5d/0xc0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0023:0xf72204ea
Code: ff 74 24 20 ff 74 24 20 ff 74 24 1c 8b 4c 24 34 e8 1b 3d ff ff 83 c4 20 3b 5c 24 58 0f 82 2a ff ff ff 83 c4 3c 5b 5e 5f 5d c3 <8b> 04 24 c3 8b 0c 24 c3 8b 34 24 c3 8b 3c 24 c3 8b 2c 24 c3 66 90
RSP: 002b:00000000f7f86508 EFLAGS: 00010246
RAX: 00000000f7f8652c RBX: 00000000f7354ff4 RCX: 0000000008f0d180
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
vkms_vblank_simulate: vblank timer overrun
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(133563134035605) <= P.seqno(133563134035604) <= S.SWH(133563134035679)) and (P.ackno exists or LAWL(89179647901912) <= P.ackno(89179647901912) <= S.AWH(89179647901912), sending SYNC...
ccid3_first_li: No RTT estimate available, using fallback RTT
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(218479562477015) <= P.seqno(218479562477014) <= S.SWH(218479562477089)) and (P.ackno exists or LAWL(90663686461284) <= P.ackno(90663686461284) <= S.AWH(90663686461284), sending SYNC...
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(186852531039123) <= P.seqno(186852531039122) <= S.SWH(186852531039197)) and (P.ackno exists or LAWL(94313103996714) <= P.ackno(94313103996714) <= S.AWH(94313103996714), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(266254994661178) <= P.seqno(266254994661177) <= S.SWH(266254994661252)) and (P.ackno exists or LAWL(267676454661100) <= P.ackno(267676454661100) <= S.AWH(267676454661100), sending SYNC...
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(9885478648442) <= P.seqno(9885478648441) <= S.SWH(9885478648516)) and (P.ackno exists or LAWL(15651833656303) <= P.ackno(15651833656303) <= S.AWH(15651833656303), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(167153758042852) <= P.seqno(167153758042851) <= S.SWH(167153758042926)) and (P.ackno exists or LAWL(89646134055236) <= P.ackno(89646134055236) <= S.AWH(89646134055236), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(178562720311340) <= P.seqno(178562720311339) <= S.SWH(178562720311414)) and (P.ackno exists or LAWL(69802693774921) <= P.ackno(69802693774921) <= S.AWH(69802693774921), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(137416252308702) <= P.seqno(137416252308701) <= S.SWH(137416252308776)) and (P.ackno exists or LAWL(80557035903923) <= P.ackno(80557035903923) <= S.AWH(80557035903923), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
net_ratelimit: 13 callbacks suppressed
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(214859813330201) <= P.seqno(214859813330200) <= S.SWH(214859813330275)) and (P.ackno exists or LAWL(260436501080636) <= P.ackno(260436501080636) <= S.AWH(260436501080636), sending SYNC...
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(135725692423184) <= P.seqno(135725692423183) <= S.SWH(135725692423258)) and (P.ackno exists or LAWL(22562127884335) <= P.ackno(22562127884335) <= S.AWH(22562127884335), sending SYNC...
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
   0:	e8 5f af ef fc       	call   0xfcefaf64
   5:	48 85 db             	test   %rbx,%rbx
   8:	75 42                	jne    0x4c
   a:	e8 c5 b3 ef fc       	call   0xfcefb3d4
   f:	9c                   	pushf
  10:	5b                   	pop    %rbx
  11:	81 e3 00 02 00 00    	and    $0x200,%ebx
  17:	31 ff                	xor    %edi,%edi
  19:	48 89 de             	mov    %rbx,%rsi
  1c:	e8 43 af ef fc       	call   0xfcefaf64
  21:	48 85 db             	test   %rbx,%rbx
  24:	0f 85 bd 00 00 00    	jne    0xe7
* 2a:	48 83 c4 18          	add    $0x18,%rsp <-- trapping instruction
  2e:	5b                   	pop    %rbx
  2f:	5d                   	pop    %rbp
  30:	41 5c                	pop    %r12
  32:	41 5d                	pop    %r13
  34:	41 5e                	pop    %r14
  36:	41 5f                	pop    %r15
  38:	e9 97 b3 ef fc       	jmp    0xfcefb3d4
  3d:	e8                   	.byte 0xe8
  3e:	92                   	xchg   %eax,%edx
  3f:	b3                   	.byte 0xb3