[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Mar 2017 10:37:36 -0800
From: Eric Dumazet <edumazet@...gle.com>
To: Dmitry Vyukov <dvyukov@...gle.com>
Cc: David Miller <davem@...emloft.net>,
Alexey Kuznetsov <kuznet@....inr.ac.ru>,
James Morris <jmorris@...ei.org>,
Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
Patrick McHardy <kaber@...sh.net>,
netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
Cong Wang <xiyou.wangcong@...il.com>,
syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/ipv4: division by 0 in tcp_select_window
On Fri, Mar 3, 2017 at 10:24 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> On Fri, Mar 3, 2017 at 7:10 PM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
>> Hello,
>>
> Wonder if this has been causing other crashes like this one?
>
> ------------[ cut here ]------------
> kernel BUG at net/ipv4/tcp_output.c:2748!
> Call Trace:
> <IRQ>
> tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2822
> tcp_retransmit_timer+0x104c/0x2d50 net/ipv4/tcp_timer.c:491
> tcp_write_timer_handler+0x334/0x9d0 net/ipv4/tcp_timer.c:574
> tcp_write_timer+0x164/0x180 net/ipv4/tcp_timer.c:592
> call_timer_fn+0x241/0x820 kernel/time/timer.c:1266
> expire_timers kernel/time/timer.c:1305 [inline]
> __run_timers+0x960/0xcf0 kernel/time/timer.c:1599
> run_timer_softirq+0x21/0x80 kernel/time/timer.c:1612
> __do_softirq+0x31f/0xbe7 kernel/softirq.c:284
> invoke_softirq kernel/softirq.c:364 [inline]
> irq_exit+0x1cc/0x200 kernel/softirq.c:405
> exiting_irq arch/x86/include/asm/apic.h:658 [inline]
> smp_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:962
> apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:487
>
> if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) {
> if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))
> BUG();
This path uses a socket lock. Probably different problem.
Powered by blists - more mailing lists