general protection fault in tcp

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-49	general protection fault in tcp_push				1	2148d	2050d	0/3	auto-closed as invalid on 2019/07/05 21:43
linux-4.14	general protection fault in tcp_push	C		done	55	1890d	1901d	1/1	fixed on 2019/12/09 13:28

audit: type=1400 audit(1547812667.718:1639): avc: denied { write } for pid=6832 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 6814 Comm: syz-executor4 Not tainted 4.4.171+ #9 task: ffff8801be3a4740 task.stack: ffff88009ff20000 RIP: 0010:[<ffffffff823ec989>] [<ffffffff823ec989>] tcp_mark_push net/ipv4/tcp.c:607 [inline] RIP: 0010:[<ffffffff823ec989>] [<ffffffff823ec989>] tcp_push+0xe9/0x5d0 net/ipv4/tcp.c:671 RSP: 0018:ffff88009ff279a0 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90002f54000 RDX: 0000000000000006 RSI: ffffffff823ec970 RDI: 0000000000000034 RBP: ffff88009ff279f0 R08: ffff880098914640 R09: ffff8801be3a5028 R10: 0000000000000000 R11: 0000000000000000 R12: ffff880098913d80 R13: 0000000000000000 R14: 0000000000000000 R15: ffff880098914638 FS: 00007f079feff700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30522000 CR3: 00000001d2e9a000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff81ae9255 ffff880098914640 0000fd589ff27d50 ffff880098913f70 0000021800000000 00000000000100a8 ffff880098913d80 00000000fffffe00 ffff8800b930f900 dffffc0000000000 ffff88009ff27b78 ffffffff823fb919 Call Trace: [<ffffffff823fb919>] tcp_sendmsg+0x16f9/0x2ab0 net/ipv4/tcp.c:1293 [<ffffffff824a8262>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [<ffffffff821d729e>] sock_sendmsg_nosec net/socket.c:638 [inline] [<ffffffff821d729e>] sock_sendmsg+0xbe/0x110 net/socket.c:648 [<ffffffff821d7525>] sock_write_iter+0x235/0x3d0 net/socket.c:847 [<ffffffff81496498>] new_sync_write fs/read_write.c:478 [inline] [<ffffffff81496498>] __vfs_write+0x2e8/0x3d0 fs/read_write.c:491 [<ffffffff81497fc2>] vfs_write+0x182/0x4e0 fs/read_write.c:538 [<ffffffff8149a5fc>] SYSC_write fs/read_write.c:585 [inline] [<ffffffff8149a5fc>] SyS_write+0xdc/0x1c0 fs/read_write.c:577 [<ffffffff82717721>] entry_SYSCALL_64_fastpath+0x1e/0x9a Code: 00 4d 8d 84 24 c0 08 00 00 4c 89 45 b8 e8 70 ca f1 fe 48 8d 7b 34 4c 8b 45 b8 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 e2 03 00 RIP [<ffffffff823ec989>] tcp_mark_push net/ipv4/tcp.c:607 [inline] RIP [<ffffffff823ec989>] tcp_push+0xe9/0x5d0 net/ipv4/tcp.c:671 RSP <ffff88009ff279a0> audit: type=1400 audit(1547812668.188:1640): avc: denied { read } for pid=6832 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 ---[ end trace 229f0582c9c5c7a2 ]---