syzbot


WARNING in tcp_sacktag_write_queue

Status: fixed on 2018/05/16 09:57
Subsystems: net
[Documentation on labels]
Fix commit: bf2acc943a45 tcp: fix TCP_REPAIR_QUEUE bound checking
First crash: 2259d, last: 2187d

Sample crash report:
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
WARNING: CPU: 0 PID: 4491 at net/ipv4/tcp_input.c:1801 tcp_sacktag_write_queue+0x1aa2/0x2d80 net/ipv4/tcp_input.c:1801
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 4491 Comm: syz-executor591 Not tainted 4.17.0-rc2+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 panic+0x22f/0x4de kernel/panic.c:184
 __warn.cold.8+0x163/0x1b3 kernel/panic.c:536
 report_bug+0x252/0x2d0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 do_error_trap+0x1de/0x490 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:992
RIP: 0010:tcp_sacktag_write_queue+0x1aa2/0x2d80 net/ipv4/tcp_input.c:1801
RSP: 0018:ffff8801d9717090 EFLAGS: 00010293
RAX: ffff8801d9b745c0 RBX: ffff8801af2b9338 RCX: ffffffff8649f944
RDX: 0000000000000000 RSI: ffffffff8649f952 RDI: 0000000000000004
RBP: ffff8801d97171c0 R08: ffff8801d9b745c0 R09: ffffed003b2e2d9d
R10: 000000000000020c R11: 0000000000000000 R12: 000000000000000a
R13: 0000000000000009 R14: ffff8801af2b8a80 R15: 0000000000000001
 tcp_ack+0x3089/0x5500 net/ipv4/tcp_input.c:3579
 tcp_rcv_established+0x5b1/0x1ef0 net/ipv4/tcp_input.c:5451
 tcp_v4_do_rcv+0x615/0x8c0 net/ipv4/tcp_ipv4.c:1477
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2335
 release_sock+0xa4/0x2b0 net/core/sock.c:2850
 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1447
 inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
 sock_write_iter+0x35a/0x5a0 net/socket.c:908
 call_write_iter include/linux/fs.h:1784 [inline]
 do_iter_readv_writev+0x859/0xa50 fs/read_write.c:680
 do_iter_write+0x185/0x5f0 fs/read_write.c:959
 vfs_writev+0x1c7/0x330 fs/read_write.c:1004
 do_writev+0x112/0x2f0 fs/read_write.c:1039
 __do_sys_writev fs/read_write.c:1112 [inline]
 __se_sys_writev fs/read_write.c:1109 [inline]
 __x64_sys_writev+0x75/0xb0 fs/read_write.c:1109
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440419
RSP: 002b:00007ffe7a8c7bb8 EFLAGS: 00000217 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440419
RDX: 0000000000000001 RSI: 00000000200006c0 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 0000000000000010 R09: 0000000000000010
R10: 0000000000000182 R11: 0000000000000217 R12: 0000000000401d40
R13: 0000000000401dd0 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/30 00:03 upstream c61a56ababa4 bb79c6ab .config console log report syz C ci-upstream-kasan-gce-root
2018/04/29 23:42 upstream c61a56ababa4 bb79c6ab .config console log report syz C ci-upstream-kasan-gce
2018/04/30 00:14 net-next-old 9e8d438e8ba4 bb79c6ab .config console log report syz C ci-upstream-net-kasan-gce
2018/04/29 22:41 upstream c61a56ababa4 bb79c6ab .config console log report ci-upstream-kasan-gce
2018/03/29 01:48 upstream a2601d78b77a bf5e585c .config console log report ci-upstream-kasan-gce
2018/03/25 00:58 upstream bcfc1f455466 2e9d9054 .config console log report ci-upstream-kasan-gce
2018/02/17 10:49 upstream 1e3510b2b053 c8b3f7c1 .config console log report ci-upstream-kasan-gce
2018/04/30 02:45 net-next-old 589f84fb9574 bb79c6ab .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.