syzbot
panic: m_getm2: len is < 0
Status:
fixed on 2019/09/24 14:06
Reported-by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com
Fix commit:
2ef5bd2f0c46
Limit the number of bytes which can be queued for SCTP sockets. This is joint work with rrs@. Reported by: syzbot+307f167f9bc214f095bc@syzkaller.appspotmail.com MFC after: 1 week
First crash: 2729d, last: 2724d
Sample crash report:
login: panic: m_getm2: len is < 0
cpuid = 0
time = 1553249927
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe002127c300
vpanic() at vpanic+0x1e0/frame 0xfffffe002127c360
panic() at panic+0x43/frame 0xfffffe002127c3c0
m_getm2() at m_getm2+0x478/frame 0xfffffe002127c430
m_uiotombuf() at m_uiotombuf+0xb5/frame 0xfffffe002127c490
sctp_lower_sosend() at sctp_lower_sosend+0x5099/frame 0xfffffe002127c670
sctp_sosend() at sctp_sosend+0x510/frame 0xfffffe002127c7a0
sosend() at sosend+0xc6/frame 0xfffffe002127c810
kern_sendit() at kern_sendit+0x35e/frame 0xfffffe002127c8c0
sendit() at sendit+0x226/frame 0xfffffe002127c920
sys_sendto() at sys_sendto+0x5c/frame 0xfffffe002127c980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe002127cab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe002127cab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x412e7a, rsp = 0x7fffdffdcf38, rbp = 0x6 ---
KDB: enter: panic
[ thread pid 788 tid 100118 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
* Struck through repros no longer work on HEAD.