syzbot


WARNING in tcp_disconnect

Status: internal: reported on 2022/10/15 16:38
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 72e560cb8c6f tcp: cdg: allow tcp_cdg_release() to be called multiple times
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 114d, last: 109d

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3700 at mm/slub.c:3572 compound_order include/linux/mm.h:684 [inline]
WARNING: CPU: 1 PID: 3700 at mm/slub.c:3572 folio_order include/linux/mm.h:700 [inline]
WARNING: CPU: 1 PID: 3700 at mm/slub.c:3572 free_large_kmalloc+0x46/0x1a0 mm/slub.c:3570
Modules linked in:
CPU: 1 PID: 3700 Comm: kworker/1:5 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
Workqueue: events mptcp_worker
RIP: 0010:free_large_kmalloc+0x46/0x1a0 mm/slub.c:3572
Code: 48 8b 07 48 83 f8 ff 0f 84 26 01 00 00 49 89 f6 49 f7 07 00 00 01 00 74 11 0f 1f 44 00 00 4c 89 f8 4c 39 f8 0f 84 45 01 00 00 <0f> 0b 31 db 80 3d 67 42 36 0c 00 0f 84 c0 00 00 00 48 8b 74 24 30
RSP: 0018:ffffc900044e7a28 EFLAGS: 00010246
RAX: 00fff00000000000 RBX: ffff88801dfb1380 RCX: ffffea0000000000
RDX: 0000000000000000 RSI: ffff88801dfb1380 RDI: ffffea000077ec40
RBP: ffffffff8e288510 R08: ffffffff813ccd27 R09: ffffed100f1df4d5
R10: ffffed100f1df4d5 R11: 1ffff1100f1df4d4 R12: 00000000c86dd3be
R13: ffff888078efa640 R14: ffff88801dfb1380 R15: ffffea000077ec40
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555556c62848 CR3: 0000000027e94000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kfree+0x182/0x210 mm/slub.c:4563
 tcp_disconnect+0x9ee/0x1a10 net/ipv4/tcp.c:3145
 __mptcp_close_ssk+0x31a/0x6a0 net/mptcp/protocol.c:2327
 mptcp_do_fastclose net/mptcp/protocol.c:2592 [inline]
 mptcp_worker+0x67b/0xfe0 net/mptcp/protocol.c:2627
 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
 kthread+0x266/0x300 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-smack-root 2022/10/19 23:31 upstream 55be6084c8e0 b31320fc .config console log report info [disk image] [vmlinux] WARNING in tcp_disconnect
ci-upstream-kasan-gce-smack-root 2022/10/15 16:37 upstream 55be6084c8e0 67cb024c .config console log report info [disk image] [vmlinux] WARNING in tcp_disconnect
* Struck through repros no longer work on HEAD.