syzbot


panic: Counter goes negative

Status: fixed on 2019/03/24 20:47
Reported-by: syzbot+6b8a4bc8cc828e9d9790@syzkaller.appspotmail.com
Fix commit: 0d3cf13dabf8 Fix a signed/unsigned bug when receiving SCTP messages. This is joint work with rrs@.
First crash: 1421d, last: 1421d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
freebsd panic: Counter goes negative (2) 2 732d 753d 0/2 auto-closed as invalid on 2021/05/05 23:11
freebsd panic: Counter goes negative (3) C 13 11d 338d 0/2 upstream: reported C repro on 2022/03/05 12:47

Sample crash report:
login: panic: Counter goes negative
cpuid = 1
time = 1552950821
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe001fa36430
vpanic() at vpanic+0x1e0/frame 0xfffffe001fa36490
panic() at panic+0x43/frame 0xfffffe001fa364f0
sctp_sorecvmsg() at sctp_sorecvmsg+0x30cf/frame 0xfffffe001fa36640
sctp_soreceive() at sctp_soreceive+0x243/frame 0xfffffe001fa36850
soreceive() at soreceive+0xb9/frame 0xfffffe001fa368b0
dofileread() at dofileread+0xd3/frame 0xfffffe001fa36910
kern_readv() at kern_readv+0x66/frame 0xfffffe001fa36950
sys_readv() at sys_readv+0x50/frame 0xfffffe001fa36980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001fa36ab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001fa36ab0
--- syscall (0, FreeBSD ELF64, nosys), rip = 0x4575ba, rsp = 0x7fffdffdcf88, rbp = 0x6b5b00 ---
KDB: enter: panic
[ thread pid 759 tid 100104 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-freebsd-main 2019/03/18 23:16 freebsd b24a98cb7ea8 4656beca console log report syz C
ci-freebsd-main 2019/03/18 22:54 freebsd b24a98cb7ea8 4656beca console log report
* Struck through repros no longer work on HEAD.