From: Eric Biggers <ebiggers@kernel•org>
To: syzbot <syzbot+e326127852f785c44347@syzkaller•appspotmail.com>
Cc: davem@davemloft•net, dccp@vger•kernel.org,
garsilva@embeddedor•com, gerrit@erg•abdn.ac.uk,
linux-kernel@vger•kernel.org, netdev@vger•kernel.org,
syzkaller-bugs@googlegroups•com
Subject: Re: BUG: please report to dccp@vger•kernel.org => prev = 5, last = 5 at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx_his
Date: Tue, 26 Feb 2019 16:44:09 -0800 [thread overview]
Message-ID: <20190227004409.GI218103@gmail.com> (raw)
In-Reply-To: <000000000000627205057803724d@google.com>
On Fri, Oct 12, 2018 at 12:58:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 771b65e89c8a Add linux-next specific files for 20181011
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=167d2376400000
> kernel config: https://syzkaller.appspot.com/x/.config?x=45f1c06c4da0a925
> dashboard link: https://syzkaller.appspot.com/bug?extid=e326127852f785c44347
> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+e326127852f785c44347@syzkaller•appspotmail.com
>
> BUG: please report to dccp@vger•kernel.org => prev = 5, last = 5 at
> net/dccp/ccids/lib/packet_history.c:425/tfrc_rx_hist_sample_rtt()
> CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 4.19.0-rc7-next-20181011+ #92
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0x244/0x3ab lib/dump_stack.c:113
> tfrc_rx_hist_sample_rtt.cold.3+0x54/0x5c
> net/dccp/ccids/lib/packet_history.c:422
> ccid3_hc_rx_packet_recv+0x5c4/0xeb0 net/dccp/ccids/ccid3.c:767
> ccid_hc_rx_packet_recv net/dccp/ccid.h:185 [inline]
> dccp_deliver_input_to_ccids+0xf0/0x280 net/dccp/input.c:180
> dccp_rcv_established+0x87/0xb0 net/dccp/input.c:378
> dccp_v4_do_rcv+0x153/0x180 net/dccp/ipv4.c:656
> sk_backlog_rcv include/net/sock.h:932 [inline]
> __sk_receive_skb+0x3e0/0xeb0 net/core/sock.c:473
> binder: send failed reply for transaction 41 to 27388:27389
> dccp_v4_rcv+0x10f9/0x1f58 net/dccp/ipv4.c:877
> ip_local_deliver_finish+0x2e9/0xda0 net/ipv4/ip_input.c:215
> NF_HOOK include/linux/netfilter.h:289 [inline]
> ip_local_deliver+0x1e4/0x740 net/ipv4/ip_input.c:256
> dst_input include/net/dst.h:450 [inline]
> ip_rcv_finish+0x1f9/0x300 net/ipv4/ip_input.c:415
> NF_HOOK include/linux/netfilter.h:289 [inline]
> ip_rcv+0xe8/0x600 net/ipv4/ip_input.c:524
> __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4908
> __netif_receive_skb+0x27/0x1e0 net/core/dev.c:5018
> process_backlog+0x24e/0x7a0 net/core/dev.c:5822
> napi_poll net/core/dev.c:6242 [inline]
> net_rx_action+0x7fa/0x19b0 net/core/dev.c:6308
> __do_softirq+0x30d/0xb26 kernel/softirq.c:292
> run_ksoftirqd+0x5e/0x100 kernel/softirq.c:654
> smpboot_thread_fn+0x68b/0xa00 kernel/smpboot.c:164
> kthread+0x35a/0x440 kernel/kthread.c:246
> ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
> dccp_close: ABORT with 52224 bytes unread
> binder: send failed reply for transaction 43 to 27399:27404
> dccp_close: ABORT with 3584 bytes unread
> binder: send failed reply for transaction 45 to 27417:27418
> binder: send failed reply for transaction 47 to 27424:27425
> dccp_close: ABORT with 105984 bytes unread
> dccp_close: ABORT with 105984 bytes unread
> dccp_close: ABORT with 105984 bytes unread
> nf_conntrack: default automatic helper assignment has been turned off for
> security reasons and CT-based firewall rule not found. Use the iptables CT
> target to attach helpers instead.
> Dead loop on virtual device ip6_vti0, fix it urgently!
> Dead loop on virtual device ip6_vti0, fix it urgently!
> Dead loop on virtual device ip6_vti0, fix it urgently!
> Dead loop on virtual device ip6_vti0, fix it urgently!
> Dead loop on virtual device ip6_vti0, fix it urgently!
> Dead loop on virtual device ip6_vti0, fix it urgently!
> IPVS: sync thread started: state = BACKUP, mcast_ifn = team_slave_0, syncid
> = 0, id = 0
> Dead loop on virtual device ip6_vti0, fix it urgently!
> IPVS: sync thread started: state = BACKUP, mcast_ifn = team_slave_0, syncid
> = 0, id = 0
> IPVS: ftp: loaded support on port[0] = 21
> : renamed from bpq0
> IPVS: ftp: loaded support on port[0] = 21
>
>
> ---
> This bug is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups•com.
>
> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
> syzbot.
>
#syz dup: BUG: please report to dccp@vger•kernel.org => prev = 0, last = 0 at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx_hist_sample_rtt()
Still occurring, see existing thread with reproducer here:
https://groups.google.com/d/msg/syzkaller-bugs/u5nq3PdPkIc/M7tbibYVCQAJ
- Eric
prev parent reply other threads:[~2019-02-27 0:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-12 7:58 BUG: please report to dccp@vger•kernel.org => prev = 5, last = 5 at net/dccp/ccids/lib/packet_history.c:LINE/tfrc_rx_his syzbot
2019-02-27 0:44 ` Eric Biggers [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190227004409.GI218103@gmail.com \
--to=ebiggers@kernel$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=dccp@vger$(echo .)kernel.org \
--cc=garsilva@embeddedor$(echo .)com \
--cc=gerrit@erg$(echo .)abdn.ac.uk \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=syzbot+e326127852f785c44347@syzkaller$(echo .)appspotmail.com \
--cc=syzkaller-bugs@googlegroups$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox