panic: Counter goes negative

panic: Counter goes negative

Status: fixed on 2019/03/24 20:47
Reported-by: syzbot+6b8a4bc8cc828e9d9790@syzkaller.appspotmail.com
Fix commit: 0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
First crash: 2075d, last: 2075d

▶ ▼ Similar bugs (2)

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
freebsd	panic: Counter goes negative (2)				2	1386d	1407d	0/2	auto-closed as invalid on 2021/05/05 23:11
freebsd	panic: Counter goes negative (3)	C			595	436d	992d	2/2	fixed on 2023/09/13 21:59

Sample crash report:

login: panic: Counter goes negative
cpuid = 1
time = 1552950821
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001fa36430
vpanic() at vpanic+0x1e0/frame 0xfffffe001fa36490
panic() at panic+0x43/frame 0xfffffe001fa364f0
sctp_sorecvmsg() at sctp_sorecvmsg+0x30cf/frame 0xfffffe001fa36640
sctp_soreceive() at sctp_soreceive+0x243/frame 0xfffffe001fa36850
soreceive() at soreceive+0xb9/frame 0xfffffe001fa368b0
dofileread() at dofileread+0xd3/frame 0xfffffe001fa36910
kern_readv() at kern_readv+0x66/frame 0xfffffe001fa36950
sys_readv() at sys_readv+0x50/frame 0xfffffe001fa36980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001fa36ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001fa36ab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x4575ba, rsp = 0x7fffdffdcf88, rbp = 0x6b5b00 ---
KDB: enter: panic
[ thread pid 759 tid 100104 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2019/03/18 23:16	freebsd	b24a98cb7ea8	4656beca		console log	report	syz	C			ci-freebsd-main
2019/03/18 22:54	freebsd	b24a98cb7ea8	4656beca		console log	report					ci-freebsd-main

* ~~Struck through~~ repros no longer work on HEAD.