kernel BUG at net/rxrpc/conn_client.c:LINE!

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 10d6aa56 Linux 4.14.135
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=117ed062600000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff4089e901d1d013
dashboard link: https://syzkaller.appspot.com/bug?extid=c7a4713d654aa4fc2ec8
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c7a471...@syzkaller.appspotmail.com

rxrpc: Assertion failed - 0(0x0) ==
18446612684779677696(0xffff8880a181e800) is false
------------[ cut here ]------------
kernel BUG at net/rxrpc/conn_client.c:792!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 32438 Comm: syz-executor.5 Not tainted 4.14.135 #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
task: ffff888092d44480 task.stack: ffff888099e90000
RIP: 0010:rxrpc_disconnect_client_call.cold+0x29/0x7a
net/rxrpc/conn_client.c:792
RSP: 0018:ffff888099e976e0 EFLAGS: 00010286
RAX: 0000000000000055 RBX: ffff88807f8bb760 RCX: 0000000000000000
RDX: 000000000001e33f RSI: ffffffff814b1975 RDI: ffffed10133d2ed2
RBP: ffff888099e97728 R08: 0000000000000055 R09: ffff888092d44d48
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a181e800
R13: ffff88807f8bb6c0 R14: 0000000000000000 R15: ffff88807f8bb710
FS: 00007fbe8dcf0700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000004eddb000 CR4: 00000000001426f0
Call Trace:
rxrpc_connect_call+0x2108/0x41a0 net/rxrpc/conn_client.c:701
rxrpc_new_client_call+0x8f7/0x1420 net/rxrpc/call_object.c:276
rxrpc_new_client_call_for_sendmsg net/rxrpc/sendmsg.c:525 [inline]
rxrpc_do_sendmsg+0x91a/0x1103 net/rxrpc/sendmsg.c:577
rxrpc_sendmsg+0x4d1/0x610 net/rxrpc/af_rxrpc.c:543
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x840 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459829
RSP: 002b:00007fbe8dcefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459829
RDX: 0000000000000001 RSI: 0000000020005c00 RDI: 0000000000000003
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbe8dcf06d4
R13: 00000000004c7000 R14: 00000000004dc570 R15: 00000000ffffffff
Code: 0f 0b 48 89 75 d0 e8 a8 49 c8 fb 48 8b 75 d0 4d 89 e1 4d 89 e0 48 c7
c1 60 2d fd 86 48 c7 c7 00 2d fd 86 48 89 f2 e8 cb 8e b6 fb <0f> 0b e8 81
49 c8 fb 48 c7 c7 e0 2e fd 86 e8 b8 8e b6 fb 0f 0b
RIP: rxrpc_disconnect_client_call.cold+0x29/0x7a
net/rxrpc/conn_client.c:792 RSP: ffff888099e976e0
---[ end trace e8d5b14c737a2637 ]---


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 414510bc Linux 4.14.142
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10275c5e600000
kernel config: https://syzkaller.appspot.com/x/.config?x=9aa0b2ccd827f416

dashboard link: https://syzkaller.appspot.com/bug?extid=c7a4713d654aa4fc2ec8
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10dc6999600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c2b571600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+c7a471...@syzkaller.appspotmail.com

rxrpc: Assertion failed - 0(0x0) ==

18446612684577522688(0xffff888095754400) is false

------------[ cut here ]------------
kernel BUG at net/rxrpc/conn_client.c:792!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:

CPU: 1 PID: 7515 Comm: syz-executor957 Not tainted 4.14.142 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

task: ffff88809df0a2c0 task.stack: ffff8880a6978000

RIP: 0010:rxrpc_disconnect_client_call.cold+0x29/0x7a
net/rxrpc/conn_client.c:792

RSP: 0018:ffff8880a697f6e0 EFLAGS: 00010286
RAX: 0000000000000055 RBX: ffff8880852a7be0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff866d10e0 RDI: ffffed1014d2fed2
RBP: ffff8880a697f728 R08: 0000000000000055 R09: ffff88809df0ab88
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888095754400
R13: ffff8880852a7b40 R14: 0000000000000000 R15: ffff8880852a7b90
FS: 00007f0d4f0ad700(0000) GS:ffff8880aef00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f0d4f0acdb8 CR3: 000000008ffac000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:
rxrpc_connect_call+0x2108/0x41a0 net/rxrpc/conn_client.c:701
rxrpc_new_client_call+0x8f7/0x1420 net/rxrpc/call_object.c:276
rxrpc_new_client_call_for_sendmsg net/rxrpc/sendmsg.c:525 [inline]
rxrpc_do_sendmsg+0x91a/0x1103 net/rxrpc/sendmsg.c:577
rxrpc_sendmsg+0x4d1/0x610 net/rxrpc/af_rxrpc.c:543
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x349/0x840 net/socket.c:2062
__sys_sendmmsg+0x152/0x3a0 net/socket.c:2152
SYSC_sendmmsg net/socket.c:2183 [inline]
SyS_sendmmsg+0x35/0x60 net/socket.c:2178
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7

RIP: 0033:0x449ad9
RSP: 002b:00007f0d4f0acce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000006e6a18 RCX: 0000000000449ad9

RDX: 0000000000000001 RSI: 0000000020005c00 RDI: 0000000000000003

RBP: 00000000006e6a10 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006e6a1c
R13: 00007ffddcf6281f R14: 00007f0d4f0ad9c0 R15: 20c49ba5e353f7cf
Code: 0f 0b 48 89 75 d0 e8 b8 1d c8 fb 48 8b 75 d0 4d 89 e1 4d 89 e0 48 c7
c1 60 37 fd 86 48 c7 c7 00 37 fd 86 48 89 f2 e8 9b 59 b6 fb <0f> 0b e8 91
1d c8 fb 48 c7 c7 e0 38 fd 86 e8 88 59 b6 fb 0f 0b
RIP: rxrpc_disconnect_client_call.cold+0x29/0x7a
net/rxrpc/conn_client.c:792 RSP: ffff8880a697f6e0
---[ end trace ca1a957f072d927f ]---