BUG: "hc->tx_t_ipi == 0" holds (exception!) at net/dccp/ccids/ccid3.c:101/ccid3_update_send_interval()
CPU: 1 PID: 31751 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 ccid3_update_send_interval.cold+0x87/0x93 net/dccp/ccids/ccid3.c:101
 ccid3_hc_tx_update_s net/dccp/ccids/ccid3.c:178 [inline]
 ccid3_hc_tx_packet_sent+0x12e/0x160 net/dccp/ccids/ccid3.c:361
 ccid_hc_tx_packet_sent net/dccp/ccid.h:178 [inline]
 dccp_xmit_packet+0x27e/0x760 net/dccp/output.c:289
 dccp_write_xmit+0x16d/0x1d0 net/dccp/output.c:363
 dccp_sendmsg+0x8de/0xc90 net/dccp/proto.c:816
 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 __sys_sendto+0x21a/0x320 net/socket.c:1899
 __do_sys_sendto net/socket.c:1911 [inline]
 __se_sys_sendto net/socket.c:1907 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f8573122209
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8571a76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f8573235030 RCX: 00007f8573122209
RDX: 000000000000000b RSI: 00000000200002c0 RDI: 0000000000000039
RBP: 00007f857317c161 R08: 0000000020000300 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee30ceeaf R14: 00007f8571a76300 R15: 0000000000022000
BUG: "hc->tx_t_ipi == 0" holds (exception!) at net/dccp/ccids/ccid3.c:101/ccid3_update_send_interval()
CPU: 0 PID: 31751 Comm: syz-executor.1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 ccid3_update_send_interval.cold+0x87/0x93 net/dccp/ccids/ccid3.c:101
 ccid3_hc_tx_update_s net/dccp/ccids/ccid3.c:178 [inline]
 ccid3_hc_tx_packet_sent+0x12e/0x160 net/dccp/ccids/ccid3.c:361
 ccid_hc_tx_packet_sent net/dccp/ccid.h:178 [inline]
 dccp_xmit_packet+0x27e/0x760 net/dccp/output.c:289
 dccp_write_xmit+0x16d/0x1d0 net/dccp/output.c:363
 dccp_sendmsg+0x8de/0xc90 net/dccp/proto.c:816
 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798
usb usb9: usbfs: interface 0 claimed by hub while 'syz-executor.3' sets config #0
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 __sys_sendto+0x21a/0x320 net/socket.c:1899
 __do_sys_sendto net/socket.c:1911 [inline]
 __se_sys_sendto net/socket.c:1907 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1907
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
usb usb9: usbfs: interface 0 claimed by usbfs while 'syz-executor.3' sets config #1
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f8573122209
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8571a76168 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f8573235030 RCX: 00007f8573122209
RDX: 000000000000000b RSI: 00000000200002c0 RDI: 0000000000000039
RBP: 00007f857317c161 R08: 0000000020000300 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffee30ceeaf R14: 00007f8571a76300 R15: 0000000000022000
hub 9-0:1.0: USB hub found
hub 9-0:1.0: 8 ports detected
usb usb9: usbfs: interface 0 claimed by hub while 'syz-executor.3' sets config #0
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'.
netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
IPVS: ftp: loaded support on port[0] = 21
A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
IPVS: ftp: loaded support on port[0] = 21
chnl_net:caif_netlink_parms(): no params data found
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered disabled state
device bridge_slave_0 entered promiscuous mode
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_1 entered promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
device bridge_slave_0 left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
Bluetooth: hci4: command 0x0409 tx timeout