syzbot

BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:691/ccid3_first_li()
CPU: 1 PID: 1257 Comm: kworker/1:2 Not tainted 6.7.0-syzkaller-02320-gacc657692aed #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
 ccid3_first_li+0x2f8/0x500 net/dccp/ccids/ccid3.c:691
 tfrc_lh_interval_add+0x610/0x8e0 net/dccp/ccids/lib/loss_interval.c:157
 tfrc_rx_handle_loss+0xe04/0x20a0 net/dccp/ccids/lib/packet_history.c:328
 ccid3_hc_rx_packet_recv+0x372/0xf50 net/dccp/ccids/ccid3.c:744
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids+0xe3/0x260 net/dccp/input.c:176
 dccp_rcv_established net/dccp/input.c:374 [inline]
 dccp_rcv_established+0x106/0x160 net/dccp/input.c:364
 dccp_v4_do_rcv+0x169/0x1b0 net/dccp/ipv4.c:675
 sk_backlog_rcv include/net/sock.h:1121 [inline]
 __sk_receive_skb+0x2af/0x840 net/core/sock.c:571
 dccp_v4_rcv+0x128a/0x1980 net/dccp/ipv4.c:898
 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x2e4/0x510 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1c4/0x2f0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0xaf/0xd0 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x115/0x180 net/core/dev.c:5532
 __netif_receive_skb+0x1f/0x1b0 net/core/dev.c:5646
 process_backlog+0x101/0x6b0 net/core/dev.c:5974
 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6536
 napi_poll net/core/dev.c:6605 [inline]
 net_rx_action+0x956/0xe90 net/core/dev.c:6738
 __do_softirq+0x21a/0x8de kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:neigh_alloc net/core/neighbour.c:509 [inline]
RIP: 0010:___neigh_create+0x4fa/0x2a80 net/core/neighbour.c:648
Code: 00 00 48 c7 c6 50 31 78 88 e8 d2 8e fc f8 49 8d be 88 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 71 21 00 00 49 8b 86 88 03 00 00 65 48 ff 00 48 8d 7d 08 48
RSP: 0018:ffffc900043a76c8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000002 RCX: 1ffffffff1e735cb
RDX: 1ffffffff1dd18a9 RSI: 0000000000000000 RDI: ffffffff8ee8c548
RBP: ffff88801d47f000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000000 R12: ffffffff8ee8c25c
R13: ffffffff8ee8c218 R14: ffffffff8ee8c1c0 R15: 000000000000009b
 ip6_finish_output2+0x10e9/0x1830 net/ipv6/ip6_output.c:128
 __ip6_finish_output net/ipv6/ip6_output.c:211 [inline]
 ip6_finish_output+0x3c7/0xf80 net/ipv6/ip6_output.c:222
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0x1e2/0x530 net/ipv6/ip6_output.c:243
 dst_output include/net/dst.h:451 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ndisc_send_skb+0xa13/0x18f0 net/ipv6/ndisc.c:509
 ndisc_send_rs+0x133/0x6a0 net/ipv6/ndisc.c:719
 addrconf_dad_completed+0x486/0x1030 net/ipv6/addrconf.c:4295
 addrconf_dad_work+0x7f6/0x14b0 net/ipv6/addrconf.c:4203
 process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
 kthread+0x2c6/0x3a0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	48 c7 c6 50 31 78 88 	mov    $0xffffffff88783150,%rsi
   9:	e8 d2 8e fc f8       	call   0xf8fc8ee0
   e:	49 8d be 88 03 00 00 	lea    0x388(%r14),%rdi
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	48 89 fa             	mov    %rdi,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
* 2a:	0f 85 71 21 00 00    	jne    0x21a1 <-- trapping instruction
  30:	49 8b 86 88 03 00 00 	mov    0x388(%r14),%rax
  37:	65 48 ff 00          	incq   %gs:(%rax)
  3b:	48 8d 7d 08          	lea    0x8(%rbp),%rdi
  3f:	48                   	rex.W