syzbot


BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li() (2)

Status: auto-closed as invalid on 2022/07/19 17:37
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 262d, last: 229d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li() 1 595d 595d 0/1 auto-closed as invalid on 2021/08/17 18:35
upstream BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li() 1 477d 473d 0/24 auto-closed as invalid on 2021/11/13 12:08
upstream BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li() (3) C error 4 12d 73d 0/24 upstream: reported C repro on 2022/09/22 23:07

Sample crash report:
ccid3_first_li: No RTT estimate available, using fallback RTT
ccid3_first_li: X_recv==0
BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:691/ccid3_first_li()
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.17.0-rc8-syzkaller-00045-g551acdc3c3d2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ccid3_first_li.cold+0x67/0x17a net/dccp/ccids/ccid3.c:691
 tfrc_lh_interval_add+0x640/0x8e0 net/dccp/ccids/lib/loss_interval.c:157
 tfrc_rx_handle_loss+0x431/0x1dd0 net/dccp/ccids/lib/packet_history.c:328
 ccid3_hc_rx_packet_recv+0x385/0xe90 net/dccp/ccids/ccid3.c:744
 ccid_hc_rx_packet_recv net/dccp/ccid.h:182 [inline]
 dccp_deliver_input_to_ccids+0xe1/0x260 net/dccp/input.c:176
 dccp_rcv_established net/dccp/input.c:374 [inline]
 dccp_rcv_established+0x107/0x160 net/dccp/input.c:364
 dccp_v4_do_rcv+0x130/0x1a0 net/dccp/ipv4.c:667
 sk_backlog_rcv include/net/sock.h:1037 [inline]
 __sk_receive_skb+0x296/0x820 net/core/sock.c:542
 dccp_v4_rcv+0xfb2/0x1450 net/dccp/ipv4.c:890
 ip_protocol_deliver_rcu+0xa3/0xf30 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x20a/0x370 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish+0x1cb/0x2f0 net/ipv4/ip_input.c:429
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:540
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5351
 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5465
 process_backlog+0x2a5/0x6c0 net/core/dev.c:5797
 __napi_poll+0xb3/0x6e0 net/core/dev.c:6365
 napi_poll net/core/dev.c:6432 [inline]
 net_rx_action+0x801/0xb40 net/core/dev.c:6519
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 run_ksoftirqd kernel/softirq.c:921 [inline]
 run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913
 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164
 kthread+0x2e9/0x3a0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2022/03/18 18:51 upstream 551acdc3c3d2 e2d91b1d .config log report info BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li()
ci-upstream-net-kasan-gce 2022/04/20 17:30 net-next 85ef87ba9bc2 160a3f31 .config log report info BUG: stored value of X_recv is zero at net/dccp/ccids/ccid3.c:LINE/ccid3_first_li()
* Struck through repros no longer work on HEAD.