Extracting prog: 2m31.699926722s
Minimizing prog: 41m25.659562685s
Simplifying prog options: 3m8.149650723s
Extracting C: 1m42.830689448s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program crashed: BUG: please report to dccp@vger.kernel.org => prev = NUM, last = NUM at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx
single: successfully extracted reproducer
found reproducer with 10 syscalls
minimizing guilty program
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
accept4(r0, 0x0, 0x0, 0x0)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-setsockopt-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-socket$inet_dccp-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-listen-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
setsockopt(0xffffffffffffffff, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(0xffffffffffffffff, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(0xffffffffffffffff, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-bind$inet6-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-syz_genetlink_get_family_id$devlink-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program crashed: BUG: please report to dccp@vger.kernel.org => prev = NUM, last = NUM at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(0xffffffffffffffff, 0x101)
r0 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r0, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r0, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0)
sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r0, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, 0x0, 0x0)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, 0x0, 0x0)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff), 0x0)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, 0x0, 0x0)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, 0x0, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x14}}, 0x0) (async, rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program crashed: BUG: please report to dccp@vger.kernel.org => prev = NUM, last = NUM at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (rerun: 64)
write$binfmt_aout(r1, 0x0, 0xc1) (rerun: 64)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1)

program crashed: BUG: please report to dccp@vger.kernel.org => prev = NUM, last = NUM at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx
extracting C reproducer
testing compiled C program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
program did not crash
simplifying guilty program options
testing program (duration=1m1.080941217s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1)

program did not crash
testing program (duration=1m1.080941217s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-bind$inet6-listen-socket$inet_dccp-setsockopt-connect$inet-accept4-sendmsg$nl_route-write$binfmt_aout
detailed listing:
executing program 0:
r0 = socket$inet6(0xa, 0x6, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c)
listen(r0, 0x101)
r1 = socket$inet_dccp(0x2, 0x6, 0x0)
setsockopt(r1, 0x10d, 0x800000000d, &(0x7f00001c9fff)="03", 0x1)
connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev}, 0x3a)
r2 = accept4(r0, 0x0, 0x0, 0x0)
sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[], 0x14}}, 0x0) (rerun: 64)
write$binfmt_aout(r1, &(0x7f00000019c0)=ANY=[], 0xc1)

program did not crash
reproducing took 48m48.339886517s
repro crashed as (corrupted=false):
BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 PID: 4520 Comm: syz.3.159 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 tfrc_rx_hist_sample_rtt+0x31c/0x3f0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x4e4/0xaf8 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
 dccp_rcv_established+0x1ac/0x2d8 net/dccp/input.c:374
 dccp_v4_do_rcv+0xa8/0x188 net/dccp/ipv4.c:672
 sk_backlog_rcv include/net/sock.h:1061 [inline]
 __sk_receive_skb+0x3f0/0x960 net/core/sock.c:528
 dccp_v4_rcv+0xedc/0x1470 net/dccp/ipv4.c:895
 ip_protocol_deliver_rcu+0x370/0x778 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:462 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5524 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5638
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6515
 __napi_poll+0xb4/0x624 net/core/dev.c:7074
 napi_poll net/core/dev.c:7141 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7231
 handle_softirqs+0x384/0xdbc kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xfc/0x1b0 kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:452 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xde8/0x190c net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 dccp_transmit_skb+0xa98/0xe74 net/dccp/output.c:138
 dccp_xmit_packet+0x234/0x448 net/dccp/output.c:281
 dccp_write_xmit+0x128/0x208 net/dccp/output.c:366
 dccp_sendmsg+0x608/0xae0 net/dccp/proto.c:810
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:834
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 PID: 4618 Comm: syz.3.200 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 tfrc_rx_hist_sample_rtt+0x31c/0x3f0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x4e4/0xaf8 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
 dccp_rcv_established+0x1ac/0x2d8 net/dccp/input.c:374
 dccp_v4_do_rcv+0xa8/0x188 net/dccp/ipv4.c:672
 sk_backlog_rcv include/net/sock.h:1061 [inline]
 __sk_receive_skb+0x3f0/0x960 net/core/sock.c:528
 dccp_v4_rcv+0xedc/0x1470 net/dccp/ipv4.c:895
 ip_protocol_deliver_rcu+0x370/0x778 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:462 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5524 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5638
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6515
 __napi_poll+0xb4/0x624 net/core/dev.c:7074
 napi_poll net/core/dev.c:7141 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7231
 handle_softirqs+0x384/0xdbc kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xfc/0x1b0 kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:452 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xde8/0x190c net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 dccp_transmit_skb+0xa98/0xe74 net/dccp/output.c:138
 dccp_xmit_packet+0x234/0x448 net/dccp/output.c:281
 dccp_write_xmit+0x128/0x208 net/dccp/output.c:366
 dccp_sendmsg+0x608/0xae0 net/dccp/proto.c:810
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:834
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

final repro crashed as (corrupted=false):
BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 PID: 4520 Comm: syz.3.159 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 tfrc_rx_hist_sample_rtt+0x31c/0x3f0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x4e4/0xaf8 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
 dccp_rcv_established+0x1ac/0x2d8 net/dccp/input.c:374
 dccp_v4_do_rcv+0xa8/0x188 net/dccp/ipv4.c:672
 sk_backlog_rcv include/net/sock.h:1061 [inline]
 __sk_receive_skb+0x3f0/0x960 net/core/sock.c:528
 dccp_v4_rcv+0xedc/0x1470 net/dccp/ipv4.c:895
 ip_protocol_deliver_rcu+0x370/0x778 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:462 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5524 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5638
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6515
 __napi_poll+0xb4/0x624 net/core/dev.c:7074
 napi_poll net/core/dev.c:7141 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7231
 handle_softirqs+0x384/0xdbc kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xfc/0x1b0 kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:452 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xde8/0x190c net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 dccp_transmit_skb+0xa98/0xe74 net/dccp/output.c:138
 dccp_xmit_packet+0x234/0x448 net/dccp/output.c:281
 dccp_write_xmit+0x128/0x208 net/dccp/output.c:366
 dccp_sendmsg+0x608/0xae0 net/dccp/proto.c:810
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:834
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:417/tfrc_rx_hist_sample_rtt()
CPU: 0 PID: 4618 Comm: syz.3.200 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 dump_stack+0x1c/0x58 lib/dump_stack.c:113
 tfrc_rx_hist_sample_rtt+0x31c/0x3f0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x4e4/0xaf8 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids net/dccp/input.c:176 [inline]
 dccp_rcv_established+0x1ac/0x2d8 net/dccp/input.c:374
 dccp_v4_do_rcv+0xa8/0x188 net/dccp/ipv4.c:672
 sk_backlog_rcv include/net/sock.h:1061 [inline]
 __sk_receive_skb+0x3f0/0x960 net/core/sock.c:528
 dccp_v4_rcv+0xedc/0x1470 net/dccp/ipv4.c:895
 ip_protocol_deliver_rcu+0x370/0x778 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x120/0x194 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:462 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5524 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5638
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6515
 __napi_poll+0xb4/0x624 net/core/dev.c:7074
 napi_poll net/core/dev.c:7141 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7231
 handle_softirqs+0x384/0xdbc kernel/softirq.c:558
 __do_softirq kernel/softirq.c:592 [inline]
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xfc/0x1b0 kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458 net/ipv4/ip_output.c:-1
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:452 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xde8/0x190c net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 dccp_transmit_skb+0xa98/0xe74 net/dccp/output.c:138
 dccp_xmit_packet+0x234/0x448 net/dccp/output.c:281
 dccp_write_xmit+0x128/0x208 net/dccp/output.c:366
 dccp_sendmsg+0x608/0xae0 net/dccp/proto.c:810
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:834
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2436
 ___sys_sendmsg+0x214/0x294 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg net/socket.c:2526 [inline]
 __arm64_sys_sendmsg+0x1ac/0x25c net/socket.c:2526
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584