general protection fault in tcp_push

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: b355d4f7 Merge 4.4.171 into android-4.4
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=127e617f400000
kernel config: https://syzkaller.appspot.com/x/.config?x=e76b3f849c857277
dashboard link: https://syzkaller.appspot.com/bug?extid=d3eb5019ee32c8400c24
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+d3eb50...@syzkaller.appspotmail.com

audit: type=1400 audit(1547812667.718:1639): avc: denied { write } for
pid=6832 comm="syz-executor2"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral
protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 6814 Comm: syz-executor4 Not tainted 4.4.171+ #9
task: ffff8801be3a4740 task.stack: ffff88009ff20000
RIP: 0010:[<ffffffff823ec989>] [<ffffffff823ec989>] tcp_mark_push
net/ipv4/tcp.c:607 [inline]
RIP: 0010:[<ffffffff823ec989>] [<ffffffff823ec989>] tcp_push+0xe9/0x5d0
net/ipv4/tcp.c:671
RSP: 0018:ffff88009ff279a0 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90002f54000
RDX: 0000000000000006 RSI: ffffffff823ec970 RDI: 0000000000000034
RBP: ffff88009ff279f0 R08: ffff880098914640 R09: ffff8801be3a5028
R10: 0000000000000000 R11: 0000000000000000 R12: ffff880098913d80
R13: 0000000000000000 R14: 0000000000000000 R15: ffff880098914638
FS: 00007f079feff700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30522000 CR3: 00000001d2e9a000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffffffff81ae9255 ffff880098914640 0000fd589ff27d50 ffff880098913f70
0000021800000000 00000000000100a8 ffff880098913d80 00000000fffffe00
ffff8800b930f900 dffffc0000000000 ffff88009ff27b78 ffffffff823fb919
Call Trace:
[<ffffffff823fb919>] tcp_sendmsg+0x16f9/0x2ab0 net/ipv4/tcp.c:1293
[<ffffffff824a8262>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
[<ffffffff821d729e>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff821d729e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
[<ffffffff821d7525>] sock_write_iter+0x235/0x3d0 net/socket.c:847
[<ffffffff81496498>] new_sync_write fs/read_write.c:478 [inline]
[<ffffffff81496498>] __vfs_write+0x2e8/0x3d0 fs/read_write.c:491
[<ffffffff81497fc2>] vfs_write+0x182/0x4e0 fs/read_write.c:538
[<ffffffff8149a5fc>] SYSC_write fs/read_write.c:585 [inline]
[<ffffffff8149a5fc>] SyS_write+0xdc/0x1c0 fs/read_write.c:577
[<ffffffff82717721>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 00 4d 8d 84 24 c0 08 00 00 4c 89 45 b8 e8 70 ca f1 fe 48 8d 7b 34 4c
8b 45 b8 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02
48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 e2 03 00
RIP [<ffffffff823ec989>] tcp_mark_push net/ipv4/tcp.c:607 [inline]
RIP [<ffffffff823ec989>] tcp_push+0xe9/0x5d0 net/ipv4/tcp.c:671
RSP <ffff88009ff279a0>
audit: type=1400 audit(1547812668.188:1640): avc: denied { read } for
pid=6832 comm="syz-executor2"
scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tclass=netlink_generic_socket permissive=1
---[ end trace 229f0582c9c5c7a2 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 8fe42840 Merge 4.9.141 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=169125d7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=22a5ba9f73b6da1d
dashboard link: https://syzkaller.appspot.com/bug?extid=3d3180698414f1b47e8a
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+3d3180...@syzkaller.appspotmail.com

kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:

CPU: 0 PID: 24279 Comm: syz-executor5 Not tainted 4.9.141+ #23
task: ffff8801d6c9df00 task.stack: ffff8801976b0000
RIP: 0010:[<ffffffff824d44e3>] [<ffffffff824d44e3>] tcp_mark_push
net/ipv4/tcp.c:603 [inline]
RIP: 0010:[<ffffffff824d44e3>] [<ffffffff824d44e3>] tcp_push+0x443/0x5e0
net/ipv4/tcp.c:667
RSP: 0018:ffff8801976b7888 EFLAGS: 00010207
RAX: ffff880168d0720c RBX: ffff880168d06900 RCX: 0000000000000006
RDX: dffffc0000000000 RSI: ffffffff824d44c9 RDI: 0000000000000034
RBP: ffff8801976b78d8 R08: 000000000000fd58 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff880168d07204 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8801db600000(0063) knlGS:00000000f574ab40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007ffe74b86e90 CR3: 000000016efad000 CR4: 00000000001606b0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:

ffff8801976b7be0 ffff880168d0720c 0000fd584240a2a0 ffff880168d06af0
0000021800000000 ffff880168d06af0 ffff880168d06af0 dffffc0000000000
ffff880168d06900 ffff880168d06900 ffff8801976b7b00 ffffffff824e359b
Call Trace:
[<ffffffff824e359b>] tcp_sendmsg+0x112b/0x2fd0 net/ipv4/tcp.c:1348
[<ffffffff825952f3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
[<ffffffff822a063b>] sock_sendmsg_nosec net/socket.c:648 [inline]
[<ffffffff822a063b>] sock_sendmsg+0xbb/0x110 net/socket.c:658
[<ffffffff822a08b3>] sock_write_iter+0x223/0x3b0 net/socket.c:856
[<ffffffff81508347>] new_sync_write fs/read_write.c:496 [inline]
[<ffffffff81508347>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
[<ffffffff8150ab97>] vfs_write+0x187/0x520 fs/read_write.c:557
[<ffffffff8150e9c9>] SYSC_write fs/read_write.c:604 [inline]
[<ffffffff8150e9c9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
[<ffffffff81006311>] do_syscall_32_irqs_on arch/x86/entry/common.c:328
[inline]
[<ffffffff81006311>] do_fast_syscall_32+0x2f1/0xa10
arch/x86/entry/common.c:390
[<ffffffff82818de0>] entry_SYSENTER_compat+0x90/0xa2
arch/x86/entry/entry_64_compat.S:137
Code: 00 48 8d 83 0c 09 00 00 48 89 45 b8 e8 97 75 e4 fe 49 8d 7c 24 34 48
8b 45 b8 48 ba 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <0f> b6 14 11
48 89 f9 83 e1 07 38 ca 7f 08 84 d2 0f 85 81 00 00
RIP [<ffffffff824d44e3>] tcp_mark_push net/ipv4/tcp.c:603 [inline]
RIP [<ffffffff824d44e3>] tcp_push+0x443/0x5e0 net/ipv4/tcp.c:667
RSP <ffff8801976b7888>
---[ end trace 2702937cf2387ee9 ]---

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]