syzbot


divide error in tcp_veno_cong_avoid

Status: auto-closed as invalid on 2019/02/22 14:09
First crash: 2393d, last: 2393d

Sample crash report:
tmpfs: Bad value '1' for mount option 'gid'
divide error: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 12507 Comm: syz-executor5 Not tainted 4.4.131-g6ec0e3f #35
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800a11c9800 task.stack: ffff880098ea0000
RIP: 0010:[<ffffffff833abd91>]  [<ffffffff833abd91>] tcp_veno_cong_avoid+0x1f1/0x640 net/ipv4/tcp_veno.c:148
RSP: 0018:ffff8801db2074c8  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8801ca0d6900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8801ca0d6ff8
RBP: ffff8801db207500 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
R13: ffff8801ca0d7194 R14: ffff8801ca0d6fec R15: 000000007fffffff
FS:  00007ff1bc0bc700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff1bc0bbdb8 CR3: 00000001d893d000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 00000000ca25e1e6 00000001001890bb ffffffff84a24520 0000000000000004
 0000000000000006 ffff8801ca0d6fb0 ffff8801ca0d6900 ffff8801db207688
 ffffffff83269978 ffff8801db207698 ffff8801d0c95640 ffffc53a08fdbb6d
Call Trace:
 <IRQ> 
 [<ffffffff83269978>] tcp_cong_avoid net/ipv4/tcp_input.c:3001 [inline]
 [<ffffffff83269978>] tcp_ack+0x1c18/0x4790 net/ipv4/tcp_input.c:3640
 [<ffffffff8327207c>] tcp_rcv_state_process+0x7bc/0x4150 net/ipv4/tcp_input.c:5834
 [<ffffffff8329f131>] tcp_v4_do_rcv+0x321/0x990 net/ipv4/tcp_ipv4.c:1421
 [<ffffffff832a4e82>] tcp_v4_rcv+0x2452/0x3010 net/ipv4/tcp_ipv4.c:1676
 [<ffffffff831ffa67>] ip_local_deliver_finish+0x257/0xa60 net/ipv4/ip_input.c:216
 [<ffffffff83201fe1>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff83201fe1>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff83201fe1>] ip_local_deliver+0x1f1/0x380 net/ipv4/ip_input.c:257
 [<ffffffff832008ca>] dst_input include/net/dst.h:504 [inline]
 [<ffffffff832008ca>] ip_rcv_finish+0x65a/0x1640 net/ipv4/ip_input.c:365
 [<ffffffff83202b54>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff83202b54>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff83202b54>] ip_rcv+0x9e4/0x1190 net/ipv4/ip_input.c:455
 [<ffffffff82f7d3d6>] __netif_receive_skb_core+0x12d6/0x2940 net/core/dev.c:4019
 [<ffffffff82f7ea9b>] __netif_receive_skb+0x5b/0x1b0 net/core/dev.c:4054
 [<ffffffff82f83026>] process_backlog+0x216/0x6a0 net/core/dev.c:4647
 [<ffffffff82f7fe62>] napi_poll net/core/dev.c:4885 [inline]
 [<ffffffff82f7fe62>] net_rx_action+0x3a2/0xdb0 net/core/dev.c:4950
 [<ffffffff838c31ec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff838c0f9c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:929
 <EOI> 
 [<ffffffff8113d884>] do_softirq.part.16+0x54/0x60 kernel/softirq.c:317
 [<ffffffff8113d956>] do_softirq arch/x86/include/asm/preempt.h:22 [inline]
 [<ffffffff8113d956>] __local_bh_enable_ip+0xc6/0xd0 kernel/softirq.c:170
 [<ffffffff838bf200>] __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:178 [inline]
 [<ffffffff838bf200>] _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:207
 [<ffffffff82f2a2e6>] spin_unlock_bh include/linux/spinlock.h:352 [inline]
 [<ffffffff82f2a2e6>] release_sock+0x3b6/0x500 net/core/sock.c:2484
 [<ffffffff832f6651>] inet_shutdown+0x1c1/0x370 net/ipv4/af_inet.c:844
 [<ffffffff82f205b9>] SYSC_shutdown net/socket.c:1819 [inline]
 [<ffffffff82f205b9>] SyS_shutdown+0x109/0x1b0 net/socket.c:1810
 [<ffffffff838bfd25>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: 83 c6 03 44 38 c6 7c 09 45 84 c0 0f 85 fa 03 00 00 8b 83 f0 06 00 00 48 8d bb f8 06 00 00 43 8d 34 24 48 0f af c2 31 d2 48 01 c0 <48> f7 f1 48 89 f9 29 c6 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 
RIP  [<ffffffff833abd91>] tcp_veno_cong_avoid+0x1f1/0x640 net/ipv4/tcp_veno.c:148
 RSP <ffff8801db2074c8>
---[ end trace 975e2e6ee7f1b6a9 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/05/06 11:01 https://android.googlesource.com/kernel/common android-4.4 6ec0e3f3a946 6c18ddb0 .config console log report ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.