BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:425/tfrc_rx_hist_sample_rtt()
CPU: 1 PID: 8938 Comm: syz-executor2 Not tainted 4.15.0+ #221
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
tfrc_rx_hist_sample_rtt+0x407/0x4d0 net/dccp/ccids/lib/packet_history.c:422
ccid3_hc_rx_packet_recv+0x696/0xeb3 net/dccp/ccids/ccid3.c:765
ccid_hc_rx_packet_recv net/dccp/ccid.h:185 [inline]
dccp_deliver_input_to_ccids+0xd9/0x250 net/dccp/input.c:180
dccp_rcv_established+0x88/0xb0 net/dccp/input.c:378
dccp_v4_do_rcv+0x135/0x160 net/dccp/ipv4.c:653
sk_backlog_rcv include/net/sock.h:908 [inline]
__sk_receive_skb+0x33e/0xc10 net/core/sock.c:513
dccp_v4_rcv+0xf5f/0x1c80 net/dccp/ipv4.c:874
ip_local_deliver_finish+0x2f1/0xc50 net/ipv4/ip_input.c:216
NF_HOOK include/linux/netfilter.h:288 [inline]
ip_local_deliver+0x1ce/0x6e0 net/ipv4/ip_input.c:257
dst_input include/net/dst.h:449 [inline]
ip_rcv_finish+0xa36/0x2040 net/ipv4/ip_input.c:397
NF_HOOK include/linux/netfilter.h:288 [inline]
ip_rcv+0xc5a/0x1840 net/ipv4/ip_input.c:493
__netif_receive_skb_core+0x1a41/0x3460 net/core/dev.c:4547
__netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4612
process_backlog+0x203/0x740 net/core/dev.c:5292
napi_poll net/core/dev.c:5690 [inline]
net_rx_action+0x792/0x1910 net/core/dev.c:5756
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1151
</IRQ>
do_softirq.part.19+0x14d/0x190 kernel/softirq.c:329
do_softirq kernel/softirq.c:177 [inline]
__local_bh_enable_ip+0x1ee/0x230 kernel/softirq.c:182
local_bh_enable include/linux/bottom_half.h:32 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:726 [inline]
ip_finish_output2+0x962/0x1550 net/ipv4/ip_output.c:231
ip_finish_output+0x864/0xd10 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:277 [inline]
ip_output+0x1d2/0x860 net/ipv4/ip_output.c:405
dst_output include/net/dst.h:443 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
ip_queue_xmit+0x8c0/0x18e0 net/ipv4/ip_output.c:504
dccp_transmit_skb+0x9ac/0x10f0 net/dccp/output.c:142
dccp_xmit_packet+0x215/0x740 net/dccp/output.c:281
dccp_write_xmit+0x17d/0x1d0 net/dccp/output.c:363
dccp_sendmsg+0x95f/0xdc0 net/dccp/proto.c:813
inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
sock_sendmsg_nosec net/socket.c:630 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:640
sock_write_iter+0x31a/0x5d0 net/socket.c:909
call_write_iter include/linux/fs.h:1781 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x684/0x970 fs/read_write.c:482
vfs_write+0x189/0x510 fs/read_write.c:544
SYSC_write fs/read_write.c:589 [inline]
SyS_write+0xef/0x220 fs/read_write.c:581
entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x453299
RSP: 002b:00007f9b6c131c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9b6c132700 RCX: 0000000000453299
RDX: 0000000000000001 RSI: 0000000020ef9fff RDI: 0000000000000016
RBP: 0000000000a2f3c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
R13: 0000000000a2f33f R14: 00007f9b6c1329c0 R15: 000000000000000c
dccp_close: ABORT with 8218 bytes unread
audit: type=1400 audit(1518181792.705:52): avc: denied { create } for pid=8954 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_scsitransport_socket permissive=1
netlink: 7 bytes leftover after parsing attributes in process `syz-executor4'.
PF_BRIDGE: br_mdb_parse() with invalid ifindex
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=9051 comm=syz-executor3
netlink: 'syz-executor2': attribute type 21 has an invalid length.
netlink: 'syz-executor2': attribute type 1 has an invalid length.
netlink: 'syz-executor2': attribute type 21 has an invalid length.
netlink: 'syz-executor2': attribute type 1 has an invalid length.
sctp: [Deprecated]: syz-executor2 (pid 9327) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor2 (pid 9330) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
Cannot find add_set index 2715 as target
Cannot find add_set index 2715 as target
Protocol error: SET target dimension is over the limit!
Protocol error: SET target dimension is over the limit!
audit: type=1400 audit(1518181794.780:53): avc: denied { create } for pid=9500 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1
sctp: [Deprecated]: syz-executor0 (pid 9524) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor1 (pid 9523) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
audit: type=1400 audit(1518181794.912:54): avc: denied { bind } for pid=9531 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1
netlink: 'syz-executor2': attribute type 21 has an invalid length.
sctp: [Deprecated]: syz-executor0 (pid 9532) Use of int in max_burst socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor1 (pid 9538) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
netlink: 'syz-executor2': attribute type 21 has an invalid length.
sock: sock_set_timeout: `syz-executor2' (pid 9590) tries to set negative timeout
device syz7 entered promiscuous mode
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
sock: sock_set_timeout: `syz-executor2' (pid 9590) tries to set negative timeout
netlink: 'syz-executor5': attribute type 14 has an invalid length.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20014. Sending cookies. Check SNMP counters.
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=6619 sclass=netlink_tcpdiag_socket pig=9853 comm=syz-executor2
SELinux: unrecognized netlink message: protocol=4 nlmsg_type=6619 sclass=netlink_tcpdiag_socket pig=9867 comm=syz-executor2
xt_l2tp: missing protocol rule (udp|l2tpip)
ipt_CLUSTERIP: bad local_nodes[1] 0
ipt_CLUSTERIP: bad local_nodes[1] 0
Protocol error: SET target dimension is over the limit!
Protocol error: SET target dimension is over the limit!
TCP: request_sock_TCPv6: Possible SYN flooding on port 20010. Sending cookies. Check SNMP counters.
audit: type=1400 audit(1518181797.134:55): avc: denied { create } for pid=10152 comm="syz-executor3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_iscsi_socket permissive=1
openvswitch: netlink: Flow actions attr not present in new flow.
openvswitch: netlink: Flow actions attr not present in new flow.
xt_CT: No such timeout policy "syz1"
xt_CT: No such timeout policy "syz1"
sctp: [Deprecated]: syz-executor6 (pid 10662) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
sctp: [Deprecated]: syz-executor6 (pid 10683) Use of int in maxseg socket option.
Use struct sctp_assoc_value instead
netlink: 'syz-executor0': attribute type 21 has an invalid length.
netlink: 'syz-executor0': attribute type 21 has an invalid length.
audit: type=1400 audit(1518181799.377:56): avc: denied { ioctl } for pid=10811 comm="syz-executor5" path="socket:[22494]" dev="sockfs" ino=22494 ioctlcmd=0x8933 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1
A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 2 bytes leftover after parsing attributes in process `syz-executor0'.
xt_dscp: dscp f7 out of range
xt_dscp: dscp f7 out of range
IPv4: Oversized IP packet from 127.0.0.1
IPVS: set_ctl: invalid protocol: 13703 39.52.93.236:60696 Ɓtp�m�`x/.�Hݼ�ބ�DB�C��+����
IPVS: set_ctl: invalid protocol: 13703 39.52.93.236:60696 Ɓtp�m�`x/.�Hݼ�ބ�DB�C��+����
xt_l2tp: missing protocol rule (udp|l2tpip)
xt_l2tp: missing protocol rule (udp|l2tpip)
netlink: 'syz-executor5': attribute type 20 has an invalid length.
netlink: 'syz-executor5': attribute type 20 has an invalid length.