BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:414/tfrc_rx_hist_sample_rtt()
CPU: 1 PID: 15490 Comm: syz-executor.0 Not tainted 6.7.0-rc4-syzkaller-00384-gb10a3ccaf6e3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
 tfrc_rx_hist_sample_rtt+0x3dd/0x4a0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x443/0xf50 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids+0xe3/0x260 net/dccp/input.c:176
 dccp_rcv_established net/dccp/input.c:374 [inline]
 dccp_rcv_established+0x106/0x160 net/dccp/input.c:364
 dccp_v4_do_rcv+0x169/0x1b0 net/dccp/ipv4.c:675
 sk_backlog_rcv include/net/sock.h:1121 [inline]
 __sk_receive_skb+0x2af/0x840 net/core/sock.c:571
 dccp_v4_rcv+0x128a/0x1980 net/dccp/ipv4.c:898
 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x2e4/0x510 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1c4/0x2f0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0xaf/0xd0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5529
 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5643
 process_backlog+0x101/0x6b0 net/core/dev.c:5971
 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6533
 napi_poll net/core/dev.c:6602 [inline]
 net_rx_action+0x956/0xe90 net/core/dev.c:6735
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__sanitizer_cov_trace_pc+0x59/0x60 kernel/kcov.c:225
Code: 82 d8 15 00 00 83 f8 02 75 20 48 8b 8a e0 15 00 00 8b 92 dc 15 00 00 48 8b 01 48 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 <c3> 66 0f 1f 44 00 00 f3 0f 1e fa 41 57 41 56 49 89 d6 41 55 41 54
RSP: 0018:ffffc90002ef71a0 EFLAGS: 00000287
RAX: 00000000000075cc RBX: ffffc90002ef7228 RCX: ffffc900149c2000
RDX: 0000000000040000 RSI: ffffffff813a070d RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000001 R12: ffffc90002ef7f58
R13: ffffc90002ef7f58 R14: 0000000000000000 R15: ffffc90002ef725e
 get_reg arch/x86/kernel/unwind_orc.c:455 [inline]
 unwind_next_frame+0x10cd/0x2390 arch/x86/kernel/unwind_orc.c:643
 arch_stack_walk+0xfa/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook mm/slab.h:763 [inline]
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x180/0x330 mm/slub.c:3523
 __alloc_skb+0x287/0x330 net/core/skbuff.c:641
 alloc_skb include/linux/skbuff.h:1286 [inline]
 alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331
 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780
 sock_alloc_send_skb include/net/sock.h:1884 [inline]
 dccp_sendmsg+0x2f4/0xcc0 net/dccp/proto.c:764
 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:847
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x2ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmmsg+0x2a5/0x450 net/socket.c:2717
 __compat_sys_sendmmsg net/compat.c:360 [inline]
 __do_compat_sys_sendmmsg net/compat.c:367 [inline]
 __se_compat_sys_sendmmsg net/compat.c:364 [inline]
 __ia32_compat_sys_sendmmsg+0x9d/0x100 net/compat.c:364
 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
 __do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:321
 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:346
 entry_SYSENTER_compat_after_hwframe+0x70/0x7a
RIP: 0023:0xf7f1b579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7f165ac EFLAGS: 00000292 ORIG_RAX: 0000000000000159
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000200017c0
RDX: 0000000000000004 RSI: 000000000000c004 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	d8 15 00 00 83 f8    	fcoms  -0x77d0000(%rip)        # 0xf8830006
   6:	02 75 20             	add    0x20(%rbp),%dh
   9:	48 8b 8a e0 15 00 00 	mov    0x15e0(%rdx),%rcx
  10:	8b 92 dc 15 00 00    	mov    0x15dc(%rdx),%edx
  16:	48 8b 01             	mov    (%rcx),%rax
  19:	48 83 c0 01          	add    $0x1,%rax
  1d:	48 39 d0             	cmp    %rdx,%rax
  20:	73 07                	jae    0x29
  22:	48 89 01             	mov    %rax,(%rcx)
  25:	48 89 34 c1          	mov    %rsi,(%rcx,%rax,8)
* 29:	c3                   	ret <-- trapping instruction
  2a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
  30:	f3 0f 1e fa          	endbr64
  34:	41 57                	push   %r15
  36:	41 56                	push   %r14
  38:	49 89 d6             	mov    %rdx,%r14
  3b:	41 55                	push   %r13
  3d:	41 54                	push   %r12