On Sun, Jan 29, 2017 at 03:35:31AM +0300, Alexander Popov wrote: > Hello, > > I'm running the syzkaller fuzzer for v4.10-rc4 (0aa0313f9d576affd7747cc3f179feb097d28990) > and have such a crash in sctp code: > ... > > Unfortunately, I didn't manage to get a C program reproducing the crash (looks like race). > However, I stably hit it on my setup - so I can help fixing the issue. > > The crash happens here: > /* Let another process have a go. Since we are going > * to sleep anyway. > */ > release_sock(sk); > current_timeo = schedule_timeout(current_timeo); > > BUG_ON(sk != asoc->base.sk); > lock_sock(sk); > > I've added some debugging output and see, that the original value of asoc->base.sk is > changed to the address of another struct sock, which appeared in sctp_endpoint_init() > shortly before the crash. You need some threading for this to happen. asoc->base.sk will change if you peeloff the association. It seems you had one thread waiting for some sndbuf to be available on a sendmsg() call and another thread did a peeloff on the association that the first thread was using. Yeah I think this will reproduce it. And in this case, it's probably better if we just return -EPIPE as the association doesn't exist in that socket anymore instead of the BUG_ON. Marcelo ---8<--- diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 26a514269b92..e9870aead88b 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -6838,7 +6838,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, */ sctp_release_sock(sk); current_timeo = schedule_timeout(current_timeo); - BUG_ON(sk != asoc->base.sk); + if (sk != asoc->base.sk) + goto do_error; sctp_lock_sock(sk); *timeo_p = current_timeo; -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
