Re: [syzbot] [net?] divide error in __tcp_select_window (4)

[Matthieu Baerts <matttbe@kernel.org>]

Hello,

On 26/11/2025 13:20, syzbot wrote:
> Hello,
> 
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> divide error in __tcp_select_window
> 
> RSP: 002b:00007f86321dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> RAX: ffffffffffffffda RBX: 00007f86315e5fa0 RCX: 00007f863138f749
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
> RBP: 00007f86321dd090 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
> R13: 00007f86315e6038 R14: 00007f86315e5fa0 R15: 00007ffd93c62a18
>  </TASK>
> Oops: divide error: 0000 [#1] SMP KASAN PTI
> CPU: 1 UID: 0 PID: 6439 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
> RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336
> Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 da 10 01 f8 e9 9c 00 00 00 e8 d0 10 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00
> RSP: 0018:ffffc900030a7640 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8880258abc80
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: ffffc900030a7730 R08: ffff8880310e8dc3 R09: 1ffff1100621d1b8
> R10: dffffc0000000000 R11: ffffed100621d1b9 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS:  00007f86321dd6c0(0000) GS:ffff888126235000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000200000000180 CR3: 000000007e366000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  tcp_select_window net/ipv4/tcp_output.c:281 [inline]
>  __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568
>  tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline]
>  tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836
>  mptcp_do_fastclose+0x286/0x390 net/mptcp/protocol.c:2896
>  mptcp_disconnect+0x238/0x730 net/mptcp/protocol.c:3380
>  mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1801

Indeed, my bad, I missed this: it is a different issue involving TFO
(too many 'fast' :) ). A different fix than the one from Paolo -- like
the one sent by Kuniyuki -- is still needed.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.