WARNING in __mptcp_move_skbs_from_subflow

Status: auto-obsoleted due to no activity on 2024/04/28 15:28
Reported-by: syzbot+51607525eb758b5715e5@syzkaller.appspotmail.com
First crash: 916d, last: 916d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING in __mptcp_move_skbs_from_subflow -1 1 926d 926d 0/3 auto-obsoleted due to no activity on 2024/04/18 16:30
linux-5.15 WARNING in __mptcp_move_skbs_from_subflow (2) origin:lts-only -1 C error 8 641d 724d 0/3 auto-obsoleted due to no activity on 2025/01/28 21:52
linux-6.1 WARNING in __mptcp_move_skbs_from_subflow (2) -1 14 640d 710d 0/3 auto-obsoleted due to no activity on 2025/01/04 07:58
upstream WARNING in __mptcp_move_skbs_from_subflow (2) mptcp -1 2 234d 245d 0/29 closed as invalid on 2026/02/13 11:01
upstream WARNING in __mptcp_move_skbs_from_subflow mptcp -1 C error 90 651d 738d 28/29 fixed on 2024/11/12 23:31

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17559 at net/mptcp/protocol.c:627 __mptcp_move_skbs_from_subflow+0x2b88/0x2c78 net/mptcp/protocol.c:627
Modules linked in:
CPU: 1 PID: 17559 Comm: syz-executor.2 Not tainted 5.15.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mptcp_move_skbs_from_subflow+0x2b88/0x2c78 net/mptcp/protocol.c:627
lr : __mptcp_move_skbs_from_subflow+0x2b88/0x2c78 net/mptcp/protocol.c:627
sp : ffff80001eb956c0
x29: ffff80001eb95840 x28: 0000000000020000 x27: ffff0000fe1493d0
x26: 00000000000004d4 x25: dfff800000000000 x24: 0000000000000000
x23: 0000000000000000 x22: ffff0000fe148d88 x21: ffff0000ff91744c
x20: ffff0001034e9780 x19: 00000000000000b8 x18: 0000000000000102
x17: 0000000000000000 x16: ffff8000084c18ac x15: 0000000000000004
x14: 1ffff0000292406a x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000000303 x10: 0000000000000000 x9 : ffff0000c65cb680
x8 : ffff800011929864 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800011927bd0
x2 : 0000000000000001 x1 : 00000000000004d4 x0 : 00000000000000b8
Call trace:
 __mptcp_move_skbs_from_subflow+0x2b88/0x2c78 net/mptcp/protocol.c:627
 move_skbs_to_msk net/mptcp/protocol.c:699 [inline]
 mptcp_data_ready+0x274/0x5f8 net/mptcp/protocol.c:744
 subflow_data_ready+0x198/0x280 net/mptcp/subflow.c:1351
 tcp_data_ready+0x22c/0x454 net/ipv4/tcp_input.c:5018
 tcp_data_queue+0x1c14/0x5288 net/ipv4/tcp_input.c:5088
 tcp_rcv_established+0xa58/0x1f40 net/ipv4/tcp_input.c:5987
 tcp_v4_do_rcv+0x340/0xc70 net/ipv4/tcp_ipv4.c:1727
 tcp_v4_rcv+0x1fd8/0x2770 net/ipv4/tcp_ipv4.c:2130
 ip_protocol_deliver_rcu+0x36c/0x770 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x11c/0x190 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:453 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x78/0x98 net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5485 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5599
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6476
 __napi_poll+0xb4/0x624 net/core/dev.c:7035
 napi_poll net/core/dev.c:7102 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7189
 __do_softirq+0x344/0xdb0 kernel/softirq.c:558
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xf8/0x1ac kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:766 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xe70/0x1930 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1944/0x31e8 net/ipv4/tcp_output.c:1402
 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
 tcp_mtu_probe net/ipv4/tcp_output.c:2454 [inline]
 tcp_write_xmit+0x46f8/0x4dc0 net/ipv4/tcp_output.c:2630
 __tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2890
 tcp_push_pending_frames include/net/tcp.h:1915 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5493 [inline]
 tcp_rcv_established+0xab4/0x1f40 net/ipv4/tcp_input.c:5989
 tcp_v4_do_rcv+0x340/0xc70 net/ipv4/tcp_ipv4.c:1727
 sk_backlog_rcv include/net/sock.h:1059 [inline]
 __release_sock+0x1a8/0x408 net/core/sock.c:2713
 release_sock+0x68/0x270 net/core/sock.c:3254
 __mptcp_push_pending+0x5f4/0x85c
 mptcp_sendmsg+0xc74/0x1a1c net/mptcp/protocol.c:1780
 inet6_sendmsg+0xb4/0xd8 net/ipv6/af_inet6.c:657
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2431
 ___sys_sendmsg+0x214/0x294 net/socket.c:2485
 __sys_sendmmsg+0x23c/0x648 net/socket.c:2571
 __do_sys_sendmmsg net/socket.c:2600 [inline]
 __se_sys_sendmmsg net/socket.c:2597 [inline]
 __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2597
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 5741
hardirqs last  enabled at (5740): [<ffff8000088cb550>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (5741): [<ffff80001197e028>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last  enabled at (5716): [<ffff8000105430d4>] local_bh_enable+0x10/0x1d0 include/linux/bottom_half.h:31
softirqs last disabled at (5717): [<ffff8000081b5054>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (5717): [<ffff8000081b5054>] do_softirq+0xf8/0x1ac kernel/softirq.c:459
---[ end trace 49ba9982022219fe ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17559 at net/mptcp/protocol.c:630 __mptcp_move_skbs_from_subflow+0x1ea0/0x2c78 net/mptcp/protocol.c:630
Modules linked in:
CPU: 1 PID: 17559 Comm: syz-executor.2 Tainted: G        W         5.15.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mptcp_move_skbs_from_subflow+0x1ea0/0x2c78 net/mptcp/protocol.c:630
lr : __mptcp_move_skbs_from_subflow+0x1ea0/0x2c78 net/mptcp/protocol.c:630
sp : ffff80001eb956c0
x29: ffff80001eb95840 x28: 1fffe000191b202d x27: 00000000fffffb2c
x26: 0000000000000fec x25: dfff800000000000 x24: 0000000000000000
x23: 0000000000000000 x22: 00000000000000b8 x21: 000000006fad935c
x20: ffff0000c8d90140 x19: ffff0000ff916dc0 x18: 0000000000000102
x17: 0000000000000000 x16: ffff8000084c18ac x15: 0000000000000001
x14: 1ffff0000292406a x13: dfff800000000000 x12: ffff700003d72af8
x11: 0000000000000303 x10: 0000000000000000 x9 : ffff0000c65cb680
x8 : ffff800011928b7c x7 : ffff80001191c688 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000083025dc
x2 : ffff80001eb958c0 x1 : 00000000fffffb2c x0 : 0000000000000b18
Call trace:
 __mptcp_move_skbs_from_subflow+0x1ea0/0x2c78 net/mptcp/protocol.c:630
 move_skbs_to_msk net/mptcp/protocol.c:699 [inline]
 mptcp_data_ready+0x274/0x5f8 net/mptcp/protocol.c:744
 subflow_data_ready+0x198/0x280 net/mptcp/subflow.c:1351
 tcp_data_ready+0x22c/0x454 net/ipv4/tcp_input.c:5018
 tcp_data_queue+0x1c14/0x5288 net/ipv4/tcp_input.c:5088
 tcp_rcv_established+0xa58/0x1f40 net/ipv4/tcp_input.c:5987
 tcp_v4_do_rcv+0x340/0xc70 net/ipv4/tcp_ipv4.c:1727
 tcp_v4_rcv+0x1fd8/0x2770 net/ipv4/tcp_ipv4.c:2130
 ip_protocol_deliver_rcu+0x36c/0x770 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1b8/0x30c net/ipv4/ip_input.c:231
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_local_deliver+0x11c/0x190 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:453 [inline]
 ip_rcv_finish+0x22c/0x264 net/ipv4/ip_input.c:447
 NF_HOOK+0x324/0x3d0 include/linux/netfilter.h:302
 ip_rcv+0x78/0x98 net/ipv4/ip_input.c:566
 __netif_receive_skb_one_core net/core/dev.c:5485 [inline]
 __netif_receive_skb+0x18c/0x400 net/core/dev.c:5599
 process_backlog+0x3ec/0x7e0 net/core/dev.c:6476
 __napi_poll+0xb4/0x624 net/core/dev.c:7035
 napi_poll net/core/dev.c:7102 [inline]
 net_rx_action+0x500/0xc10 net/core/dev.c:7189
 __do_softirq+0x344/0xdb0 kernel/softirq.c:558
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 do_softirq+0xf8/0x1ac kernel/softirq.c:459
 __local_bh_enable_ip+0x298/0x470 kernel/softirq.c:383
 local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:766 [inline]
 ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
 __ip_finish_output+0x1b0/0x458
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xe70/0x1930 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1944/0x31e8 net/ipv4/tcp_output.c:1402
 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
 tcp_write_xmit+0x12bc/0x4dc0 net/ipv4/tcp_output.c:2705
 __tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2890
 tcp_push_pending_frames include/net/tcp.h:1915 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5493 [inline]
 tcp_rcv_established+0xab4/0x1f40 net/ipv4/tcp_input.c:5989
 tcp_v4_do_rcv+0x340/0xc70 net/ipv4/tcp_ipv4.c:1727
 sk_backlog_rcv include/net/sock.h:1059 [inline]
 __release_sock+0x1a8/0x408 net/core/sock.c:2713
 release_sock+0x68/0x270 net/core/sock.c:3254
 __mptcp_push_pending+0x5f4/0x85c
 mptcp_sendmsg+0xc74/0x1a1c net/mptcp/protocol.c:1780
 inet6_sendmsg+0xb4/0xd8 net/ipv6/af_inet6.c:657
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x584/0x870 net/socket.c:2431
 ___sys_sendmsg+0x214/0x294 net/socket.c:2485
 __sys_sendmmsg+0x23c/0x648 net/socket.c:2571
 __do_sys_sendmmsg net/socket.c:2600 [inline]
 __se_sys_sendmmsg net/socket.c:2597 [inline]
 __arm64_sys_sendmmsg+0xa0/0xbc net/socket.c:2597
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 5981
hardirqs last  enabled at (5980): [<ffff8000081b4d1c>] __local_bh_enable_ip+0x230/0x470 kernel/softirq.c:388
hardirqs last disabled at (5981): [<ffff80001197e028>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:396
softirqs last  enabled at (5958): [<ffff8000105430d4>] local_bh_enable+0x10/0x1d0 include/linux/bottom_half.h:31
softirqs last disabled at (5959): [<ffff8000081b5054>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (5959): [<ffff8000081b5054>] do_softirq+0xf8/0x1ac kernel/softirq.c:459
---[ end trace 49ba9982022219ff ]---
TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
TCP: request_sock_subflow_v4: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/19 15:27 linux-5.15.y ddcaf4999061 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 WARNING in __mptcp_move_skbs_from_subflow
* Struck through repros no longer work on HEAD.