------------[ cut here ]------------ TCP recvmsg seq # bug 2: copied 18680DE9, seq 18680DB1, rcvnxt 18680DB2, fl 40 WARNING: CPU: 1 PID: 5883 at net/ipv4/tcp.c:2414 tcp_recvmsg_locked+0x7dc/0x2640 net/ipv4/tcp.c:2412 Modules linked in: CPU: 1 PID: 5883 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller-01468-g173e7622ccb3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:tcp_recvmsg_locked+0x7dc/0x2640 net/ipv4/tcp.c:2412 Code: b6 04 28 84 c0 48 8b 5c 24 08 0f 85 2d 01 00 00 8b 0a 48 c7 c7 00 04 cb 8c 44 89 fe 44 89 f2 44 8b 44 24 24 e8 65 4a 73 f7 90 <0f> 0b 90 90 4c 8b 64 24 38 e9 40 ff ff ff 89 f9 80 e1 07 80 c1 03 RSP: 0018:ffffc90009f97280 EFLAGS: 00010246 RAX: 2388732371451e00 RBX: ffff88801bfda370 RCX: ffff888077bd5a00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90009f97470 R08: ffffffff8158a8d2 R09: fffffbfff1c39b80 R10: dffffc0000000000 R11: fffffbfff1c39b80 R12: ffff88801bfda398 R13: dffffc0000000000 R14: 0000000018680db1 R15: 0000000018680de9 FS: 00007faaaeff56c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558f4c68f8 CR3: 000000007a712000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: receive_fallback_to_copy net/ipv4/tcp.c:1881 [inline] tcp_zerocopy_receive+0x81c/0x25b0 net/ipv4/tcp.c:2113 do_tcp_getsockopt+0x243e/0x3520 net/ipv4/tcp.c:4311