dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(253362192158467) <= P.seqno(253362192158466) <= S.SWH(253362192158541)) and (P.ackno exists or LAWL(47379941843413) <= P.ackno(47379941843413) <= S.AWH(47379941843413), sending SYNC...
BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 UID: 0 PID: 13980 Comm: syz.2.2904 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 tfrc_rx_hist_sample_rtt+0x397/0x4b0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x69d/0xe60 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
 dccp_rcv_established+0x1bb/0x320 net/dccp/input.c:374
 dccp_v4_do_rcv+0xff/0x1f0 net/dccp/ipv4.c:681
 sk_backlog_rcv include/net/sock.h:1122 [inline]
 __sk_receive_skb+0x82b/0x8b0 net/core/sock.c:575
 ip_protocol_deliver_rcu+0x2e9/0x440 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233
 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314
 __netif_receive_skb_one_core net/core/dev.c:5896 [inline]
 __netif_receive_skb+0x2bf/0x650 net/core/dev.c:6009
 process_backlog+0x662/0x15b0 net/core/dev.c:6357
 __napi_poll+0xcb/0x490 net/core/dev.c:7191
 napi_poll net/core/dev.c:7260 [inline]
 net_rx_action+0x89b/0x1240 net/core/dev.c:7382
 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:mt_validate+0x45ae/0x4b30 lib/maple_tree.c:7571
Code: c0 f5 49 8d 9d f8 00 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f 85 35 03 00 00 44 0f b6 3b <4c> 8d b4 24 e0 00 00 00 4c 8b 64 24 50 45 0f b6 ff 48 8b 5c 24 28
RSP: 0018:ffffc90004537080 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888028fc5ef8 RCX: dffffc0000000000
RDX: ffffc9000c401000 RSI: 0000000000000589 RDI: 000000000000058a
RBP: ffffc90004537290 R08: ffffffff8c015528 R09: ffffffff8c015404
R10: 0000000000000003 R11: ffff888031413c00 R12: 0000000000000000
R13: ffff888028fc5e00 R14: 0000000000000001 R15: 000000000000000a
 validate_mm+0xf1/0x590 mm/vma.c:584
 __split_vma+0xa60/0xbf0 mm/vma.c:513
 vms_gather_munmap_vmas+0x4c1/0x1600 mm/vma.c:1289
 __mmap_prepare mm/vma.c:2246 [inline]
 __mmap_region mm/vma.c:2448 [inline]
 mmap_region+0xa50/0x2fa0 mm/vma.c:2539
 do_mmap+0xecc/0x13a0 mm/mmap.c:561
 vm_mmap_pgoff+0x214/0x430 mm/util.c:575
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faef678d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faef75f7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007faef69a5fa0 RCX: 00007faef678d169
RDX: 000000000200000d RSI: 0000000000b36000 RDI: 0000400000000000
RBP: 00007faef680e2a0 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000004008031 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007faef69a5fa0 R15: 00007ffee65d6158
 </TASK>
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(14810174745640) <= P.seqno(14810174745639) <= S.SWH(14810174745714)) and (P.ackno exists or LAWL(163398942843298) <= P.ackno(163398942843298) <= S.AWH(163398942843298), sending SYNC...
----------------
Code disassembly (best guess):
   0:	c0 f5 49             	shl    $0x49,%ch
   3:	8d 9d f8 00 00 00    	lea    0xf8(%rbp),%ebx
   9:	48 89 d8             	mov    %rbx,%rax
   c:	48 c1 e8 03          	shr    $0x3,%rax
  10:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  17:	fc ff df
  1a:	0f b6 04 08          	movzbl (%rax,%rcx,1),%eax
  1e:	84 c0                	test   %al,%al
  20:	0f 85 35 03 00 00    	jne    0x35b
  26:	44 0f b6 3b          	movzbl (%rbx),%r15d
* 2a:	4c 8d b4 24 e0 00 00 	lea    0xe0(%rsp),%r14 <-- trapping instruction
  31:	00
  32:	4c 8b 64 24 50       	mov    0x50(%rsp),%r12
  37:	45 0f b6 ff          	movzbl %r15b,%r15d
  3b:	48 8b 5c 24 28       	mov    0x28(%rsp),%rbx