| 0/0 |
2026/03/06 06:33 |
flow |
repro |
9m
Results: map[ReproOpts: ReproSyz:r0 = socket(0x2, 0x1, 0x6)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f000001)=0x4000000, 0x4)
setsockopt$sock_int(r0, 0x6, 0x2, &(0x7f000001)=0x8, 0x4)
bind(r0, &(0x7f000001)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10)
listen(r0, 0x1)
r1 = socket(0x2, 0x1, 0x6)
setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f000001)=0x4000000, 0x4)
setsockopt$sock_int(r1, 0x6, 0x2, &(0x7f000001)=0x8, 0x4)
connect(r1, &(0x7f000001)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10)
accept(r0, 0x0, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)={0x48, 0x24, 0x601, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10000, 0xffffffff, 0x0, [[{0xc, 0x1, "netem\x00"}, {0x18, 0x2, {0x2710, 0xffffffff, 0x0, 0x0, 0x0}}]]}, 0x48}], 0x1, 0x0, 0x0, 0x0}, 0x0)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 1/1 |
2026/03/06 06:33 |
action |
provide-var |
0m
Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 2/1 |
2026/03/06 06:33 |
action |
kernel-checkouter |
0m
Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/a5253da791ee6bd8b1744a6033a0524c017e7214]
|
| 3/1 |
2026/03/06 06:33 |
action |
kernel-builder |
5m
Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/efe2e744b054c6cf477e63b611e537ef68ba7cea]
|
| 4/1 |
2026/03/06 06:39 |
agent |
crash-repro-finder |
3m
Model:
Results:
Instruction:
You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
Bug Title: BUG: soft lockup in tcp_write_timer
Original Crash Report:
watchdog: BUG: soft lockup - CPU#0 stuck for 144s! [syz.4.1501:10985]
Modules linked in:
irq event stamp: 11106543
hardirqs last enabled at (11106542): [<ffffffff8bad1f2e>] irqentry_exit+0x59e/0x620 kernel/entry/common.c:242
hardirqs last disabled at (11106543): [<ffffffff8bad093e>] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1056
softirqs last enabled at (6959006): [<ffffffff8187fdef>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last enabled at (6959006): [<ffffffff8187fdef>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last enabled at (6959006): [<ffffffff8187fdef>] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
softirqs last disabled at (6959009): [<ffffffff8187fdef>] __do_softirq kernel/softirq.c:656 [inline]
softirqs last disabled at (6959009): [<ffffffff8187fdef>] invoke_softirq kernel/softirq.c:496 [inline]
softirqs last disabled at (6959009): [<ffffffff8187fdef>] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
CPU: 0 UID: 0 PID: 10985 Comm: syz.4.1501 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:194
Code: f7 e8 7d 70 f2 f5 f7 c3 00 02 00 00 74 05 e8 00 c1 1d f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> c4 36 e4 f5 65 8b 05 8d ef 6b 07 85 c0 74 18 5b 41 5e c3 cc cc
RSP: 0018:ffffc900000077c0 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000282 RCX: 0000000000000103
RDX: 0000000000000002 RSI: ffffffff8def196a RDI: 0000000000000001
RBP: 0000000000000000 R08: ffffffff901172b7 R09: 1ffffffff2022e56
R10: dffffc0000000000 R11: fffffbfff2022e57 R12: ffff888065e80000
R13: ffff888065e78000 R14: ffffffff9a4adc38 R15: 0000000000000008
FS: 00007f9ae63bf6c0(0000) GS:ffff888125466000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9ae639ed58 CR3: 000000007c7a0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
__debug_check_no_obj_freed lib/debugobjects.c:1108 [inline]
debug_check_no_obj_freed+0x52e/0x550 lib/debugobjects.c:1129
__free_pages_prepare mm/page_alloc.c:1440 [inline]
__free_frozen_pages+0x549/0xdb0 mm/page_alloc.c:2978
__folio_put+0x414/0x4f0 mm/swap.c:112
put_netmem include/net/netmem.h:420 [inline]
skb_page_unref include/linux/skbuff_ref.h:43 [inline]
__skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
skb_release_data+0x4cb/0x940 net/core/skbuff.c:1122
skb_release_all net/core/skbuff.c:1203 [inline]
__kfree_skb+0x5d/0x210 net/core/skbuff.c:1217
tcp_write_queue_purge+0x143/0x360 net/ipv4/tcp.c:3390
tcp_done_with_error+0x43/0xd0 net/ipv4/tcp_input.c:4887
tcp_write_err net/ipv4/tcp_timer.c:78 [inline]
tcp_write_timeout net/ipv4/tcp_timer.c:295 [inline]
tcp_retransmit_timer+0x1f0e/0x35f0 net/ipv4/tcp_timer.c:603
tcp_write_timer+0x15c/0x2d0 net/ipv4/tcp_timer.c:739
call_timer_fn+0x192/0x640 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__schedule+0x0/0x5340 kernel/sched/core.c:6762
Code: 81 f6 45 89 f8 89 d9 48 8b 5c 24 08 e9 ee fe ff ff cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
RSP: 0018:ffffc900044af648 EFLAGS: 00000202
RAX: 0000000000002091 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8def196a RDI: 0000000000000001
RBP: 0000000000000000 R08: ffffffff901172b7 R09: 1ffffffff2022e56
R10: dffffc0000000000 R11: fffffbfff2022e57 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7234
irqentry_exit+0x599/0x620 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5872
Code: e9 30 ff ff ff e8 65 95 0b 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 e1 22 7a 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 c6 7b 0e 0a cc 48 8d 3d 9e 48 73
RSP: 0018:ffffc900044af778 EFLAGS: 00000286
RAX: b185cdba9987f900 RBX: 0000000000000246 RCX: 0000000000000046
RDX: 000000005a44979c RSI: ffffffff8e161e99 RDI: ffffffff8c27a480
RBP: 0000000000000000 R08: ffffffff81767a45 R09: ffffffff8e7602e0
R10: ffffc900044af560 R11: ffffffff81b0b130 R12: 0000000000000002
R13: ffffffff8e7602e0 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4837
sk_prot_alloc+0x57/0x210 net/core/sock.c:2239
sk_alloc+0x3a/0x390 net/core/sock.c:2301
unix_create1+0xb0/0x7d0 net/unix/af_unix.c:-1
unix_create+0x16b/0x210 net/unix/af_unix.c:1169
__sock_create+0x4b2/0x9d0 net/socket.c:1605
sock_create net/socket.c:1663 [inline]
__sys_socketpair+0x1c4/0x560 net/socket.c:1810
__do_sys_socketpair net/socket.c:1863 [inline]
__se_sys_socketpair net/socket.c:1860 [inline]
__x64_sys_socketpair+0x9b/0xb0 net/socket.c:1860
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9ae559c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9ae63bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035
RAX: ffffffffffffffda RBX: 00007f9ae5815fa0 RCX: 00007f9ae559c629
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001
RBP: 00007f9ae5632b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9ae5816038 R14: 00007f9ae5815fa0 R15: 00007fff562bc958
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 10975 Comm: syz.2.1498 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
RIP: 0010:__lock_acquire+0x517/0x2cf0 kernel/locking/lockdep.c:5187
Code: 1d 44 89 e0 49 ff c7 49 63 8e 10 0b 00 00 48 83 c3 28 41 89 c4 49 39 cf 0f 8d c7 00 00 00 49 83 ff 31 0f 83 83 00 00 00 8b 03 <25> ff 1f 00 00 48 0f a3 05 cc f0 81 12 73 10 48 69 c0 c8 00 00 00
RSP: 0018:ffffc90000a07e00 EFLAGS: 00000083
RAX: 00000000000a6007 RBX: ffff888031ede6e8 RCX: 0000000000000007
RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff888031ede6f0 R08: ffffffff81d14b42 R09: ffffffff8e7602e0
R10: dffffc0000000000 R11: fffff91ffffb9f79 R12: 0000000000000002
R13: ffff888031ede6f0 R14: ffff888031eddac0 R15: 0000000000000006
FS: 00007f5d1500d6c0(0000) GS:ffff888125566000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa820fe9078 CR3: 0000000078b12000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
trace_call_bpf+0xe3/0xb70 kernel/trace/bpf_trace.c:-1
perf_trace_run_bpf_submit+0x78/0x170 kernel/events/core.c:11301
do_perf_trace_lock include/trace/events/lock.h:50 [inline]
perf_trace_lock+0x32d/0x410 include/trace/events/lock.h:50
__do_trace_lock_release include/trace/events/lock.h:69 [inline]
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0x392/0x3d0 kernel/locking/lockdep.c:5879
rcu_lock_release include/linux/rcupdate.h:322 [inline]
rcu_read_unlock+0x93/0xa0 include/linux/rcupdate.h:881
__perf_output_begin kernel/events/ring_buffer.c:268 [inline]
perf_output_begin_forward+0x9ea/0xab0 kernel/events/ring_buffer.c:277
__perf_event_output kernel/events/core.c:8808 [inline]
perf_event_output_forward+0x2d4/0x480 kernel/events/core.c:8826
__perf_event_overflow+0x87a/0xec0 kernel/events/core.c:10762
perf_swevent_hrtimer+0x3e0/0x590 kernel/events/core.c:12157
__run_hrtimer kernel/time/hrtimer.c:1785 [inline]
__hrtimer_run_queues+0x4e7/0xcc0 kernel/time/hrtimer.c:1849
hrtimer_interrupt+0x42b/0x1010 kernel/time/hrtimer.c:1911
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
__sysvec_apic_timer_interrupt+0x102/0x460 arch/x86/kernel/apic/apic.c:1062
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5872
Code: e9 30 ff ff ff e8 65 95 0b 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 e1 22 7a 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 c6 7b 0e 0a cc 48 8d 3d 9e 48 73
RSP: 0018:ffffc90000a08c60 EFLAGS: 00000296
RAX: 193bff1a09d4f900 RBX: 0000000000000246 RCX: 0000000000000101
RDX: 00000000f0efda00 RSI: ffffffff8e161e99 RDI: ffffffff8c27a480
RBP: 0000000000000000 R08: ffffffff81b1ec94 R09: ffffc90000a08ce0
R10: ffffc90000a08ce8 R11: fffff5200014119f R12: 0000000000000000
R13: ffffc90000a08ce0 R14: 0000000000000000 R15: 0000000000000001
call_timer_fn+0xf1/0x640 kernel/time/timer.c:1745
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:schedule_debug kernel/sched/core.c:5854 [inline]
RIP: 0010:__schedule+0x17c/0x5340 kernel/sched/core.c:6783
Code: 10 48 8d 58 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 23 c3 81 f6 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 30 00 <74> 08 48 89 df e8 0a c3 81 f6 48 81 3b 9d 6e ac 57 0f 85 89 1a 00
RSP: 0018:ffffc900047d6e00 EFLAGS: 00000246
RAX: 1ffff920008fa000 RBX: ffffc900047d0000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8c27a460 RDI: ffffffff8c27a420
RBP: ffffc900047d6ff0 R08: ffffffff901172b7 R09: 1ffffffff2022e56
R10: dffffc0000000000 R11: fffffbfff2022e57 R12: ffff888125566000
R13: 0000000000000001 R14: dffffc0000000000 R15: 1ffff110170e75b3
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7234
irqentry_exit+0x599/0x620 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_acquire+0xaa/0x2e0 kernel/locking/lockdep.c:5864
Code: 0f 84 c1 00 00 00 65 8b 05 e3 69 7a 11 85 c0 0f 85 b2 00 00 00 65 48 8b 05 2b 24 7a 11 83 b8 14 0b 00 00 00 0f 85 9d 00 00 00 <9c> 5b fa 48 c7 c7 e3 b0 f0 8d e8 c7 b1 0b 0a 65 ff 05 b0 69 7a 11
RSP: 0018:ffffc900047d7120 EFLAGS: 00000246
RAX: ffff888031eddac0 RBX: ffffffff8213758b RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff81767a62 RDI: 1ffffffff1cec05c
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff81b0b130 R12: 0000000000000002
R13: ffffffff8e7602e0 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
class_rcu_constructor include/linux/rcupdate.h:1193 [inline]
unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
save_stack+0x122/0x230 mm/page_owner.c:165
__reset_page_owner+0x71/0x1f0 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__slab_free+0x263/0x2b0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4837
vm_area_dup+0x2b/0x680 mm/vma_init.c:123
dup_mmap+0x8b1/0x1d90 mm/mmap.c:1787
dup_mm kernel/fork.c:1530 [inline]
copy_mm+0x13b/0x4b0 kernel/fork.c:1582
copy_process+0x18b6/0x3cf0 kernel/fork.c:2223
kernel_clone+0x248/0x8e0 kernel/fork.c:2654
__do_sys_clone kernel/fork.c:2795 [inline]
__se_sys_clone kernel/fork.c:2779 [inline]
__x64_sys_clone+0x1b6/0x230 kernel/fork.c:2779
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5d1419c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5d1500cfd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f5d14415fa0 RCX: 00007f5d1419c629
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f5d14232b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5d14416038 R14: 00007f5d14415fa0 R15: 00007ffc121b5768
</TASK>
The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt
Reply: r0 = socket(0x2, 0x1, 0x6)
setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f000001)=0x4000000, 0x4)
setsockopt$sock_int(r0, 0x6, 0x2, &(0x7f000001)=0x8, 0x4)
bind(r0, &(0x7f000001)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10)
listen(r0, 0x1)
r1 = socket(0x2, 0x1, 0x6)
setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f000001)=0x4000000, 0x4)
setsockopt$sock_int(r1, 0x6, 0x2, &(0x7f000001)=0x8, 0x4)
connect(r1, &(0x7f000001)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10)
accept(r0, 0x0, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)={0x48, 0x24, 0x601, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10000, 0xffffffff, 0x0, [[{0xc, 0x1, "netem\x00"}, {0x18, 0x2, {0x2710, 0xffffffff, 0x0, 0x0, 0x0}}]]}, 0x48}], 0x1, 0x0, 0x0, 0x0}, 0x0)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
sendmsg(r1, &(0x7f000001)={0x0, 0x0, &(0x7f000001)=[{&(0x7f000001)=""/1048576, 0x100000}], 0x1, 0x0, 0x0, 0x0}, 0x40)
|
| 5/2 |
2026/03/06 06:39 |
llm |
crash-repro-finder |
2m
Model:
Tokens:
input: 11779
output: 17
thoughts: 17808
Thoughts: **Reproducing a Soft Lockup in `tcp_write_timer`**
Alright, let's break this down. The goal is to trigger a "soft lockup" within the TCP stack, specifically in the `tcp_write_timer` function, which, as I understand it, is closely tied to retransmissions. The crash report points to `tcp_write_queue_purge` as the potential culprit, likely because it's spending too much time freeing SKBs (socket buffer descriptors). The `tcp_write_timer` function is part of retransmission logic, so the goal is to create a scenario where TCP is furiously retransmitting and then times out. The most likely cause is a large write queue with many SKBs that are unacknowledged and must be purged. This, in turn, suggests a lot of small packets, because small packets maximize the number of SKBs needed.
Here’s the plan, and it's heavily inspired by how Syzkaller likely found the original issue:
1. **Setup:** We start by creating two TCP sockets. One socket will listen for connections, the other will connect to the listening socket. The listening socket will accept the connection. We will set the `SO_SNDBUF` option to a large value (perhaps 32MB) on both sockets. We will also set `TCP_MAXSEG` to a very small size (e.g., 8 bytes). This will force a large number of SKBs to be created.
2. **Network Manipulation:** The trick is that we will use a netlink socket to set up a `netem` qdisc (queueing discipline) on the loopback interface (`lo`). This will be configured with 100% packet loss.
3. **Sending Data:** Now we will fill the TCP socket's buffer with data, in small chunks. Because we've specified 8 byte max segment size (MSS), and given that SO_SNDBUF is 32MB, we will get many small SKBs.
4. **Packet Loss:** Because of the `netem` rule we just added, almost every packet sent on the loopback interface will be dropped. This triggers retransmissions. The sending socket will retransmit, trying to send those 2M or so packets. But they will all be dropped.
5. **Timeout:** Eventually, TCP’s retransmission timer will give up and call `tcp_write_queue_purge`. This is where the soft lockup comes in: with a huge number of SKBs in the write queue, `tcp_write_queue_purge` will take a long time to iterate through and free them all.
This approach bypasses the problem of having to manage and manipulate TCP handshake packets using more sophisticated means (e.g. `syz_tun_create` to spoof packets). The `netem` qdisc is essentially a "firewall" on the loopback device. It makes it easy to simulate lost packets. Also, since packets are on the loopback, it is easy to setup. The critical part is setting the right socket options. We must force TCP to create a lot of small packets. We also need a large send buffer.
To write this, I’ll need a Syzkaller program. The program uses `setsockopt` with `SO_SNDBUF` (increase buffer), `TCP_MAXSEG` (small segment size), netlink to set the netem rule, and a loop of sends to trigger the buffer fill. Then, we wait for timeout. The `send` is combined with `MSG_DONTWAIT` to immediately return EAGAIN when the buffer is full (or almost full) and to avoid blocking.
|
| 6/2 |
2026/03/06 06:42 |
tool |
set-results |
0m
Args:
Results:
|
| 7/2 |
2026/03/06 06:42 |
llm |
crash-repro-finder |
0m
Model:
Tokens:
input: 30405
output: 2588
thoughts: 0
|