syzbot
assert failed: to_ticks >= 0 (2)
Status:
fixed on 2019/08/25 05:45
Reported-by: syzbot+259675123340bf46a6de@syzkaller.appspotmail.com
Fix commit:
4952945bc9cb
Clamp tcp timer quantities to reasonable ranges.
First crash: 2700d, last: 2641d
Sample crash report:
[ 30.8298560] panic: kernel diagnostic assertion "to_ticks >= 0" failed: file "/syzkaller/managers/netbsd/kernel/sys/kern/kern_timeout.c", line 335
[ 30.8298560] cpu0: Begin traceback...
[ 30.8298560] vpanic() at netbsd:vpanic+0x214
[ 30.8298560] _GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[ 30.8298560] callout_schedule_locked() at netbsd:callout_schedule_locked+0x25b
[ 30.8298560] change_keepalive() at netbsd:change_keepalive+0x104
[ 30.8298560] tcp_ctloutput() at netbsd:tcp_ctloutput+0x410
[ 30.8298560] tcp_ctloutput_wrapper() at netbsd:tcp_ctloutput_wrapper+-0x5d22f
[ 30.8298560] sosetopt() at netbsd:sosetopt+0x115
[ 30.8298560] sys_setsockopt() at netbsd:sys_setsockopt+0x187
[ 30.8298560] sys_syscall() at netbsd:sys_syscall+0xe2
[ 30.8298560] syscall() at netbsd:syscall+0x348
[ 30.8298560] --- syscall (number 0) ---
[ 30.8298560] 77428143f4ca:
[ 30.8298560] cpu0: End traceback...
[ 30.8298560] dumping to dev 4,1 (offset=0, size=0): not possible
[ 30.8298560] rebooting...
SeaBIOS (version 1.8.2-20190322_093631-google)
Total RAM Size = 0x00000001e0000000 = 7680 MiB
CPUs found: 2 Max CPUs supported: 2
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f29d0: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Booting from Hard Disk 0...
>> NetBSD/x86 BIOS Boot, Revision 5.10 (Tue Jul 17 14:59:51 UTC 2018) (from NetBSD 8.0)
>> Memory: 639/3144640 k
1. Boot normally
2. Boot single user
3. Disable ACPI
4. Disable ACPI and SMP
5. Drop to boot prompt
* Struck through repros no longer work on HEAD.