linux-kernel - Re: [syzbot] [net?] divide error in __tcp_select

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5336d822-a26f-495c-9f35-1c1aa140a715@kernel.org>
Date: Wed, 26 Nov 2025 13:22:36 +0100
From: Matthieu Baerts <matttbe@...nel.org>
To: syzbot <syzbot+3a92d359bc2ec6255a33@...kaller.appspotmail.com>,
 linux-kernel@...r.kernel.org, pabeni@...hat.com,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [net?] divide error in __tcp_select_window (4)

Hello,

On 26/11/2025 13:20, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> divide error in __tcp_select_window
> 
> RSP: 002b:00007f86321dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> RAX: ffffffffffffffda RBX: 00007f86315e5fa0 RCX: 00007f863138f749
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
> RBP: 00007f86321dd090 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
> R13: 00007f86315e6038 R14: 00007f86315e5fa0 R15: 00007ffd93c62a18
>  </TASK>
> Oops: divide error: 0000 [#1] SMP KASAN PTI
> CPU: 1 UID: 0 PID: 6439 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336
> Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 da 10 01 f8 e9 9c 00 00 00 e8 d0 10 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00
> RSP: 0018:ffffc900030a7640 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880258abc80
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc900030a7730 R08: ffff8880310e8dc3 R09: 1ffff1100621d1b8
> R10: dffffc0000000000 R11: ffffed100621d1b9 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS:  00007f86321dd6c0(0000) GS:ffff888126235000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000000180 CR3: 000000007e366000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  tcp_select_window net/ipv4/tcp_output.c:281 [inline]
>  __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568
>  tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]
>  tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836
>  mptcp_do_fastclose+0x286/0x390 net/mptcp/protocol.c:2896
>  mptcp_disconnect+0x238/0x730 net/mptcp/protocol.c:3380
>  mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1801

Indeed, my bad, I missed this: it is a different issue involving TFO
(too many 'fast' :) ). A different fix than the one from Paolo -- like
the one sent by Kuniyuki -- is still needed.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.