syzbot


WARNING in __mptcp_move_skbs_from_subflow (2)

Status: upstream: reported on 2025/11/21 12:11
Subsystems: mptcp
[Documentation on labels]
Reported-by: syzbot+9475dcc0b42355ded022@syzkaller.appspotmail.com
First crash: 49d, last: 38d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mptcp?] WARNING in __mptcp_move_skbs_from_subflow (2) 0 (1) 2025/11/21 12:11
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING in __mptcp_move_skbs_from_subflow -1 1 731d 731d 0/3 auto-obsoleted due to no activity on 2024/04/18 16:30
linux-5.15 WARNING in __mptcp_move_skbs_from_subflow -1 1 721d 721d 0/3 auto-obsoleted due to no activity on 2024/04/28 15:28
linux-5.15 WARNING in __mptcp_move_skbs_from_subflow (2) origin:lts-only -1 C error 8 446d 529d 0/3 auto-obsoleted due to no activity on 2025/01/28 21:52
linux-6.1 WARNING in __mptcp_move_skbs_from_subflow (2) -1 14 444d 514d 0/3 auto-obsoleted due to no activity on 2025/01/04 07:58
upstream WARNING in __mptcp_move_skbs_from_subflow mptcp -1 C error 90 456d 543d 28/29 fixed on 2024/11/12 23:31

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 564 at net/mptcp/protocol.c:723 __mptcp_move_skbs_from_subflow+0x5e3/0x3360 net/mptcp/protocol.c:723
Modules linked in:
CPU: 0 UID: 0 PID: 564 Comm: syz.1.5904 Tainted: G     U  W    L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [W]=WARN, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__mptcp_move_skbs_from_subflow+0x5e3/0x3360 net/mptcp/protocol.c:723
Code: 82 ee 01 00 00 e8 7d d3 73 f6 48 8b 44 24 48 48 c1 e8 03 42 80 3c 30 00 0f 85 91 28 00 00 48 8b 04 24 48 8b a8 f0 07 00 00 90 <0f> 0b 90 48 8d bd e0 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 30 00
RSP: 0018:ffffc9000c3af9c8 EFLAGS: 00010246
RAX: ffff88807a4b2640 RBX: ffff888033fd9c70 RCX: ffffffff8b493f15
RDX: ffff88807fac5ac0 RSI: ffffffff8b493f23 RDI: 0000000000000004
RBP: ffff88806bdac400 R08: 0000000000000004 R09: 000000000001802a
R10: 0000000000008000 R11: 0000000000000001 R12: 0000000000008000
R13: 000000005c45ecc4 R14: dffffc0000000000 R15: ffff888012433c00
FS:  00007f46332f06c0(0000) GS:ffff8881249fe000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f46332aed58 CR3: 0000000055596000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __mptcp_move_skbs+0x2ac/0x460 net/mptcp/protocol.c:2158
 mptcp_release_cb+0x64a/0xa60 net/mptcp/protocol.c:3531
 release_sock+0x1d0/0x220 net/core/sock.c:3738
 inet_wait_for_connect net/ipv4/af_inet.c:611 [inline]
 __inet_stream_connect+0x659/0xf50 net/ipv4/af_inet.c:705
 inet_stream_connect+0x57/0xa0 net/ipv4/af_inet.c:750
 __sys_connect_file+0x141/0x1a0 net/socket.c:2102
 __sys_connect+0x13b/0x160 net/socket.c:2121
 __do_sys_connect net/socket.c:2127 [inline]
 __se_sys_connect net/socket.c:2124 [inline]
 __x64_sys_connect+0x72/0xb0 net/socket.c:2124
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f463238f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f46332f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007f46325e5fa0 RCX: 00007f463238f7c9
RDX: 0000000000000054 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f4632413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f46325e6038 R14: 00007f46325e5fa0 R15: 00007fff3b136cc8
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/02 06:34 upstream 1d18101a644e d1b870e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto WARNING in __mptcp_move_skbs_from_subflow
2025/11/21 10:31 upstream fd95357fd8c6 52ed5c96 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING in __mptcp_move_skbs_from_subflow
* Struck through repros no longer work on HEAD.