------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2591!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 12496 Comm: syz-executor3 Not tainted 4.4.132-g4b08356 #48
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800bb011800 task.stack: ffff8801d1bd0000
RIP: 0010:[<ffffffff8328aff5>]  [<ffffffff8328aff5>] __tcp_retransmit_skb+0x17e5/0x1860 net/ipv4/tcp_output.c:2591
RSP: 0018:ffff8801db207b60  EFLAGS: 00010206
RAX: ffff8800bb011800 RBX: ffff8801d91a7428 RCX: ffff8801c9b3c144
RDX: 0000000000000100 RSI: ffffffff8328aff5 RDI: ffff8801d91a742c
RBP: ffff8801db207c08 R08: 000000de572c3551 R09: 000000000000000c
R10: ffffed0043fffa01 R11: 0000000000000001 R12: 00000000f17b83fc
R13: 00000000f16c9f44 R14: ffff8801d91a7400 R15: ffff8801c9b3bf00
FS:  0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:0000000009a53900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020385ff0 CR3: 00000001cb600000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 000000de572c3551 ffffffffffffffff 000000de5769363b ffff8801c9b3bf00
 0000000000000004 00000000f16ca374 dffffc0000000000 ffff8801c9b3c144
 ffff8801db207bc8 ffffffff833a936e ffff8801c9b3bf00 ffffffff833a8f50
Call Trace:
 <IRQ> 
 [<ffffffff8328b763>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2664
 [<ffffffff8329104d>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff83292951>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff83292f0a>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff8129085c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff81291582>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81291582>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838c376c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff8113f75d>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113f75d>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838c2ed1>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff838c2ed1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838c1e10>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff81277463>] rcu_read_lock_sched_held+0x103/0x120 kernel/rcu/update.c:108
 [<ffffffff81288f88>] trace_rcu_utilization include/trace/events/rcu.h:20 [inline]
 [<ffffffff81288f88>] rcu_note_context_switch+0x288/0xf40 kernel/rcu/tree.c:354
 [<ffffffff838b0361>] __schedule+0x61/0x1d70 kernel/sched/core.c:3255
 [<ffffffff838b226a>] schedule+0x7a/0x1b0 kernel/sched/core.c:3359
 [<ffffffff838bde54>] freezable_schedule include/linux/freezer.h:171 [inline]
 [<ffffffff838bde54>] do_nanosleep+0x1f4/0x4f0 kernel/time/hrtimer.c:1503
 [<ffffffff812a02a0>] hrtimer_nanosleep+0x210/0x540 kernel/time/hrtimer.c:1572
 [<ffffffff812f440e>] C_SYSC_nanosleep kernel/compat.c:254 [inline]
 [<ffffffff812f440e>] compat_SyS_nanosleep+0x27e/0x390 kernel/compat.c:239
 [<ffffffff81006d96>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d96>] do_fast_syscall_32+0x326/0x8b0 arch/x86/entry/common.c:459
 [<ffffffff838c1bea>] sysenter_flags_fixed+0xd/0x17
Code: e0 26 fe e9 aa ed ff ff e8 89 e0 26 fe e9 4f f5 ff ff e8 7f e0 26 fe e9 6b f5 ff ff e8 95 e0 26 fe e9 d3 ef ff ff e8 fb 61 0c fe <0f> 0b 4c 89 f7 e8 81 e0 26 fe e9 d9 ec ff ff e8 f7 e0 26 fe e9 
RIP  [<ffffffff8328aff5>] __tcp_retransmit_skb+0x17e5/0x1860 net/ipv4/tcp_output.c:2591
 RSP <ffff8801db207b60>
---[ end trace 57cad5a556e25308 ]---