syzbot


kernel BUG at net/ipv4/tcp_output.c:LINE!

Status: auto-closed as invalid on 2019/02/22 14:50
First crash: 2280d, last: 2222d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG at net/ipv4/tcp_output.c:LINE! 37 2414d 2427d 3/26 fixed on 2017/11/07 20:45
android-44 kernel BUG at net/ipv4/tcp_output.c:LINE! C 5 2158d 1838d 0/2 public: reported C repro on 2019/04/11 08:44
upstream kernel BUG at net/ipv4/tcp_output.c:LINE! (2) net syz 23 2178d 2283d 5/26 fixed on 2018/06/07 13:52

Sample crash report:
------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2668!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.9.81-g1a93831 #33
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d9b73000 task.stack: ffff8801d9b88000
RIP: 0010:[<ffffffff83279392>]  [<ffffffff83279392>] __tcp_retransmit_skb+0x1882/0x1ce0 net/ipv4/tcp_output.c:2668
RSP: 0018:ffff8801db307b58  EFLAGS: 00010206
RAX: ffff8801d9b73000 RBX: 0000000000000001 RCX: ffffffff83279392
RDX: 0000000000000100 RSI: ffff8801b2ece304 RDI: ffff8801cec1852c
RBP: ffff8801db307c10 R08: ffff88021fffd05c R09: 0000000000000000
R10: ffff88021fffd058 R11: ffff88021fffd050 R12: ffff8801cec18586
R13: 000000005ac3962d R14: ffff8801cec18500 R15: ffff8801b2ece0c0
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a2f448 CR3: 00000001d88b2000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 15132903cc156fdf 0000000bb9b6ec21 ffff8801b2ece0c0 0000000000000004
 0000000000000000 dffffc0000000000 ffff8801c485cf30 ffff8801db307bb8
 ffffffff8339ebb7 ffff8801b2ece974 ffff8801b2ece0c0 ffffffff8339e790
Call Trace:
 [<ffffffff8327a019>] tcp_retransmit_skb+0x29/0x2b0 net/ipv4/tcp_output.c:2741
 [<ffffffff83280abf>] tcp_retransmit_timer+0xc4f/0x22c0 net/ipv4/tcp_timer.c:507
 [<ffffffff8328234e>] tcp_write_timer_handler+0x21e/0x780 net/ipv4/tcp_timer.c:591
 [<ffffffff83282a0a>] tcp_write_timer+0x15a/0x170 net/ipv4/tcp_timer.c:609
 [<ffffffff812a5854>] call_timer_fn+0x164/0x700 kernel/time/timer.c:1319
 [<ffffffff812a7adc>] expire_timers kernel/time/timer.c:1359 [inline]
 [<ffffffff812a7adc>] __run_timers kernel/time/timer.c:1658 [inline]
 [<ffffffff812a7adc>] run_timer_softirq+0xe8c/0x1650 kernel/time/timer.c:1684
 [<ffffffff838ba846>] __do_softirq+0x206/0x951 kernel/softirq.c:284
 [<ffffffff81146c45>] invoke_softirq kernel/softirq.c:364 [inline]
 [<ffffffff81146c45>] irq_exit+0x165/0x190 kernel/softirq.c:405
 [<ffffffff838b945b>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
 [<ffffffff838b945b>] smp_apic_timer_interrupt+0x7b/0xa0 arch/x86/kernel/apic/apic.c:960
 [<ffffffff838b56e0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:636
 <EOI> [   52.198977]  [<ffffffff838b2a56>] ? native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:53
 [<ffffffff838b2085>] arch_safe_halt arch/x86/include/asm/paravirt.h:103 [inline]
 [<ffffffff838b2085>] default_idle+0x55/0x360 arch/x86/kernel/process.c:295
 [<ffffffff8106bc3a>] arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:286
 [<ffffffff838b2e96>] default_idle_call+0x36/0x60 kernel/sched/idle.c:97
 [<ffffffff812266e0>] cpuidle_idle_call kernel/sched/idle.c:155 [inline]
 [<ffffffff812266e0>] cpu_idle_loop kernel/sched/idle.c:248 [inline]
 [<ffffffff812266e0>] cpu_startup_entry+0x2b0/0x380 kernel/sched/idle.c:303
 [<ffffffff810b0243>] start_secondary+0x303/0x3e0 arch/x86/kernel/smpboot.c:254
Code: ff 48 8b 7d c0 e8 7f 54 2c fe e9 cc f8 ff ff 48 89 cf e8 b2 54 2c fe e9 aa f1 ff ff e8 88 54 2c fe e9 79 f8 ff ff e8 5e 20 0f fe <0f> 0b e8 97 54 2c fe e9 53 fb ff ff e8 8d 54 2c fe e9 1b fe ff 
RIP  [<ffffffff83279392>] __tcp_retransmit_skb+0x1882/0x1ce0 net/ipv4/tcp_output.c:2668
 RSP <ffff8801db307b58>
---[ end trace 9a469742cba903d1 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/14 10:04 https://android.googlesource.com/kernel/common android-4.9 1a938310b8af 88bc17df .config console log report ci-android-49-kasan-gce
2018/01/28 11:13 https://android.googlesource.com/kernel/common android-4.9 68d447c0a37b 08d47756 .config console log report ci-android-49-kasan-gce
2018/01/27 02:12 https://android.googlesource.com/kernel/common android-4.9 f518fe49bbaa 1d18b112 .config console log report ci-android-49-kasan-gce
2018/03/23 23:14 https://android.googlesource.com/kernel/common android-4.9 ebc27895e954 2e9d9054 .config console log report ci-android-49-kasan-gce-386
2018/01/24 13:12 https://android.googlesource.com/kernel/common android-4.9 e9dabe69deb8 a5b7566c .config console log report ci-android-49-kasan-gce-386
* Struck through repros no longer work on HEAD.