From owner-freebsd-transport@freebsd.org Thu May 20 21:41:19 2021 Return-Path: Delivered-To: freebsd-transport@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E0A8A64983A for ; Thu, 20 May 2021 21:41:19 +0000 (UTC) (envelope-from tuexen@freebsd.org) Received: from drew.franken.de (mail-n.franken.de [193.175.24.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Sectigo RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FmNTq3TnDz4dPb; Thu, 20 May 2021 21:41:19 +0000 (UTC) (envelope-from tuexen@freebsd.org) Received: from smtpclient.apple (ip4d15f626.dynamic.kabel-deutschland.de [77.21.246.38]) (Authenticated sender: macmic) by mail-n.franken.de (Postfix) with ESMTPSA id 14252722C9DA8; Thu, 20 May 2021 23:41:07 +0200 (CEST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\)) Subject: Re: integer divide fault in tcp_mss() From: Michael Tuexen In-Reply-To: Date: Thu, 20 May 2021 23:41:06 +0200 Cc: freebsd-transport@freebsd.org, rscheff@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <7A5903CA-2FD2-4ABD-9FF6-3D75BB18B500@freebsd.org> References: <88EFAFD0-7743-413A-8F3B-61835CF97721@freebsd.org> To: Mark Johnston X-Mailer: Apple Mail (2.3654.80.0.2.43) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Rspamd-Queue-Id: 4FmNTq3TnDz4dPb X-Spamd-Bar: / Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [0.00 / 15.00]; ASN(0.00)[asn:680, ipnet:193.174.0.0/15, country:DE]; local_wl_from(0.00)[freebsd.org] X-BeenThere: freebsd-transport@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Discussions of transport level network protocols in FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 May 2021 21:41:20 -0000 On 20. May 2021, at 23:04, Mark Johnston wrote: >=20 > On Thu, May 20, 2021 at 10:58:01PM +0200, Michael Tuexen wrote: >>> On 20. May 2021, at 22:31, Mark Johnston wrote: >>>=20 >>> Hi, >>>=20 >>> My syzkaller instance managed to trigger an integer divide fault in >>> tcp_mss(). I attached a reproducer with debugging info. >>>=20 >>> I'm not sure if it's a recent regression or not. Interestingly, = syzbot >>> doesn't appear to have discovered this one. >>>=20 >>> #14 =20 >>> #15 0xffffffff80dee710 in tcp_mss (tp=3Dtp@entry=3D0xfffffe00cb99e428,= offer=3Doffer@entry=3D-1) at = /usr/home/markj/src/freebsd/sys/netinet/tcp_input.c:3903 >>> #16 0xffffffff80e0cc70 in tcp_usr_send (so=3D, = flags=3D, m=3D0x0, nam=3D0xfffff800038c9dc0, = control=3D,=20 >>> td=3D0xfffffe00cb995740) at = /usr/home/markj/src/freebsd/sys/netinet/tcp_usrreq.c:1144 >>> #17 0xffffffff80cbe3f7 in sosend_generic (so=3D0xfffff8006806db10, = addr=3D0xfffff800038c9dc0, uio=3D, = top=3D0xfffff80004a18900,=20 >>> control=3D, flags=3D128, td=3D0xfffffe00cb995740) = at /usr/home/markj/src/freebsd/sys/kern/uipc_socket.c:1759 >>> #18 0xffffffff80cbe706 in sosend (so=3D0x0, = so@entry=3D0xfffff8006806db10, addr=3D0x10000, uio=3D0x0, = uio@entry=3D0xfffffe0084f248a8, top=3D0xffff, top@entry=3D0x0,=20 >>> control=3Dcontrol@entry=3D0x0, flags=3D16, flags@entry=3D128, = td=3D0xfffffe00cb995740) at = /usr/home/markj/src/freebsd/sys/kern/uipc_socket.c:1809 >>> #19 0xffffffff80cc54ec in kern_sendit (td=3D, = td@entry=3D0xfffffe00cb995740, s=3D3, mp=3D, = mp@entry=3D0xfffffe0084f24980, flags=3D128,=20 >>> control=3D0x0, segflg=3Dsegflg@entry=3DUIO_USERSPACE) at = /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:798 >>> #20 0xffffffff80cc588b in sendit (td=3D0xfffffe00cb995740, s=3D65536, = mp=3Dmp@entry=3D0xfffffe0084f24980, flags=3D65535) >>> at /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:723 >>> #21 0xffffffff80cc569d in sys_sendto (td=3D0x0, uap=3D) at /usr/home/markj/src/freebsd/sys/kern/uipc_syscalls.c:841 >>> #22 0xffffffff810cf77e in syscallenter (td=3D) at = /usr/home/markj/src/freebsd/sys/amd64/amd64/../../kern/subr_syscall.c:189 >>> #23 amd64_syscall (td=3D0xfffffe00cb995740, traced=3D0) at = /usr/home/markj/src/freebsd/sys/amd64/amd64/trap.c:1156 >>> >> Does the reproducer work for you?=20 >=20 > Hrm, I reproduced the crash in a test VM but now I can't get it to > happen anymore using a stock GENERIC kernel. This is probably from a > local change that I was testing then. Sorry for the noise. I executed the syzkaller reproducer about 1000000 times and it did not = trigger anything. So chances are high that this problem might actually be related to some = local changes. Thanks for notifying and retesting. Best regards Michael=