[syzkaller] WARNING in __mptcp_move_skbs_from_subflow

[cpaasch]

Head is netnext (d8e79f1dbcee ("nexthop: Fix type of event_type in call_nexthop_notifiers")).

------------[ cut here ]------------
WARNING: CPU: 1 PID: 16 at net/mptcp/protocol.c:249 __mptcp_move_skbs_from_subflow+0x7cb/0xa50 net/mptcp/protocol.c:249
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.7.0-rc6 #83
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xb7/0xfe lib/dump_stack.c:118
 panic+0x22d/0x5b2 kernel/panic.c:221
 __warn.cold+0x2f/0x3b kernel/panic.c:582
 report_bug+0x1d1/0x200 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:175 [inline]
 fixup_bug arch/x86/kernel/traps.c:170 [inline]
 do_error_trap+0xcf/0x100 arch/x86/kernel/traps.c:267
 do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:286
 invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:__mptcp_move_skbs_from_subflow+0x7cb/0xa50 net/mptcp/protocol.c:249
Code: 03 5c 24 64 2b 5c 24 5c 44 89 ff 44 01 7c 24 10 89 de 44 01 7c 24 34 e8 73 b2 b0 fe 41 39 df 0f 86 31 fb ff ff e8 75 b1 b0 fe <0f> 0b e9 a4 fb ff ff e8 69 b1 b0 fe 49 8d be c8 00 00 00 e8 fd 7d
RSP: 0018:ffff88811a9cf3a0 EFLAGS: 00010206
RAX: ffff88811a976200 RBX: 0000000000007f70 RCX: ffffffff8273c15d
RDX: 0000000000000100 RSI: ffffffff8273c16b RDI: 0000000000000004
RBP: ffff88806f4c20d8 R08: ffff88811a976200 R09: ffffed10233fdb7e
R10: ffff888119fedbeb R11: ffffed10233fdb7d R12: ffff888119fedb00
R13: ffff888119fedbe8 R14: ffff8880672f5c80 R15: 0000000000007fe4
 move_skbs_to_msk+0x153/0x160 net/mptcp/protocol.c:287
 mptcp_data_ready+0x85/0x1d0 net/mptcp/protocol.c:301
 subflow_data_ready+0xc7/0xe0 net/mptcp/subflow.c:892
 tcp_data_ready+0x72/0x110 net/ipv4/tcp_input.c:4776
 tcp_data_queue+0x9a8/0x2200 net/ipv4/tcp_input.c:4842
 tcp_rcv_established+0x4ab/0xed0 net/ipv4/tcp_input.c:5735
 tcp_v4_do_rcv+0x342/0x480 net/ipv4/tcp_ipv4.c:1623
 tcp_v4_rcv+0x1a9a/0x1c00 net/ipv4/tcp_ipv4.c:2005
 ip_protocol_deliver_rcu+0x42/0x380 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0xc3/0xe0 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x162/0x220 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:441 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
 ip_rcv_finish+0x79/0x90 net/ipv4/ip_input.c:414
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_rcv+0x19d/0x1b0 net/ipv4/ip_input.c:539
 __netif_receive_skb_one_core+0x156/0x180 net/core/dev.c:5268
 __netif_receive_skb+0x29/0xd0 net/core/dev.c:5382
 process_backlog+0x133/0x2d0 net/core/dev.c:6214
 napi_poll net/core/dev.c:6659 [inline]
 net_rx_action+0x2c0/0x7b0 net/core/dev.c:6727
 __do_softirq+0x10d/0x3be kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:604 [inline]
 run_ksoftirqd+0x15/0x20 kernel/softirq.c:596
 smpboot_thread_fn+0x24d/0x3c0 kernel/smpboot.c:165
 kthread+0x1ba/0x210 kernel/kthread.c:268
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:351
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 1 seconds..

Syzkaller reproducer:

# {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:1 Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r1, &(0x7f00000013c0)={0x2, 0x4e20, @multicast2}, 0x10)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10)
listen(r1, 0x3)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x4d)
sendmsg$inet(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="ff", 0xff3e}], 0x1}, 0x0)

C repro attached.

[cpaasch]

Attached c-repro disguised as .txt ... 🤦‍♂️

repro.txt

[cpaasch]

Most recent repro on top of:

61820897eea1 ("add mptcp_token_destroy") (HEAD) (5 minutes ago) b0d0a0e4a622 ("Squash-to: "mptcp: refactor token container."") (5 minutes ago) f20592a47bdd ("Cleanup") (5 minutes ago) 5d3e110f5b3f ("Paolos pastebin") (5 minutes ago) 39e00acbdf14 ("FIX inet_csk_prepare_for_destroy_sock") (5 minutes ago) 5c71d0591dde ("net: mptcp: improve fallback to TCP") (5 minutes ago) f2ddcb183129 ("mptcp: add receive buffer auto-tuning") (5 minutes ago) 425515bac500 ("[DO-NOT-MERGE] mptcp: enabled by default") (tag: export/20200604T011812, mptcp_net-next/export) (16 hours ago) a6e5b8cb5b3d ("mptcp: introduce token KUNIT self-tests") (16 hours ago) c8d7079853ff ("mptcp: move crypto test to KUNIT") (16 hours ago) 177c4645e9e4 ("mptcp: refactor token container.") (16 hours ago) c28bd2bcde26 ("mptcp: add __init annotation on setup functions") (16 hours ago) 2ef1779dfe17 ("bpf: fix unused-var without NETDEVICES") (16 hours ago) cb8e59cc8720 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") (netnext/master, mptcp_net-next/net-next) (18 hours ago)

No syzkaller-reproducers though.

[cpaasch]

No more reproducing on top of:

4fb948e08615 ("Cleanup") (HEAD) (3 minutes ago) 55a9c834a69e ("net: mptcp: improve fallback to TCP") (3 minutes ago) 431bc5f80631 ("mptcp: add receive buffer auto-tuning") (3 minutes ago) e15b65dd24f2 ("bpf: fix unused-var without NETDEVICES") (3 minutes ago) bc4f11450b97 ("[DO-NOT-MERGE] mptcp: enabled by default") (tag: export/20200605T181020, mptcp_net-next/export) (57 minutes ago) 420e02a447ae ("[DO-NOT-MERGE] mptcp: use kmalloc on kasan build") (57 minutes ago) 36b7954c10e9 ("mptcp: don't leak msk in token container") (57 minutes ago) 3c886ec494bb ("mptcp: introduce token KUNIT self-tests") (58 minutes ago) fa2e5ed0f343 ("mptcp: move crypto test to KUNIT") (58 minutes ago) d830aaf04072 ("mptcp: refactor token container.") (58 minutes ago) 1cbe672caef8 ("mptcp: add __init annotation on setup functions") (58 minutes ago) 213fe1da0f79 ("mptcp: fix races between shutdown and recvmsg") (58 minutes ago) 5b67054b7a7a ("inet_connection_sock: clear inet_num out of destroy helper") (58 minutes ago) 5e296dd01405 ("bpf: fix unused-var without NETDEVICES") (58 minutes ago) cb8e59cc8720 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") (netnext/master, mptcp_net-next/net-next) (2 days ago)