------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2838!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 6193 Comm: syz-executor6 Not tainted 4.15.0-rc8+ #201
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__tcp_retransmit_skb+0x258f/0x2700 net/ipv4/tcp_output.c:2838
RSP: 0018:ffff8801db207148 EFLAGS: 00010206
RAX: ffff8801d61b86c0 RBX: 0000000000000001 RCX: ffffffff84928cbf
RDX: 0000000000000100 RSI: ffff8801bf6aa238 RDI: ffff8801be12f2ec
RBP: ffff8801db207450 R08: ffff88021fff801c R09: 0000000000000000
R10: ffff88021fff8010 R11: ffff88021fff801d R12: ffff8801be12f34e
R13: 00000000d026038d R14: ffff8801be12f2c0 R15: ffff8801bf6aa000
FS:  00007fe66a2bb700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020e68000 CR3: 00000001bd7c2006 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2920
 tcp_retransmit_timer+0xe7e/0x27b0 net/ipv4/tcp_timer.c:465
 tcp_write_timer_handler+0x335/0x820 net/ipv4/tcp_timer.c:550
 tcp_write_timer+0x152/0x170 net/ipv4/tcp_timer.c:570
 call_timer_fn+0x228/0x820 kernel/time/timer.c:1318
 expire_timers kernel/time/timer.c:1355 [inline]
 __run_timers+0x7ee/0xb70 kernel/time/timer.c:1658
 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1684
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285
 invoke_softirq kernel/softirq.c:365 [inline]
 irq_exit+0x1cc/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:541 [inline]
 smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:937
 </IRQ>
RIP: 0010:__sanitizer_cov_trace_pc+0x1/0x50 kernel/kcov.c:94
RSP: 0018:ffff8801d90ee070 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff11
RAX: 0000000000000003 RBX: ffff8801d83e2640 RCX: 1ffffffff0c402d0
RDX: 0000000000000000 RSI: ffffc900044cf000 RDI: ffff8801c0900810
RBP: ffff8801d90ee160 R08: 0000000000000000 R09: 1ffff1003b21dc0f
R10: ffff8801d90ee040 R11: 0000000000000002 R12: 1ffff1003b21dc13
R13: ffff8801cf4a6100 R14: ffff8801c0900800 R15: ffffffff86201680
 NF_HOOK_COND include/linux/netfilter.h:277 [inline]
 ip_output+0x1d2/0x860 net/ipv4/ip_output.c:405
 dst_output include/net/dst.h:443 [inline]
 ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
 ip_queue_xmit+0x8c0/0x18e0 net/ipv4/ip_output.c:504
 sctp_v4_xmit+0x108/0x140 net/sctp/protocol.c:994
 sctp_packet_transmit+0x225e/0x3750 net/sctp/output.c:638
 sctp_outq_flush+0x121b/0x4060 net/sctp/outqueue.c:1197
 sctp_outq_uncork+0x5a/0x70 net/sctp/outqueue.c:776
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1807 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1210 [inline]
 sctp_do_sm+0x4e0/0x6ed0 net/sctp/sm_sideeffect.c:1181
 sctp_assoc_bh_rcv+0x283/0x4b0 net/sctp/associola.c:1065
 sctp_inq_push+0x23b/0x300 net/sctp/inqueue.c:95
 sctp_backlog_rcv+0x177/0xa90 net/sctp/input.c:350
 sk_backlog_rcv include/net/sock.h:908 [inline]
 __release_sock+0x124/0x360 net/core/sock.c:2274
 release_sock+0xa4/0x2a0 net/core/sock.c:2789
 sctp_wait_for_connect+0x346/0x570 net/sctp/socket.c:8272
 sctp_sendmsg+0x2b3d/0x35e0 net/sctp/socket.c:2080
 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
 sock_sendmsg_nosec net/socket.c:630 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:640
 SYSC_sendto+0x361/0x5c0 net/socket.c:1721
 SyS_sendto+0x40/0x50 net/socket.c:1689
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x452ee9
RSP: 002b:00007fe66a2bac58 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000000000071bf58 RCX: 0000000000452ee9
RDX: 000000000000fea6 RSI: 0000000020a88f88 RDI: 0000000000000015
RBP: 0000000000000433 R08: 0000000020e68000 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f5568
R13: 00000000ffffffff R14: 00007fe66a2bb6d4 R15: 0000000000000002
Code: f7 ff ff 89 85 20 fd ff ff e8 5e b0 15 fd 8b 85 20 fd ff ff e9 95 f7 ff ff 4c 89 e7 e8 6b b0 15 fd e9 da e6 ff ff e8 51 a6 dd fc <0f> 0b 89 85 70 fd ff ff e8 54 b0 15 fd 8b 85 70 fd ff ff e9 31 
RIP: __tcp_retransmit_skb+0x258f/0x2700 net/ipv4/tcp_output.c:2838 RSP: ffff8801db207148
---[ end trace edac26b7c52b34a7 ]---