On Sun, Mar 5, 2017 at 4:00 AM, Dmitry Vyukov <dvyu...@google.com> wrote: > On Fri, Mar 3, 2017 at 11:08 PM, Eric Dumazet <eric.duma...@gmail.com> wrote: >> From: Eric Dumazet <eduma...@google.com> >> >> Dmitry Vyukov reported a divide by 0 triggered by syzkaller, exploiting >> tcp_disconnect() path that was never really considered and/or used >> before syzkaller ;) >> >> I was not able to reproduce the bug, but it seems issues here are the >> three possible actions that assumed they would never trigger on a >> listener. >> >> 1) tcp_write_timer_handler >> 2) tcp_delack_timer_handler >> 3) MTU reduction >> >> Only IPv6 MTU reduction was properly testing TCP_CLOSE and TCP_LISTEN >> states from tcp_v6_mtu_reduced() > > I've run the test as "while ./a.out; do true; done". I've also noticed > that it either reproduces very quickly or does not happen at all. So I > rebooted machine, run the program in loop and then repeated if it does > not happen within seconds.
Yes, I was also doing this. What I noticed is that your program did not use SO_REUSEADDR, meaning the second (and later) bind() syscall would fail. Maybe some sysctl difference between your host and mine.... > > Retested with your patch, seems to not crash anymore. > Thanks for testing !
