kernel BUG at net/ipv4/tcp_output.c:2748!

Hi
   I've got the following error report while fuzzing the kernel with
syzkaller on
linux-4.11.0-rc3.
I provide attachment that contains PoC and PoC source code.
PoC can trigger this bug.
config_4_11_rc3 is config file.
Here is panic log:

------------[ cut here ]------------
kernel BUG at net/ipv4/tcp_output.c:2748!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 15 Comm: ksoftirqd/1 Not tainted 4.11.0-rc3 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
Ubuntu-1.8.2-1ubuntu1 04/01/2014
task: ffff88003e17adc0 task.stack: ffff88003e1a8000
RIP: 0010:__tcp_retransmit_skb+0x1945/0x1d40 net/ipv4/tcp_output.c:2748
RSP: 0018:ffff88003e1af9e8 EFLAGS: 00010206
RAX: ffff88003e17adc0 RBX: ffff88003a321568 RCX: 0000000014eed6cd
RDX: 0000000000000100 RSI: ffff88003a321540 RDI: ffff88003a32156c
RBP: ffff88003e1afa80 R08: 00000000a35ea9d4 R09: 0000000000000000
R10: 0000000000000000 R11: ffff88003e17adc0 R12: ffff88003a3215c6
R13: 0000000014eedffd R14: ffff88003a321540 R15: ffff880039640bc0
FS:  0000000000000000(0000) GS:ffff88003ed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e38a0 CR3: 000000003b7b3000 CR4: 00000000000006e0
Call Trace:
 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2822
 tcp_retransmit_timer+0xc49/0x23b0 net/ipv4/tcp_timer.c:492
 tcp_write_timer_handler+0x203/0x7a0 net/ipv4/tcp_timer.c:576
 tcp_write_timer+0x179/0x190 net/ipv4/tcp_timer.c:594
 call_timer_fn+0x15b/0x5e0 kernel/time/timer.c:1268
 expire_timers kernel/time/timer.c:1307 [inline]
 __run_timers kernel/time/timer.c:1601 [inline]
 run_timer_softirq+0x5c7/0x1140 kernel/time/timer.c:1614
 __do_softirq+0x217/0x8b7 kernel/softirq.c:284
 run_ksoftirqd+0x1a/0x50 kernel/softirq.c:676
 smpboot_thread_fn+0x420/0x880 kernel/smpboot.c:164
 kthread+0x2e2/0x3f0 kernel/kthread.c:229
 ret_from_fork+0x2e/0x40 arch/x86/entry/entry_64.S:430
Code: 42 7f fe be 00 00 10 00 4c 89 ff e8 96 81 dd ff e9 31 fa ff ff
e8 2c 42 7f fe 4d 89 b7 50 09 00 00 e9 e3 f5 ff ff e8 1b 42 7f fe <0f>
0b e8 34 1a 9e fe e9 c5 f5 ff ff e8 fa 19 9e fe 8b 4d c4 e9
RIP: __tcp_retransmit_skb+0x1945/0x1d40 net/ipv4/tcp_output.c:2748
RSP: ffff88003e1af9e8
---[ end trace 3957062d6d66daab ]---
Kernel panic - not syncing: Fatal exception in interrupt
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

On Tue, Jun 13, 2017 at 07:39:00PM +0800, Dison River wrote:

Hi
   I've got the following error report while fuzzing the kernel with
syzkaller on
linux-4.11.0-rc3.

4.11-rc3 is pretty old now, can you try 4.12-rc4 for this?

thanks,

greg k-h

Hi:
I tested the PoC on v3.18 ~ v4.11,all the kenel have crashed.But,The
v4.12-rc4 version is not affected
thanks.

2017-06-13 21:02 GMT+08:00 Greg KH [off-list ref]:

On Tue, Jun 13, 2017 at 07:39:00PM +0800, Dison River wrote:

quoted

Hi
   I've got the following error report while fuzzing the kernel with
syzkaller on
linux-4.11.0-rc3.

4.11-rc3 is pretty old now, can you try 4.12-rc4 for this?

thanks,

greg k-h