BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 PID: 23832 Comm: syz-executor.3 Not tainted 6.1.82-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
tfrc_rx_hist_sample_rtt+0x38f/0x4a0 net/dccp/ccids/lib/packet_history.c:414
ccid3_hc_rx_packet_recv+0x6aa/0xf40 net/dccp/ccids/ccid3.c:760
ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
dccp_rcv_established+0x1b3/0x310 net/dccp/input.c:374
dccp_v4_do_rcv+0xfb/0x1e0 net/dccp/ipv4.c:674
sk_backlog_rcv include/net/sock.h:1117 [inline]
__sk_receive_skb+0x41a/0x9d0 net/core/sock.c:568
ip_protocol_deliver_rcu+0x381/0x740 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x2b4/0x4f0 net/ipv4/ip_input.c:233
NF_HOOK+0x39d/0x450 include/linux/netfilter.h:302
NF_HOOK+0x39d/0x450 include/linux/netfilter.h:302
__netif_receive_skb_one_core net/core/dev.c:5528 [inline]
__netif_receive_skb+0x1c6/0x530 net/core/dev.c:5642
process_backlog+0x381/0x760 net/core/dev.c:5970
__napi_poll+0xc7/0x470 net/core/dev.c:6537
napi_poll net/core/dev.c:6604 [inline]
net_rx_action+0x70f/0xeb0 net/core/dev.c:6715
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:lock_acquire+0x26f/0x5a0 kernel/locking/lockdep.c:5666
Code: 2b 00 74 08 4c 89 f7 e8 2f a5 77 00 f6 44 24 61 02 0f 85 84 01 00 00 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 43 c7 44 25 09 00 00 00 00 43 c7 44 25
RSP: 0018:ffffc9000b9bf2e0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff92001737e68 RCX: 1ffff92001737e08
RDX: dffffc0000000000 RSI: ffffffff8aebffc0 RDI: ffffffff8b3d2b40
RBP: ffffc9000b9bf428 R08: dffffc0000000000 R09: fffffbfff2092c45
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001737e64
R13: dffffc0000000000 R14: ffffc9000b9bf340 R15: 0000000000000246
rcu_lock_acquire include/linux/rcupdate.h:319 [inline]
rcu_read_lock include/linux/rcupdate.h:760 [inline]
page_ext_get+0x39/0x2a0 mm/page_ext.c:157
page_table_check_set+0x5d/0x6f0 mm/page_table_check.c:109
page_table_check_pte_set include/linux/page_table_check.h:83 [inline]
set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline]
copy_present_pte mm/memory.c:1000 [inline]
copy_pte_range mm/memory.c:1091 [inline]
copy_pmd_range mm/memory.c:1177 [inline]
copy_pud_range mm/memory.c:1214 [inline]
copy_p4d_range mm/memory.c:1238 [inline]
copy_page_range+0x2d50/0x4660 mm/memory.c:1336
dup_mmap kernel/fork.c:696 [inline]
dup_mm kernel/fork.c:1540 [inline]
copy_mm+0xf42/0x1990 kernel/fork.c:1589
copy_process+0x19d5/0x4060 kernel/fork.c:2267
kernel_clone+0x222/0x920 kernel/fork.c:2682
__do_sys_clone kernel/fork.c:2823 [inline]
__se_sys_clone kernel/fork.c:2807 [inline]
__x64_sys_clone+0x231/0x280 kernel/fork.c:2807
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f1df847add3
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe8178a158 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1df847add3
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 00005555571ab750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
----------------
Code disassembly (best guess):
0: 2b 00 sub (%rax),%eax
2: 74 08 je 0xc
4: 4c 89 f7 mov %r14,%rdi
7: e8 2f a5 77 00 call 0x77a53b
c: f6 44 24 61 02 testb $0x2,0x61(%rsp)
11: 0f 85 84 01 00 00 jne 0x19b
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 43 c7 44 25 09 00 00 movl $0x0,0x9(%r13,%r12,1)
3a: 00 00
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 25 .byte 0x25