Date: Thu, 20 May 2021 22:58:01 +0200 From: Michael Tuexen <tuexen@freebsd.org> To: Mark Johnston <markj@freebsd.org> Cc: freebsd-transport@freebsd.org, rscheff@freebsd.org Subject: Re: integer divide fault in tcp_mss() Message-ID: <88EFAFD0-7743-413A-8F3B-61835CF97721@freebsd.org> In-Reply-To: <YKbHOnBZEVwcRzYX@nuc> References: <YKbHOnBZEVwcRzYX@nuc>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 20. May 2021, at 22:31, Mark Johnston <markj@freebsd.org> wrote: >=20 > Hi, >=20 > My syzkaller instance managed to trigger an integer divide fault in > tcp_mss(). I attached a reproducer with debugging info. >=20 > I'm not sure if it's a recent regression or not. Interestingly, = syzbot > doesn't appear to have discovered this one. >=20 > #14 <signal handler called>=20 > #15 0xffffffff80dee710 in tcp_mss (tp=3Dtp@entry=3D0xfffffe00cb99e428, = offer=3Doffer@entry=3D-1) at = /usr/home/markj/src/freebsd/sys/netinet/tcp_input.c:3903 > #16 0xffffffff80e0cc70 in tcp_usr_send (so=3D<optimized out>, = flags=3D<optimized out>, m=3D0x0, nam=3D0xfffff800038c9dc0, = control=3D<optimized out>,=20 > td=3D0xfffffe00cb995740) at = /usr/home/markj/src/freebsd/sys/netinet/tcp_usrreq.c:1144 > #17 0xffffffff80cbe3f7 in sosend_generic (so=3D0xfffff8006806db10, = addr=3D0xfffff800038c9dc0, uio=3D<optimized out>, = top=3D0xfffff80004a18900,=20 > control=3D<optimized out>, flags=3D128, td=3D0xfffffe00cb995740) at = /usr/home/markj/src/freebsd/sys/kern/uipc_socket.c:1759 > #18 0xffffffff80cbe706 in sosend (so=3D0x0, = so@entry=3D0xfffff8006806db10, addr=3D0x10000, uio=3D0x0, = uio@entry=3D0xfffffe0084f248a8, top=3D0xffff, top@entry=3D0x0,=20 > control=3Dcontrol@entry=3D0x0, flags=3D16, flags@entry=3D128, = td=3D0xfffffe00cb995740) at = /usr/home/markj/src/freebsd/sys/kern/uipc_socket.c:1809 > #19 0xffffffff80cc54ec in kern_sendit (td=3D<optimized out>, = td@entry=3D0xfffffe00cb995740, s=3D3, mp=3D<optimized out>, = mp@entry=3D0xfffffe0084f24980, flags=3D128,=20 > control=3D0x0, segflg=3Dsegflg@entry=3DUIO_USERSPACE) at = /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:798 > #20 0xffffffff80cc588b in sendit (td=3D0xfffffe00cb995740, s=3D65536, = mp=3Dmp@entry=3D0xfffffe0084f24980, flags=3D65535) > at /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:723 > #21 0xffffffff80cc569d in sys_sendto (td=3D0x0, uap=3D<optimized out>) = at /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:841 > #22 0xffffffff810cf77e in syscallenter (td=3D<optimized out>) at = /usr/home/markj/src/freebsd/sys/amd64/amd64/../../kern/subr_syscall.c:189 > #23 amd64_syscall (td=3D0xfffffe00cb995740, traced=3D0) at = /usr/home/markj/src/freebsd/sys/amd64/amd64/trap.c:1156 > <report.txt> Does the reproducer work for you?=20 Best regards Michael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?88EFAFD0-7743-413A-8F3B-61835CF97721>