------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2817!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3076 Comm: syz-executor4 Not tainted 4.13.0+ #43
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801a98a6500 task.stack: ffff8801a98b0000
RIP: 0010:__tcp_retransmit_skb+0x1d18/0x1fa0 net/ipv4/tcp_output.c:2817
RSP: 0018:ffff8801db3072a8 EFLAGS: 00010206
RAX: ffff8801a98a6500 RBX: 0000000000000001 RCX: 00000000401bf861
RDX: 0000000000000100 RSI: ffff8801d9b88a40 RDI: ffff8801d9b88a6c
RBP: ffff8801db307468 R08: ffff88021fff905c R09: ffff88021fff9048
R10: 0000000000000000 R11: ffff88021fff905d R12: ffff8801d9b88ac6
R13: 00000000401bfbf1 R14: ffff8801d9b88a40 R15: ffff8801caabef40
FS:  00000000019df940(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a6e938 CR3: 00000001a987b000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2891
 tcp_retransmit_timer+0xcee/0x2a10 net/ipv4/tcp_timer.c:476
 tcp_write_timer_handler+0x335/0x810 net/ipv4/tcp_timer.c:561
 tcp_write_timer+0x146/0x160 net/ipv4/tcp_timer.c:579
 call_timer_fn+0x246/0x850 kernel/time/timer.c:1281
 expire_timers kernel/time/timer.c:1320 [inline]
 __run_timers+0x7fd/0xb90 kernel/time/timer.c:1620
 run_timer_softirq+0x4c/0xb0 kernel/time/timer.c:1646
 __do_softirq+0x2bb/0xbd0 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1d3/0x210 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x177/0x710 arch/x86/kernel/apic/apic.c:1048
 apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:770
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:814 [inline]
RIP: 0010:slab_alloc mm/slab.c:3390 [inline]
RIP: 0010:kmem_cache_alloc+0x22b/0x760 mm/slab.c:3559
RSP: 0018:ffff8801a98b7d80 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000007 RBX: 00000000014000c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000282
RBP: ffff8801a98b7df0 R08: ffff8801a98b7690 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801c596cc80
R13: ffff8801dae08780 R14: ffff8801dae08780 R15: 00000000014000c0
 getname_flags+0xcb/0x580 fs/namei.c:137
 getname+0x19/0x20 fs/namei.c:208
 do_sys_open+0x2e7/0x6d0 fs/open.c:1053
 SYSC_open fs/open.c:1077 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1072
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x450080
RSP: 002b:0000000000a6e890 EFLAGS: 00000206 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00000000019df914 RCX: 0000000000450080
RDX: 00000000000006a2 RSI: 0000000000090800 RDI: 0000000000a6fa50
RBP: 0000000000000082 R08: 0000000000000001 R09: 00000000019df940
R10: 0000000000000000 R11: 0000000000000206 R12: 00000000000006a2
R13: 0000000000000000 R14: 000000000001baac R15: 0000000000000016
Code: ff e8 7d a5 93 fd e9 4b fb ff ff 48 8b bd a0 fe ff ff e8 cc a5 93 fd e9 fc f8 ff ff e8 c2 a5 93 fd e9 53 f6 ff ff e8 98 f3 5e fd <0f> 0b e8 b1 a5 93 fd e9 9e e5 ff ff 4c 89 e7 e8 44 a5 93 fd e9 
RIP: __tcp_retransmit_skb+0x1d18/0x1fa0 net/ipv4/tcp_output.c:2817 RSP: ffff8801db3072a8
---[ end trace 567886cd73791e64 ]---