syzbot


panic: rcv_start < rcv_end

Status: fixed on 2019/10/02 01:48
Reported-by: syzbot+4bf3bda3dea6907c816f@syzkaller.appspotmail.com
Fix commit: Only update SACK/DSACK lists when a non-empty segment was received. This fixes hitting a KASSERT with a valid packet exchange.
First crash: 1247d, last: 1247d

Sample crash report:
panic: rcv_start < rcv_end
cpuid = 0
time = 1567903232
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame 0xfffffe0019f6c250
vpanic() at vpanic+0x1e0/frame 0xfffffe0019f6c2b0
panic() at panic+0x43/frame 0xfffffe0019f6c310
tcp_update_dsack_list() at tcp_update_dsack_list+0x962/frame 0xfffffe0019f6c3c0
tcp_do_segment() at tcp_do_segment+0x4252/frame 0xfffffe0019f6c4d0
tcp_input() at tcp_input+0x1583/frame 0xfffffe0019f6c640
ip_input() at ip_input+0x2c4/frame 0xfffffe0019f6c700
netisr_dispatch_src() at netisr_dispatch_src+0xe9/frame 0xfffffe0019f6c770
ether_demux() at ether_demux+0x24a/frame 0xfffffe0019f6c7c0
ether_nh_input() at ether_nh_input+0x7c6/frame 0xfffffe0019f6c840
netisr_dispatch_src() at netisr_dispatch_src+0xe9/frame 0xfffffe0019f6c8b0
ether_input() at ether_input+0xbf/frame 0xfffffe0019f6c900
vtnet_rxq_eof() at vtnet_rxq_eof+0xb22/frame 0xfffffe0019f6c9b0
vtnet_rx_vq_intr() at vtnet_rx_vq_intr+0xa5/frame 0xfffffe0019f6c9f0
ithread_loop() at ithread_loop+0x2f2/frame 0xfffffe0019f6ca60
fork_exit() at fork_exit+0xb0/frame 0xfffffe0019f6cab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0019f6cab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100039 ]
Stopped at      kdb_enter+0x6a: movq    $0,kdb_why
db> 

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-freebsd-main 2019/09/08 00:40 freebsd bb0c984706c2 a60cb4cd console log report
* Struck through repros no longer work on HEAD.