syzbot


WARNING in tcp_cleanup_ulp

Status: fixed on 2018/11/12 21:25
Subsystems: net
[Documentation on labels]
Fix commit: aadd4355918f tcp, ulp: remove socket lock assertion on ULP cleanup
First crash: 2017d, last: 2017d

Sample crash report:
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
WARNING: CPU: 1 PID: 7584 at include/net/sock.h:1539 sock_owned_by_me include/net/sock.h:1539 [inline]
WARNING: CPU: 1 PID: 7584 at include/net/sock.h:1539 tcp_cleanup_ulp+0x1ad/0x200 net/ipv4/tcp_ulp.c:102
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 7584 Comm: syz-executor0 Not tainted 4.19.0-rc7+ #263
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 panic+0x238/0x4e7 kernel/panic.c:184
 __warn.cold.8+0x163/0x1ba kernel/panic.c:536
 report_bug+0x254/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x1fc/0x4d0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:993
RIP: 0010:sock_owned_by_me include/net/sock.h:1539 [inline]
RIP: 0010:tcp_cleanup_ulp+0x1ad/0x200 net/ipv4/tcp_ulp.c:102
Code: 83 c0 03 38 d0 7c 04 84 d2 75 61 44 8b 25 5b 21 e8 02 31 ff 44 89 e6 e8 71 20 f7 fa 45 85 e4 0f 84 91 fe ff ff e8 53 1f f7 fa <0f> 0b e9 85 fe ff ff 4c 89 ef e8 d4 4f 39 fb e9 9f fe ff ff 4c 89
RSP: 0018:ffff8801daf06860 EFLAGS: 00010206
RAX: ffff8801c1da8140 RBX: ffff8801caca4d40 RCX: ffffffff8687b9ef
RDX: 0000000000000100 RSI: ffffffff8687b9fd RDI: 0000000000000005
RBP: ffff8801daf06880 R08: ffff8801c1da8140 R09: 0000000000000002
R10: 0000000000000000 R11: ffff8801c1da8140 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000003 R15: ffff8801daf069a0
 tcp_v4_destroy_sock+0x161/0x990 net/ipv4/tcp_ipv4.c:1980
 tcp_v6_destroy_sock+0x15/0x20 net/ipv6/tcp_ipv6.c:1762
 inet_csk_destroy_sock+0x19f/0x440 net/ipv4/inet_connection_sock.c:838
 tcp_done+0x272/0x310 net/ipv4/tcp.c:3760
 tcp_v6_syn_recv_sock+0x1f21/0x25f0 net/ipv6/tcp_ipv6.c:1236
 tcp_get_cookie_sock+0x10e/0x580 net/ipv4/syncookies.c:213
 cookie_v6_check+0x17c7/0x27d0 net/ipv6/syncookies.c:257
 tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1028 [inline]
 tcp_v6_do_rcv+0x10ea/0x13c0 net/ipv6/tcp_ipv6.c:1336
 tcp_v6_rcv+0x320f/0x3890 net/ipv6/tcp_ipv6.c:1545
 ip6_input_finish+0x3fc/0x1aa0 net/ipv6/ip6_input.c:384
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:427
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x115/0x640 net/ipv6/ip6_input.c:272
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4941
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5051
 process_backlog+0x218/0x6f0 net/core/dev.c:5855
 napi_poll net/core/dev.c:6275 [inline]
 net_rx_action+0x7c5/0x1950 net/core/dev.c:6341
 __do_softirq+0x30b/0xad8 kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1047
 </IRQ>
 do_softirq.part.13+0x126/0x160 kernel/softirq.c:336
 do_softirq kernel/softirq.c:328 [inline]
 __local_bh_enable_ip+0x21d/0x260 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:723 [inline]
 ip6_finish_output2+0xce4/0x27a0 net/ipv6/ip6_output.c:121
 ip6_finish_output+0x5fe/0xbc0 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:444 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_xmit+0xf69/0x2420 net/ipv6/ip6_output.c:275
 inet6_csk_xmit+0x375/0x630 net/ipv6/inet6_connection_sock.c:139
 __tcp_transmit_skb+0x1c0e/0x3b60 net/ipv4/tcp_output.c:1160
 tcp_transmit_skb net/ipv4/tcp_output.c:1176 [inline]
 tcp_write_xmit+0x10e0/0x5780 net/ipv4/tcp_output.c:2378
 tcp_push_one+0xdd/0x110 net/ipv4/tcp_output.c:2565
 tcp_sendmsg_locked+0xbc3/0x3f00 net/ipv4/tcp.c:1386
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1443
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 __sys_sendto+0x3d7/0x670 net/socket.c:1788
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f6ea1b21c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569
RDX: fffffffffffffedd RSI: 0000000020000280 RDI: 0000000000000007
RBP: 000000000072bf00 R08: 0000000020000080 R09: 000000000000001c
R10: 0000000020000004 R11: 0000000000000246 R12: 00007f6ea1b226d4
R13: 00000000004c3921 R14: 00000000004d57d8 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/10/17 01:10 net-next-old 2c59f06cc044 1ba7fd7e .config console log report syz ci-upstream-net-kasan-gce
2018/10/16 15:44 net-next-old 2c59f06cc044 1ba7fd7e .config console log report syz ci-upstream-net-kasan-gce
2018/10/17 03:10 linux-next 6d5d82417dd6 1ba7fd7e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/10/16 18:29 linux-next 6d5d82417dd6 1ba7fd7e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2018/10/17 01:32 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/17 00:40 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 21:53 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 18:47 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 18:36 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 16:15 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 15:04 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/16 13:48 net-next-old 2c59f06cc044 1ba7fd7e .config console log report ci-upstream-net-kasan-gce
2018/10/17 04:00 linux-next 6d5d82417dd6 1ba7fd7e .config console log report ci-upstream-linux-next-kasan-gce-root
2018/10/16 15:03 linux-next 6d5d82417dd6 1ba7fd7e .config console log report ci-upstream-linux-next-kasan-gce-root
2018/10/16 12:51 linux-next 6d5d82417dd6 1ba7fd7e .config console log report ci-upstream-linux-next-kasan-gce-root
2018/10/16 12:02 linux-next 6d5d82417dd6 8cd30605 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.