bisecting fixing commit since e2cd24b629389b52a31d96d226ed150dacab9cdd building syzkaller on a60cb4cd840ce786236a00480e8bb1025e0c5fef testing commit e2cd24b629389b52a31d96d226ed150dacab9cdd with gcc (GCC) 8.1.0 kernel signature: 0bb9bb3d60716ea0ac23f51bb42879e2e7d96741 all runs: crashed: WARNING in tcp_retransmit_timer testing current HEAD a844dc4c544291470aa69edbe2434b040794e269 testing commit a844dc4c544291470aa69edbe2434b040794e269 with gcc (GCC) 8.1.0 kernel signature: 7a5b77fbc673acafc4367c56f329651fa2ee2961 all runs: OK # git bisect start a844dc4c544291470aa69edbe2434b040794e269 e2cd24b629389b52a31d96d226ed150dacab9cdd Bisecting: 858 revisions left to test after this (roughly 10 steps) [107e5b0b9ed11d99e409e4a3e120237710c39e95] net: openvswitch: free vport unless register_netdevice() succeeds testing commit 107e5b0b9ed11d99e409e4a3e120237710c39e95 with gcc (GCC) 8.1.0 kernel signature: 0684b6f8cb75d7a9a11249c408c58541133c26da all runs: OK # git bisect bad 107e5b0b9ed11d99e409e4a3e120237710c39e95 Bisecting: 429 revisions left to test after this (roughly 9 steps) [07a971f35f90e4b5823a7c2e7a83df85328f4ad3] powerpc/pseries: Fix cpu_hotplug_lock acquisition in resize_hpt() testing commit 07a971f35f90e4b5823a7c2e7a83df85328f4ad3 with gcc (GCC) 8.1.0 kernel signature: 738f0b9980faad67b1829b4a97e3090289d168eb all runs: OK # git bisect bad 07a971f35f90e4b5823a7c2e7a83df85328f4ad3 Bisecting: 214 revisions left to test after this (roughly 8 steps) [66b330f8729281f03924f1ebaaba42612a545d3d] media: rc: imon: Allow iMON RC protocol for ffdc 7e device testing commit 66b330f8729281f03924f1ebaaba42612a545d3d with gcc (GCC) 8.1.0 kernel signature: e45a0b4ccd2727017b58fc976169c3bc05686e56 all runs: OK # git bisect bad 66b330f8729281f03924f1ebaaba42612a545d3d Bisecting: 106 revisions left to test after this (roughly 7 steps) [2bb28f30f7995e1be8d0cf2a10c25c33419c92fe] perf/x86/intel: Restrict period on Nehalem testing commit 2bb28f30f7995e1be8d0cf2a10c25c33419c92fe with gcc (GCC) 8.1.0 kernel signature: cfdf0f4b9c1a1c2f485c23c9d17f1b4b3b91e975 all runs: crashed: WARNING in tcp_retransmit_timer # git bisect good 2bb28f30f7995e1be8d0cf2a10c25c33419c92fe Bisecting: 53 revisions left to test after this (roughly 6 steps) [e991f02f6f9117514ed1374b39ce195013ab9cd0] f2fs: use generic EFSBADCRC/EFSCORRUPTED testing commit e991f02f6f9117514ed1374b39ce195013ab9cd0 with gcc (GCC) 8.1.0 kernel signature: dcdd222184bf4ce5c9dc7eccb983bb43041c2a34 all runs: OK # git bisect bad e991f02f6f9117514ed1374b39ce195013ab9cd0 Bisecting: 26 revisions left to test after this (roughly 5 steps) [16694567a78161aa952cc41cfbc82fc7bf30c47c] HID: sony: Fix memory corruption issue on cleanup. testing commit 16694567a78161aa952cc41cfbc82fc7bf30c47c with gcc (GCC) 8.1.0 kernel signature: f4e24a32a9ddc2cdcb02875a4171146fb063154e all runs: OK # git bisect bad 16694567a78161aa952cc41cfbc82fc7bf30c47c Bisecting: 12 revisions left to test after this (roughly 4 steps) [b15bf74405faa1a65025eb8a6eb337e140e5250a] iommu/amd: Fix race in increase_address_space() testing commit b15bf74405faa1a65025eb8a6eb337e140e5250a with gcc (GCC) 8.1.0 kernel signature: f12f5e3667e62b7d6d62597a532b110d49494e15 run #0: crashed: WARNING in tcp_retransmit_timer run #1: crashed: WARNING in tcp_retransmit_timer run #2: crashed: WARNING in tcp_retransmit_timer run #3: crashed: WARNING in tcp_retransmit_timer run #4: crashed: WARNING in tcp_retransmit_timer run #5: crashed: WARNING in tcp_retransmit_timer run #6: crashed: WARNING in corrupted run #7: crashed: WARNING in tcp_retransmit_timer run #8: crashed: WARNING in tcp_retransmit_timer run #9: crashed: WARNING in tcp_retransmit_timer # git bisect good b15bf74405faa1a65025eb8a6eb337e140e5250a Bisecting: 6 revisions left to test after this (roughly 3 steps) [120d5674a14f5d641970bc4287a752e60415b17c] media: technisat-usb2: break out of loop at end of buffer testing commit 120d5674a14f5d641970bc4287a752e60415b17c with gcc (GCC) 8.1.0 kernel signature: d57fe785854f5fc03ffb7083c85c87bfccd455f0 all runs: OK # git bisect bad 120d5674a14f5d641970bc4287a752e60415b17c Bisecting: 2 revisions left to test after this (roughly 2 steps) [56af7c0ea79095edbf198711141805b936fc2996] binfmt_elf: move brk out of mmap when doing direct loader exec testing commit 56af7c0ea79095edbf198711141805b936fc2996 with gcc (GCC) 8.1.0 kernel signature: 754f38a9d66b33701499dce0ee66763566174211 all runs: crashed: WARNING in tcp_retransmit_timer # git bisect good 56af7c0ea79095edbf198711141805b936fc2996 Bisecting: 0 revisions left to test after this (roughly 1 step) [ba2ddb43f270e6492ccce4fc42fc32c611de8f68] tcp: Don't dequeue SYN/FIN-segments from write-queue testing commit ba2ddb43f270e6492ccce4fc42fc32c611de8f68 with gcc (GCC) 8.1.0 kernel signature: 3cf98fc43cd73f0fbc5ad35209d8db43c528c9fd all runs: OK # git bisect bad ba2ddb43f270e6492ccce4fc42fc32c611de8f68 Bisecting: 0 revisions left to test after this (roughly 0 steps) [f1dcc5ed4bea3f2d63b74ad86617ec12b1e5e9d4] tcp: Reset send_head when removing skb from write-queue testing commit f1dcc5ed4bea3f2d63b74ad86617ec12b1e5e9d4 with gcc (GCC) 8.1.0 kernel signature: 438d92a1436159ddd29b218859777cecf1510202 all runs: crashed: WARNING in tcp_retransmit_timer # git bisect good f1dcc5ed4bea3f2d63b74ad86617ec12b1e5e9d4 ba2ddb43f270e6492ccce4fc42fc32c611de8f68 is the first bad commit commit ba2ddb43f270e6492ccce4fc42fc32c611de8f68 Author: Christoph Paasch Date: Fri Sep 13 13:08:19 2019 -0700 tcp: Don't dequeue SYN/FIN-segments from write-queue If a SYN/FIN-segment is on the write-queue, skb->len is 0, but the segment actually has been transmitted. end_seq and seq of the tcp_skb_cb in that case will indicate this difference. We should not remove such segments from the write-queue as we might be in SYN_SENT-state and a retransmission-timer is running. When that one fires, packets_out will be 1, but the write-queue would be empty, resulting in: [ 61.280214] ------------[ cut here ]------------ [ 61.281307] WARNING: CPU: 0 PID: 0 at net/ipv4/tcp_timer.c:429 tcp_retransmit_timer+0x18f9/0x2660 [ 61.283498] Modules linked in: [ 61.284084] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.142 #58 [ 61.285214] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011 [ 61.286644] task: ffffffff8401e1c0 task.stack: ffffffff84000000 [ 61.287758] RIP: 0010:tcp_retransmit_timer+0x18f9/0x2660 [ 61.288715] RSP: 0018:ffff88806ce07cb8 EFLAGS: 00010206 [ 61.289669] RAX: ffffffff8401e1c0 RBX: ffff88805c998b00 RCX: 0000000000000006 [ 61.290968] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88805c9994d8 [ 61.292314] RBP: ffff88805c99919a R08: ffff88807fff901c R09: ffff88807fff9008 [ 61.293547] R10: ffff88807fff9017 R11: ffff88807fff9010 R12: ffff88805c998b30 [ 61.294834] R13: ffffffff844b9380 R14: 0000000000000000 R15: ffff88805c99930c [ 61.296086] FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000 [ 61.297523] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.298646] CR2: 00007f721da50ff8 CR3: 0000000004014002 CR4: 00000000001606f0 [ 61.299944] Call Trace: [ 61.300403] [ 61.300806] ? kvm_sched_clock_read+0x21/0x30 [ 61.301689] ? sched_clock+0x5/0x10 [ 61.302433] ? sched_clock_cpu+0x18/0x170 [ 61.303173] tcp_write_timer_handler+0x2c1/0x7a0 [ 61.304038] tcp_write_timer+0x13e/0x160 [ 61.304794] call_timer_fn+0x14a/0x5f0 [ 61.305480] ? tcp_write_timer_handler+0x7a0/0x7a0 [ 61.306364] ? __next_timer_interrupt+0x140/0x140 [ 61.307229] ? _raw_spin_unlock_irq+0x24/0x40 [ 61.308033] ? tcp_write_timer_handler+0x7a0/0x7a0 [ 61.308887] ? tcp_write_timer_handler+0x7a0/0x7a0 [ 61.309760] run_timer_softirq+0xc41/0x1080 [ 61.310539] ? trigger_dyntick_cpu.isra.33+0x180/0x180 [ 61.311506] ? ktime_get+0x13f/0x1c0 [ 61.312232] ? clockevents_program_event+0x10d/0x2f0 [ 61.313158] __do_softirq+0x20b/0x96b [ 61.313889] irq_exit+0x1a7/0x1e0 [ 61.314513] smp_apic_timer_interrupt+0xfc/0x4d0 [ 61.315386] apic_timer_interrupt+0x8f/0xa0 [ 61.316129] Followed by a panic. So, before removing an skb with skb->len == 0, let's make sure that the skb is really empty by checking the end_seq and seq. This patch needs to be backported only to 4.14 and older (among those that applied the backport of fdfc5c8594c2). Fixes: fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases") Cc: Eric Dumazet Cc: Jason Baron Cc: Vladimir Rutsky Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Signed-off-by: Christoph Paasch Signed-off-by: Greg Kroah-Hartman net/ipv4/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) kernel signature: 3cf98fc43cd73f0fbc5ad35209d8db43c528c9fd previous signature: 438d92a1436159ddd29b218859777cecf1510202 revisions tested: 13, total time: 3h28m54.794302524s (build: 1h43m35.033475127s, test: 1h44m11.519934193s) first good commit: ba2ddb43f270e6492ccce4fc42fc32c611de8f68 tcp: Don't dequeue SYN/FIN-segments from write-queue cc: ["cpaasch@apple.com" "edumazet@google.com" "gregkh@linuxfoundation.org" "jbaron@akamai.com" "ncardwell@google.com" "rutsky@google.com" "soheil@google.com"]