------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2591!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 14893 Comm: syz-executor3 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d4e76000 task.stack: ffff8800ba9c8000
RIP: 0010:[<ffffffff83164527>]  [<ffffffff83164527>] __tcp_retransmit_skb+0x1587/0x17b0 net/ipv4/tcp_output.c:2591
RSP: 0018:ffff8801db207b70  EFLAGS: 00010206
RAX: ffff8801d4e76000 RBX: ffff8800a9869f80 RCX: ffffffff83164527
RDX: 0000000000000100 RSI: ffff8801d45f0280 RDI: ffff8801d45f02ac
RBP: ffff8801db207c18 R08: ffff88021fffd018 R09: 0000000000000006
R10: ffffed0043fffa01 R11: 0000000000000000 R12: 00000000bd99dd58
R13: ffff8801d45f02a8 R14: 00000000bda8c210 R15: ffff8801d45f0280
FS:  0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f6f82b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000f6ef5db0 CR3: 00000001c1ea8000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffffffffffff 151dfe5eb9ead67b 000000171196df85 ffff8800a9869f80
 0000000000000004 ffff8800a986a844 0000000000000000 ffff8801d45f0780
 ffff8800a986a1c4 ffffffff8328521e ffff8800a986a814 ffff8800a9869f80
Call Trace:
 <IRQ> 
 [<ffffffff83164e33>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2664
 [<ffffffff8316aa00>] tcp_retransmit_timer+0xa60/0x1f10 net/ipv4/tcp_timer.c:461
 [<ffffffff8316c0ce>] tcp_write_timer_handler+0x21e/0x6d0 net/ipv4/tcp_timer.c:543
 [<ffffffff8316c621>] tcp_write_timer+0xa1/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff812a0efb>] call_timer_fn+0x18b/0x860 kernel/time/timer.c:1185
 [<ffffffff812a2e54>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812a2e54>] run_timer_softirq+0x604/0xbb0 kernel/time/timer.c:1444
 [<ffffffff83776e57>] __do_softirq+0x227/0xa38 kernel/softirq.c:273
 [<ffffffff8113daa9>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113daa9>] irq_exit+0x119/0x140 kernel/softirq.c:391
 [<ffffffff837765bb>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff837765bb>] smp_apic_timer_interrupt+0x7b/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff83775510>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:737
 <EOI> 
 [<ffffffff81b49baa>] spin_unlock_irqrestore include/linux/spinlock.h:362 [inline]
 [<ffffffff81b49baa>] avc_reclaim_node security/selinux/avc.c:543 [inline]
 [<ffffffff81b49baa>] avc_alloc_node+0x27a/0x3e0 security/selinux/avc.c:561
 [<ffffffff81b4aa32>] avc_insert security/selinux/avc.c:672 [inline]
 [<ffffffff81b4aa32>] avc_compute_av+0x182/0x640 security/selinux/avc.c:978
 [<ffffffff81b4b8cc>] avc_has_extended_perms+0x48c/0xf30 security/selinux/avc.c:1026
 [<ffffffff81b5bedf>] ioctl_has_perm security/selinux/hooks.c:3271 [inline]
 [<ffffffff81b5bedf>] selinux_file_ioctl+0x33f/0x570 security/selinux/hooks.c:3319
 [<ffffffff81b443dd>] security_file_ioctl+0x7d/0xb0 security/security.c:753
 [<ffffffff8161e43a>] C_SYSC_ioctl fs/compat_ioctl.c:1554 [inline]
 [<ffffffff8161e43a>] compat_SyS_ioctl+0xea/0x2540 fs/compat_ioctl.c:1544
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17
Code: 88 e8 7e a2 39 fe 8b 45 88 e9 8e f9 ff ff e8 91 a2 39 fe e9 4d f9 ff ff 48 8b 7d c8 e8 83 a2 39 fe e9 ad fd ff ff e8 29 c8 1f fe <0f> 0b e8 52 a2 39 fe e9 6f fd ff ff e8 48 a2 39 fe e9 c7 fd ff 
RIP  [<ffffffff83164527>] __tcp_retransmit_skb+0x1587/0x17b0 net/ipv4/tcp_output.c:2591
 RSP <ffff8801db207b70>
---[ end trace 49448961d4b1ba1e ]---