syzbot


divide error in __tcp_select_window

Status: closed as invalid on 2019/01/01 20:10
First crash: 2656d, last: 2655d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream divide error in __tcp_select_window (2) net C done 4 1321d 1322d 20/28 fixed on 2021/11/10 00:50
upstream divide error in __tcp_select_window net C done 1119 1456d 1461d 19/28 fixed on 2021/03/10 01:48

Sample crash report:
device syz3 entered promiscuous mode
device syz3 left promiscuous mode
divide error: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 11187 Comm: syz-executor7 Not tainted 4.9.43-g7073fca #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801ceb56000 task.stack: ffff8801cde08000
RIP: 0010:[<ffffffff83261e12>]  [<ffffffff83261e12>] __tcp_select_window+0x432/0x510 net/ipv4/tcp_output.c:2499
RSP: 0018:ffff8801cde0f988  EFLAGS: 00010216
RAX: 0000000000000480 RBX: 0000000000000480 RCX: ffffc90000f3a000
RDX: 0000000000000000 RSI: 0000000000000480 RDI: ffff8801d22d88a5
RBP: ffff8801cde0f9b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 1ffff10039bc1eea R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffff8801d22d8000
FS:  00007f1debf7a700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020936000 CR3: 00000001d60d1000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 000000008123b60d ffff8801d22d8000 0000000000000000 ffff8801d22d8130
 0000000000000480 ffff8801d22d8000 ffff8801cde0f9e8 ffffffff8321b3be
 ffff8801d22d8130 0000000000000000 dffffc0000000000 ffff8801d22d8130
Call Trace:
 [<ffffffff8321b3be>] tcp_cleanup_rbuf+0x43e/0x4f0 net/ipv4/tcp.c:1468
 [<ffffffff83220c82>] tcp_recvmsg+0xd92/0x2810 net/ipv4/tcp.c:1937
 [<ffffffff832e5a36>] inet_recvmsg+0x306/0x4c0 net/ipv4/af_inet.c:784
 [<ffffffff82ec91a9>] sock_recvmsg_nosec net/socket.c:737 [inline]
 [<ffffffff82ec91a9>] sock_recvmsg+0xc9/0x110 net/socket.c:744
 [<ffffffff82ecaab2>] SYSC_recvfrom+0x1f2/0x320 net/socket.c:1721
 [<ffffffff82ecf030>] SyS_recvfrom+0x40/0x50 net/socket.c:1694
 [<ffffffff838a6985>] entry_SYSCALL_64_fastpath+0x23/0xc6
Code: fe 89 d8 44 29 e8 44 39 e0 7d 18 44 39 e3 7c 13 e8 a4 82 10 fe 45 39 f5 0f 84 b5 00 00 00 44 89 e3 eb be e8 91 82 10 fe 89 d8 99 <41> f7 fd 89 c3 41 0f af dd eb ab e8 7e 82 10 fe 44 89 f1 f7 d9 
RIP  [<ffffffff83261e12>] __tcp_select_window+0x432/0x510 net/ipv4/tcp_output.c:2499
 RSP <ffff8801cde0f988>
device syz3 entered promiscuous mode
---[ end trace 48b784d54c534ec8 ]---
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/08/15 07:28 https://android.googlesource.com/kernel/common android-4.9 7073fca5af57 6a0246bf .config console log report ci-android-49-kasan-gce
2017/08/14 13:57 https://android.googlesource.com/kernel/common android-4.9 02f29ab1b950 6a0246bf .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.