BUG: please report to dccp@vger.kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:414/tfrc_rx_hist_sample_rtt()
CPU: 2 UID: 0 PID: 10817 Comm: syz.4.1450 Not tainted 6.14.0-rc6-syzkaller-00103-g4003c9e78778 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 tfrc_rx_hist_sample_rtt+0x3e1/0x4a0 net/dccp/ccids/lib/packet_history.c:414
 ccid3_hc_rx_packet_recv+0x443/0xf50 net/dccp/ccids/ccid3.c:760
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids+0xe3/0x270 net/dccp/input.c:176
 dccp_rcv_established net/dccp/input.c:374 [inline]
 dccp_rcv_established+0x10a/0x160 net/dccp/input.c:364
 dccp_v4_do_rcv+0x171/0x1b0 net/dccp/ipv4.c:681
 sk_backlog_rcv include/net/sock.h:1122 [inline]
 __sk_receive_skb+0x7aa/0x890 net/core/sock.c:575
 dccp_v4_rcv+0x1153/0x1d30 net/dccp/ipv4.c:904
 ip_protocol_deliver_rcu+0x441/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:469 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5896
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6009
 process_backlog+0x443/0x15f0 net/core/dev.c:6357
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:7191
 napi_poll net/core/dev.c:7260 [inline]
 net_rx_action+0xa94/0x1010 net/core/dev.c:7382
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 ab 3c f6 48 89 df e8 de 2a 3d f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 a5 01 2e f6 65 8b 05 a6 d3 a9 74 85 c0 74 16 5b
RSP: 0018:ffffc9000317f3e8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff9aaf6030 RCX: 1ffffffff20c4411
RDX: 0000000000000000 RSI: ffffffff8b6cfc80 RDI: ffffffff8bd36ae0
RBP: 0000000000000286 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90626417 R11: 0000000000000000 R12: ffff88803ec00000
R13: 00000000000001e2 R14: 0000000000000001 R15: ffff88803ec00000
 __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline]
 debug_check_no_obj_freed+0x327/0x600 lib/debugobjects.c:1129
 free_pages_prepare mm/page_alloc.c:1134 [inline]
 free_frozen_pages+0x283/0xfb0 mm/page_alloc.c:2660
 __folio_put+0x32a/0x450 mm/swap.c:112
 folio_put include/linux/mm.h:1489 [inline]
 hugetlb_free_folio mm/hugetlb.c:102 [inline]
 __update_and_free_hugetlb_folio+0x35b/0x610 mm/hugetlb.c:1638
 update_and_free_hugetlb_folio+0x82/0x120 mm/hugetlb.c:1693
 update_and_free_pages_bulk+0x710/0xad0 mm/hugetlb.c:1795
 return_unused_surplus_pages+0x232/0x300 mm/hugetlb.c:2540
 hugetlb_acct_memory.part.0+0x8ac/0xd00 mm/hugetlb.c:5039
 hugetlb_acct_memory mm/hugetlb.c:7141 [inline]
 hugetlb_unreserve_pages+0x223/0x280 mm/hugetlb.c:7139
 remove_inode_hugepages+0xd39/0xeb0 fs/hugetlbfs/inode.c:605
 hugetlbfs_evict_inode+0x96/0x260 fs/hugetlbfs/inode.c:615
 evict+0x409/0x960 fs/inode.c:796
 iput_final fs/inode.c:1946 [inline]
 iput fs/inode.c:1972 [inline]
 iput+0x52a/0x890 fs/inode.c:1958
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:440
 __dentry_kill+0x1d0/0x600 fs/dcache.c:643
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:885
 dput+0x1f/0x30 fs/dcache.c:875
 __fput+0x51c/0xb70 fs/file_table.c:472
 task_work_run+0x14e/0x250 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f941298d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9413703038 EFLAGS: 00000246 ORIG_RAX: 000000000000001f
RAX: 0000000000000000 RBX: 00007f9412ba6080 RCX: 00007f941298d169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f9412a0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9412ba6080 R15: 00007ffede829a68
 </TASK>
ccid3_first_li: No RTT estimate available, using fallback RTT
dccp_check_seqno: Step 6 failed for CLOSE packet, (LSWL(180252754853050) <= P.seqno(180252754853049) <= S.SWH(180252754853124)) and (P.ackno exists or LAWL(34307151869423) <= P.ackno(34307151869423) <= S.AWH(34307151869423), sending SYNC...
----------------
Code disassembly (best guess):
   0:	f5                   	cmc
   1:	53                   	push   %rbx
   2:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi
   7:	48 89 fb             	mov    %rdi,%rbx
   a:	48 83 c7 18          	add    $0x18,%rdi
   e:	e8 86 ab 3c f6       	call   0xf63cab99
  13:	48 89 df             	mov    %rbx,%rdi
  16:	e8 de 2a 3d f6       	call   0xf63d2af9
  1b:	f7 c5 00 02 00 00    	test   $0x200,%ebp
  21:	75 23                	jne    0x46
  23:	9c                   	pushf
  24:	58                   	pop    %rax
  25:	f6 c4 02             	test   $0x2,%ah
  28:	75 37                	jne    0x61
* 2a:	bf 01 00 00 00       	mov    $0x1,%edi <-- trapping instruction
  2f:	e8 a5 01 2e f6       	call   0xf62e01d9
  34:	65 8b 05 a6 d3 a9 74 	mov    %gs:0x74a9d3a6(%rip),%eax        # 0x74a9d3e1
  3b:	85 c0                	test   %eax,%eax
  3d:	74 16                	je     0x55
  3f:	5b                   	pop    %rbx