Page MenuHomeFreeBSD

syzcaller found an interesting Invariant crash

Authored by rrs on May 13 2021, 10:58 AM.



syzcaller came up with an interesting crash that has to do with sending
both a SYN and FIN together. Turns out there were actually two problems.

  1. Not splitting the flags when you clone off a new rsm the right way (SYN should go to the left edge and FIN should go to the right)
  2. a KASSERT that did not properly account for this case i.e. no mbuf/no data.
Test Plan

This pkt-drill script will currently cause a crash without the patch. With the
patch everything works as it should.

 0.00 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0.00 setsockopt(3, IPPROTO_TCP, TCP_FUNCTION_BLK, {function_set_name="rack",
                                                    pcbcnt=0}, 36) = 0
+0.00 sendto(3, ..., 0, MSG_EOF, ..., ...) = 0
+0.00 setsockopt(3,IPPROTO_TCP,TCP_NOOPT, [1], 4) = 0
+0.00 shutdown(3, SHUT_WR) = 0
+0.00 close(3) = 0

Diff Detail

rG FreeBSD src repository
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

rrs requested review of this revision.May 13 2021, 10:58 AM
rrs added a reviewer: tuexen.
tuexen retitled this revision from Skyzall found an interesting Invariant crash to syzcaller found an interesting Invariant crash.
tuexen edited the summary of this revision. (Show Details)
tuexen edited the test plan for this revision. (Show Details)
This revision is now accepted and ready to land.May 13 2021, 11:04 AM
This revision was automatically updated to reflect the committed changes.