[syzkaller] Divide by 0 in mptcp_subflow_get_send()

[mjmartineau]

Syzkaller has started reporting a divide error in mptcp_subflow_get_send() (three times in 10 minutes). Tag export/20221021T061837.

(I had not been running syzkaller most of the week due to c_start() warnings triggered by a cpumask bug, which prevented any useful syskaller results)

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 14336 Comm: syz-executor.6 Not tainted 6.1.0-rc1-00215-g47aa7f23f440 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:div_u64_rem include/linux/math64.h:29 [inline]
RIP: 0010:div_u64 include/linux/math64.h:128 [inline]
RIP: 0010:mptcp_subflow_get_send+0xa87/0x1200 net/mptcp/protocol.c:1486
Code: 49 0f af 5d 10 48 c1 ea 03 80 3c 02 00 0f 85 7d 06 00 00 49 8b 94 24 50 03 00 00 44 89 f0 44 89 f9 48 0f af c2 31 d2 48 01 d8 <48> f7 f1 48 8b 14 24 48 c1 ea 03 49 89 45 10 48 b8 00 00 00 00 00
RSP: 0018:ffffc9000e38f370 EFLAGS: 00010216
RAX: 06e5618100000000 RBX: 00003315a7530468 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8411a48a RDI: ffff888034110fd0
RBP: ffffc9000e38f468 R08: 0000000000000000 R09: ffffffff866ebc17
R10: fffffbfff0cdd782 R11: 0000000000000001 R12: ffff888034110c80
R13: ffff88810c145c00 R14: 00000000fff89798 R15: 0000000000000000
FS:  00007f8cc79d3640(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200c7000 CR3: 000000003779c004 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <TASK>
 __mptcp_push_pending+0x19e/0x770 net/mptcp/protocol.c:1550
 mptcp_sendmsg+0x694/0x19d0 net/mptcp/protocol.c:1813
 inet_sendmsg+0x11f/0x150 net/ipv4/af_inet.c:828
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg+0x141/0x190 net/socket.c:734
 sock_no_sendpage+0x13d/0x1c0 net/core/sock.c:3219
 inet_sendpage+0x106/0x130 net/ipv4/af_inet.c:846
 kernel_sendpage net/socket.c:3561 [inline]
 kernel_sendpage+0x276/0x820 net/socket.c:3555
 sock_sendpage+0x89/0xb0 net/socket.c:1054
 pipe_to_sendpage+0x2b4/0x390 fs/splice.c:361
 splice_from_pipe_feed fs/splice.c:415 [inline]
 __splice_from_pipe+0x46d/0x8b0 fs/splice.c:559
 splice_from_pipe fs/splice.c:594 [inline]
 generic_splice_sendpage+0xda/0x140 fs/splice.c:743
 do_splice_from fs/splice.c:764 [inline]
 direct_splice_actor+0x115/0x190 fs/splice.c:931
 splice_direct_to_actor+0x338/0x8d0 fs/splice.c:886
 do_splice_direct+0x1bd/0x290 fs/splice.c:974
 do_sendfile+0xb18/0x12e0 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f8cc8281e7d
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8cc79d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f8cc83c1050 RCX: 00007f8cc8281e7d
RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006
RBP: 00007f8cc82f3593 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000800002 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f8cc83c1050 R15: 00007f8cc79b3000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:div_u64_rem include/linux/math64.h:29 [inline]
RIP: 0010:div_u64 include/linux/math64.h:128 [inline]
RIP: 0010:mptcp_subflow_get_send+0xa87/0x1200 net/mptcp/protocol.c:1486
Code: 49 0f af 5d 10 48 c1 ea 03 80 3c 02 00 0f 85 7d 06 00 00 49 8b 94 24 50 03 00 00 44 89 f0 44 89 f9 48 0f af c2 31 d2 48 01 d8 <48> f7 f1 48 8b 14 24 48 c1 ea 03 49 89 45 10 48 b8 00 00 00 00 00
RSP: 0018:ffffc9000e38f370 EFLAGS: 00010216
RAX: 06e5618100000000 RBX: 00003315a7530468 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8411a48a RDI: ffff888034110fd0
RBP: ffffc9000e38f468 R08: 0000000000000000 R09: ffffffff866ebc17
R10: fffffbfff0cdd782 R11: 0000000000000001 R12: ffff888034110c80
R13: ffff88810c145c00 R14: 00000000fff89798 R15: 0000000000000000
FS:  00007f8cc79d3640(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000204b0000 CR3: 000000003779c006 CR4: 0000000000770ef0
PKRU: 55555554
----------------
Code disassembly (best guess):
   0:	49 0f af 5d 10       	imul   0x10(%r13),%rbx
   5:	48 c1 ea 03          	shr    $0x3,%rdx
   9:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   d:	0f 85 7d 06 00 00    	jne    0x690
  13:	49 8b 94 24 50 03 00 	mov    0x350(%r12),%rdx
  1a:	00
  1b:	44 89 f0             	mov    %r14d,%eax
  1e:	44 89 f9             	mov    %r15d,%ecx
  21:	48 0f af c2          	imul   %rdx,%rax
  25:	31 d2                	xor    %edx,%edx
  27:	48 01 d8             	add    %rbx,%rax
* 2a:	48 f7 f1             	div    %rcx <-- trapping instruction
  2d:	48 8b 14 24          	mov    (%rsp),%rdx
  31:	48 c1 ea 03          	shr    $0x3,%rdx
  35:	49 89 45 10          	mov    %rax,0x10(%r13)
  39:	48                   	rex.W
  3a:	b8 00 00 00 00       	mov    $0x0,%eax

Line 1486 of protocol.c is:

	subflow->avg_pacing_rate = div_u64((u64)subflow->avg_pacing_rate * wmem +
					   READ_ONCE(ssk->sk_pacing_rate) * burst,
					   burst + wmem);

So somehow wmem == -burst? (burst is already confirmed as a non-zero value)

report0.gz
log0.gz
config.gz

[geliangtang]

Mat, I just sent a patch to fix this error:
https://patchwork.kernel.org/project/mptcp/patch/[email protected]/

[matttbe]

Now in our tree:

• dce423f: "squashed" in "mptcp: add get_subflow wrappers"
• Results: 9bcf275..d708694 (export)

Tests are now in progress:

https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export/20221031T151210

Thank you for the fix!