syzbot


panic: runtime error: slice bounds out of range [2:LINE]

Status: fixed on 2021/08/16 21:45
Fix commit: 6d0b40b1d159 [op] Make PacketBuffer Clone() do a deeper copy.
First crash: 1015d, last: 1015d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: runtime error: slice bounds out of range [12:LINE] C 63 167d 946d 26/26 fixed on 2023/11/17 13:01
gvisor panic: runtime error: slice bounds out of range [40:LINE] 3 1002d 1005d 14/26 fixed on 2021/09/25 08:25

Sample crash report:
panic: runtime error: slice bounds out of range [2:0]

goroutine 215600 [running]:
panic(0x125f0c0, 0xc00550d740)
	GOROOT/src/runtime/panic.go:1065 +0x565 fp=0xc089c08400 sp=0xc089c08338 pc=0x437c65
runtime.goPanicSliceB(0x2, 0x0)
	GOROOT/src/runtime/panic.go:116 +0xa5 fp=0xc089c08448 sp=0xc089c08400 pc=0x435445
gvisor.dev/gvisor/pkg/tcpip/header.IPv4.TotalLength(...)
	pkg/tcpip/header/ipv4.go:313
gvisor.dev/gvisor/pkg/tcpip/header/parse.IPv4(0xc009a80400, 0xc009a80400)
	pkg/tcpip/header/parse/parse.go:74 +0x1fd fp=0xc089c08490 sp=0xc089c08448 pc=0xb48c9d
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*protocol).Parse(0xc000c6f980, 0xc009a80400, 0x100)
	pkg/tcpip/network/ipv4/ipv4.go:1595 +0x39 fp=0xc089c084c8 sp=0xc089c08490 pc=0xbb23b9
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*protocol).parseAndValidate(0xc000c6f980, 0xc009a80400, 0x0, 0x14cffa0, 0xc003327000, 0x405000)
	pkg/tcpip/network/ipv4/ipv4.go:1551 +0x49 fp=0xc089c08550 sp=0xc089c084c8 pc=0xbb2009
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleLocalPacket(0xc0004e8700, 0xc009a80300, 0x4af001)
	pkg/tcpip/network/ipv4/ipv4.go:1024 +0x145 fp=0xc089c08770 sp=0xc089c08550 pc=0xbaf4e5
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacket(0xc0004e8700, 0xc00282ca00, 0xc009a80300, 0xc00282ca00, 0x0, 0x0)
	pkg/tcpip/network/ipv4/ipv4.go:530 +0x6b3 fp=0xc089c089c8 sp=0xc089c08770 pc=0xbaca33
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).WritePacket(0xc0004e8700, 0xc00282ca00, 0x560b004000000006, 0xc009a80300, 0x1414, 0xc008f747ca)
	pkg/tcpip/network/ipv4/ipv4.go:520 +0x1be fp=0xc089c08a38 sp=0xc089c089c8 pc=0xbac1fe
gvisor.dev/gvisor/pkg/tcpip/stack.(*Route).WritePacket(0xc00282ca00, 0x4000000006, 0xc009a80300, 0x4, 0x560b)
	pkg/tcpip/stack/route.go:569 +0xd7 fp=0xc089c08a78 sp=0xc089c08a38 pc=0x9aeb57
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.sendTCP(0xc00282ca00, 0x0, 0xc001f78994, 0x4, 0x560b, 0xc001f78990, 0x4, 0x140040, 0x6f980f85, 0x0, ...)
	pkg/tcpip/transport/tcp/connect.go:1005 +0x28e fp=0xc089c0a898 sp=0xc089c08a78 pc=0xb5ddae
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.replyWithReset(0xc00044e700, 0xc008c04c00, 0x0, 0x0, 0x0)
	pkg/tcpip/transport/tcp/protocol.go:217 +0x225 fp=0xc089c0a9f0 sp=0xc089c0a898 pc=0xb72e85
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*protocol).HandleUnknownDestinationPacket(0xc00052c0f0, 0x0, 0xc001f78994, 0x4, 0x560b, 0xc001f78990, 0x4, 0xc009a80200, 0x0)
	pkg/tcpip/transport/tcp/protocol.go:164 +0x17b fp=0xc089c0aa70 sp=0xc089c0a9f0 pc=0xb72bfb
gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverTransportPacket(0xc0002b5880, 0x6, 0xc009a80200, 0x0)
	pkg/tcpip/stack/nic.go:1022 +0x3f8 fp=0xc089c0ab78 sp=0xc089c0aa70 pc=0x9a5c58
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleValidatedPacket(0xc0004e8700, 0xc001521bb6, 0x14, 0x3c, 0xc009a80200, 0xc0004ed2e4, 0x7)
	pkg/tcpip/network/ipv4/ipv4.go:1278 +0x674 fp=0xc089c0b340 sp=0xc089c0ab78 pc=0xbafc54
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleLocalPacket(0xc0004e8700, 0xc009a80100, 0x1)
	pkg/tcpip/network/ipv4/ipv4.go:1032 +0x1de fp=0xc089c0b560 sp=0xc089c0b340 pc=0xbaf57e
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacket(0xc0004e8700, 0xc00282c960, 0xc009a80100, 0xc00282c900, 0x0, 0x0)
	pkg/tcpip/network/ipv4/ipv4.go:530 +0x6b3 fp=0xc089c0b7b8 sp=0xc089c0b560 pc=0xbaca33
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).WritePacket(0xc0004e8700, 0xc00282c960, 0x4000000006, 0xc009a80100, 0x800, 0xc000a124f8)
	pkg/tcpip/network/ipv4/ipv4.go:520 +0x1be fp=0xc089c0b828 sp=0xc089c0b7b8 pc=0xbac1fe
gvisor.dev/gvisor/pkg/tcpip/stack.(*Route).WritePacket(0xc00282c960, 0x4000000006, 0xc009a80100, 0x4, 0x0)
	pkg/tcpip/stack/route.go:569 +0xd7 fp=0xc089c0b868 sp=0xc089c0b828 pc=0x9aeb57
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.sendTCP(0xc00282c960, 0x560b, 0xc00082e348, 0x4, 0x0, 0xc00082e348, 0x4, 0x6f980f8400020040, 0x720000000000, 0xc005ac3e60, ...)
	pkg/tcpip/transport/tcp/connect.go:1005 +0x28e fp=0xc089c0d688 sp=0xc089c0b868 pc=0xb5ddae
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*endpoint).sendTCP(0xc008f4f500, 0xc00282c960, 0x560b, 0xc00082e348, 0x4, 0x0, 0xc00082e348, 0x4, 0x6f980f8400020000, 0x720000000000, ...)
	pkg/tcpip/transport/tcp/connect.go:871 +0xff fp=0xc089c0d758 sp=0xc089c0d688 pc=0xb5d01f
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*endpoint).sendSynTCP(0xc008f4f500, 0xc00282c960, 0x560b, 0xc00082e348, 0x4, 0x0, 0xc00082e348, 0x4, 0x6f980f8400020000, 0x720000000000, ...)
	pkg/tcpip/transport/tcp/connect.go:859 +0xe5 fp=0xc089c0d820 sp=0xc089c0d758 pc=0xb5ce65
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*handshake).start(0xc008f27580)
	pkg/tcpip/transport/tcp/connect.go:583 +0x325 fp=0xc089c0d958 sp=0xc089c0d820 pc=0xb5bae5
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*endpoint).connect(0xc008f4f500, 0x0, 0x0, 0x0, 0xc009340000, 0x4d0101, 0x0, 0x0)
	pkg/tcpip/transport/tcp/endpoint.go:2772 +0x979 fp=0xc089c0efe8 sp=0xc089c0d958 pc=0xb6b919
gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*endpoint).Connect(0xc008f4f500, 0xc000000000, 0x0, 0x0, 0x0, 0x0, 0xc009340000)
	pkg/tcpip/transport/tcp/endpoint.go:2445 +0x86 fp=0xc089c0f9f8 sp=0xc089c0efe8 pc=0xb6ae26
gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*socketOpsCommon).Connect(0xc00325ff50, 0xc009a98000, 0xc001f78930, 0x10, 0x10, 0x1, 0x0)
	pkg/sentry/socket/netstack/netstack.go:663 +0x3f5 fp=0xc089c0faf8 sp=0xc089c0f9f8 pc=0xbe0515
gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Connect(0xc009a98000, 0x3, 0x20000300, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	pkg/sentry/syscalls/linux/vfs2/socket.go:328 +0x227 fp=0xc089c0fba8 sp=0xc089c0faf8 pc=0xed36e7
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall(0xc009a98000, 0x2a, 0x3, 0x20000300, 0x10, 0x0, 0x0, 0x0, 0xf1b293, 0x1340c20, ...)
	pkg/sentry/kernel/task_syscall.go:116 +0x1b9 fp=0xc089c0fc68 sp=0xc089c0fba8 pc=0xa467b9
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke(0xc009a98000, 0x2a, 0x3, 0x20000300, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0)
	pkg/sentry/kernel/task_syscall.go:291 +0x70 fp=0xc089c0fcf0 sp=0xc089c0fc68 pc=0xa47a90
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter(0xc009a98000, 0x2a, 0x3, 0x20000300, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0)
	pkg/sentry/kernel/task_syscall.go:238 +0xb4 fp=0xc089c0fd50 sp=0xc089c0fcf0 pc=0xa47574
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall(0xc009a98000, 0x2, 0xc009a98000)
	pkg/sentry/kernel/task_syscall.go:205 +0x198 fp=0xc089c0fe20 sp=0xc089c0fd50 pc=0xa46e58
gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute(0x0, 0xc009a98000, 0x14cfca0, 0x0)
	pkg/sentry/kernel/task_run.go:327 +0xe1f fp=0xc089c0ff60 sp=0xc089c0fe20 pc=0xa39bbf
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run(0xc009a98000, 0xcfb)
	pkg/sentry/kernel/task_run.go:100 +0x1e2 fp=0xc089c0ffd0 sp=0xc089c0ff60 pc=0xa38642
runtime.goexit()
	src/runtime/asm_amd64.s:1371 +0x1 fp=0xc089c0ffd8 sp=0xc089c0ffd0 pc=0x472821
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start
	pkg/sentry/kernel/task_start.go:381 +0x116

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/20 18:25 gvisor 5ad30cac2ede 1b201b48 .config console log report info ci-gvisor-kvm-cover panic: runtime error: slice bounds out of range [2:LINE]
* Struck through repros no longer work on HEAD.