------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2817!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 7398 Comm: syz-executor3 Not tainted 4.13.0+ #43
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801c4ec24c0 task.stack: ffff8801d1080000
RIP: 0010:__tcp_retransmit_skb+0x1d18/0x1fa0 net/ipv4/tcp_output.c:2817
RSP: 0018:ffff8801db2072a8 EFLAGS: 00010206
RAX: ffff8801c4ec24c0 RBX: 0000000000000001 RCX: 000000002a4d2c3a
RDX: 0000000000000100 RSI: ffff8801c0880800 RDI: ffff8801c088082c
RBP: ffff8801db207468 R08: ffff88021fff901c R09: ffff88021fff9008
R10: 0000000000000000 R11: ffff88021fff901d R12: ffff8801c0880886
R13: 000000002a4d2fca R14: ffff8801c0880800 R15: ffff8801caeb0780
FS:  00007feb359e0700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a6fa18 CR3: 00000001cc44a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2891
 tcp_retransmit_timer+0xcee/0x2a10 net/ipv4/tcp_timer.c:476
 tcp_write_timer_handler+0x335/0x810 net/ipv4/tcp_timer.c:561
 tcp_write_timer+0x146/0x160 net/ipv4/tcp_timer.c:579
 call_timer_fn+0x246/0x850 kernel/time/timer.c:1281
 expire_timers kernel/time/timer.c:1320 [inline]
 __run_timers+0x7fd/0xb90 kernel/time/timer.c:1620
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:770
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:814 [inline]
RIP: 0010:lock_acquire+0x256/0x580 kernel/locking/lockdep.c:4005
RSP: 0018:ffff8801d1086f08 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: ffff8801c4ec24c0 RCX: 0000000000000000
RDX: 1ffffffff0b592fd RSI: ffffffff8140e701 RDI: 0000000000000282
RBP: ffff8801d1087000 R08: ffff8801d1086980 R09: ffff8801d1086978
R10: ffff8801d10868f0 R11: 1ffff100389d872b R12: 1ffff1003a210de7
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
 down_write+0x87/0x120 kernel/locking/rwsem.c:53
 i_mmap_lock_write include/linux/fs.h:467 [inline]
 unlink_file_vma+0x75/0xb0 mm/mmap.c:157
 free_pgtables+0x226/0x330 mm/memory.c:635
 exit_mmap+0x2bf/0x530 mm/mmap.c:3022
 __mmput kernel/fork.c:924 [inline]
 mmput+0x223/0x6d0 kernel/fork.c:945
 exit_mm kernel/exit.c:544 [inline]
 do_exit+0x9a1/0x1b40 kernel/exit.c:852
 do_group_exit+0x149/0x400 kernel/exit.c:968
 get_signal+0x7e8/0x17e0 kernel/signal.c:2334
 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808
 exit_to_usermode_loop+0x224/0x300 arch/x86/entry/common.c:158
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath+0x42f/0x500 arch/x86/entry/common.c:266
 entry_SYSCALL_64_fastpath+0xbc/0xbe
RIP: 0033:0x451e59
RSP: 002b:00007feb359dfcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000718398 RCX: 0000000000451e59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718398
RBP: 0000000000718370 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000a6f7ef R14: 00007feb359e09c0 R15: 0000000000000018
Code: ff e8 7d a5 93 fd e9 4b fb ff ff 48 8b bd a0 fe ff ff e8 cc a5 93 fd e9 fc f8 ff ff e8 c2 a5 93 fd e9 53 f6 ff ff e8 98 f3 5e fd <0f> 0b e8 b1 a5 93 fd e9 9e e5 ff ff 4c 89 e7 e8 44 a5 93 fd e9 
RIP: __tcp_retransmit_skb+0x1d18/0x1fa0 net/ipv4/tcp_output.c:2817 RSP: ffff8801db2072a8
---[ end trace 0b2108c128624a30 ]---