syz-executor.2 (29717) used greatest stack depth: 20568 bytes left audit: type=1800 audit(1551914581.106:528): pid=29732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=17134 res=0 BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:422/tfrc_rx_hist_sample_rtt() CPU: 0 PID: 29763 Comm: syz-executor.0 Not tainted 5.0.0+ #9 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 tfrc_rx_hist_sample_rtt.cold+0x56/0x61 net/dccp/ccids/lib/packet_history.c:422 ccid3_hc_rx_packet_recv+0x5c6/0xeb0 net/dccp/ccids/ccid3.c:767 ccid_hc_rx_packet_recv net/dccp/ccid.h:185 [inline] dccp_deliver_input_to_ccids+0xee/0x280 net/dccp/input.c:180 dccp_rcv_established net/dccp/input.c:378 [inline] dccp_rcv_established+0x83/0xb0 net/dccp/input.c:368 dccp_v4_do_rcv+0x139/0x190 net/dccp/ipv4.c:659 sk_backlog_rcv include/net/sock.h:937 [inline] __sk_receive_skb+0x33a/0xbd0 net/core/sock.c:527 dccp_v4_rcv+0xeaa/0x1bf1 net/dccp/ipv4.c:880 ip_protocol_deliver_rcu+0x60/0x8f0 net/ipv4/ip_input.c:208 ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_local_deliver+0x1e9/0x520 net/ipv4/ip_input.c:255 dst_input include/net/dst.h:450 [inline] ip_rcv_finish+0x1e1/0x300 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_rcv+0xe8/0x3f0 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x4fa/0x1070 net/core/dev.c:6412 __do_softirq+0x266/0x95a kernel/softirq.c:293 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027 do_softirq.part.0+0x11a/0x170 kernel/softirq.c:338 do_softirq kernel/softirq.c:330 [inline] __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:190 local_bh_enable include/linux/bottom_half.h:32 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:684 [inline] ip_finish_output2+0x99c/0x1740 net/ipv4/ip_output.c:231 ip_finish_output+0x73c/0xd50 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip_output+0x21f/0x670 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:444 [inline] ip_local_out+0xc4/0x1b0 net/ipv4/ip_output.c:124 __ip_queue_xmit+0x86f/0x1bf0 net/ipv4/ip_output.c:505 ip_queue_xmit+0x5a/0x70 include/net/ip.h:198 dccp_transmit_skb+0x977/0x12c0 net/dccp/output.c:142 dccp_xmit_packet+0x1f6/0x660 net/dccp/output.c:281 dccp_write_xmit+0x181/0x1e0 net/dccp/output.c:363 dccp_sendmsg+0xa60/0xd00 net/dccp/proto.c:816 inet_sendmsg+0x147/0x5d0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:632 kernel_sendmsg+0x44/0x50 net/socket.c:640 sock_no_sendpage+0x116/0x150 net/core/sock.c:2716 kernel_sendpage+0x95/0xf0 net/socket.c:3427 sock_sendpage+0x8b/0xc0 net/socket.c:869 pipe_to_sendpage+0x299/0x370 fs/splice.c:452 splice_from_pipe_feed fs/splice.c:503 [inline] __splice_from_pipe+0x39a/0x7e0 fs/splice.c:627 splice_from_pipe+0x108/0x170 fs/splice.c:662 generic_splice_sendpage+0x3c/0x50 fs/splice.c:832 do_splice_from fs/splice.c:851 [inline] direct_splice_actor+0x126/0x1a0 fs/splice.c:1023 splice_direct_to_actor+0x369/0x970 fs/splice.c:978 do_splice_direct+0x1da/0x2a0 fs/splice.c:1066 do_sendfile+0x597/0xd00 fs/read_write.c:1436 __do_sys_sendfile64 fs/read_write.c:1491 [inline] __se_sys_sendfile64 fs/read_write.c:1483 [inline] __x64_sys_sendfile64+0x15a/0x220 fs/read_write.c:1483 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457f29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc5d9dadc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457f29 RDX: 0000000020000180 RSI: 000000000000000e RDI: 0000000000000009 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 000000010000014e R11: 0000000000000246 R12: 00007fc5d9dae6d4 R13: 00000000004c4ece R14: 00000000004d8bf8 R15: 00000000ffffffff dccp_close: ABORT with 9140 bytes unread device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state dccp_close: ABORT with 10633 bytes unread device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPVS: ftp: loaded support on port[0] = 21 chnl_net:caif_netlink_parms(): no params data found bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_0 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_1 entered promiscuous mode bond0: Enslaving bond_slave_0 as an active interface with an up link bond0: Enslaving bond_slave_1 as an active interface with an up link team0: Port device team_slave_0 added team0: Port device team_slave_1 added device hsr_slave_0 entered promiscuous mode device hsr_slave_1 entered promiscuous mode bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state 8021q: adding VLAN 0 to HW filter on device bond0 IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready bridge0: port 1(bridge_slave_0) entered disabled state bridge0: port 2(bridge_slave_1) entered disabled state 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 8021q: adding VLAN 0 to HW filter on device batadv0 dccp_close: ABORT with 10633 bytes unread tls_set_device_offload_rx: netdev lo with no TLS offload tls_set_device_offload_rx: netdev lo with no TLS offload tls_set_device_offload_rx: netdev lo with no TLS offload