panic: rcv_start < rcv_end

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: bb0c9847 vm_object_coalesce(): avoid extending any nosplit..
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=10061571600000
dashboard link: https://syzkaller.appspot.com/bug?extid=4bf3bda3dea6907c816f

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4bf3bd...@syzkaller.appspotmail.com

panic: rcv_start < rcv_end
cpuid = 0
time = 1567903232
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
0xfffffe0019f6c250
vpanic() at vpanic+0x1e0/frame 0xfffffe0019f6c2b0
panic() at panic+0x43/frame 0xfffffe0019f6c310
tcp_update_dsack_list() at tcp_update_dsack_list+0x962/frame
0xfffffe0019f6c3c0
tcp_do_segment() at tcp_do_segment+0x4252/frame 0xfffffe0019f6c4d0
tcp_input() at tcp_input+0x1583/frame 0xfffffe0019f6c640
ip_input() at ip_input+0x2c4/frame 0xfffffe0019f6c700
netisr_dispatch_src() at netisr_dispatch_src+0xe9/frame 0xfffffe0019f6c770
ether_demux() at ether_demux+0x24a/frame 0xfffffe0019f6c7c0
ether_nh_input() at ether_nh_input+0x7c6/frame 0xfffffe0019f6c840
netisr_dispatch_src() at netisr_dispatch_src+0xe9/frame 0xfffffe0019f6c8b0
ether_input() at ether_input+0xbf/frame 0xfffffe0019f6c900
vtnet_rxq_eof() at vtnet_rxq_eof+0xb22/frame 0xfffffe0019f6c9b0
vtnet_rx_vq_intr() at vtnet_rx_vq_intr+0xa5/frame 0xfffffe0019f6c9f0
ithread_loop() at ithread_loop+0x2f2/frame 0xfffffe0019f6ca60
fork_exit() at fork_exit+0xb0/frame 0xfffffe0019f6cab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0019f6cab0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100039 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
db>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Mark Johnston]

#syz fix: Only update SACK/DSACK lists when a non-empty segment was received.

[Mark Johnston]

On Sat, Sep 07, 2019 at 05:41:07PM -0700, syzbot wrote:

#syz fix: Only update SACK/DSACK lists when a non-empty segment was received. This fixes hitting a KASSERT with a valid packet exchange.