Re: passt crashes a) hides error b) assert tripped

[Laurent Vivier <lvivier@redhat.com>]

On 11/8/26 22:31, contact@jbartunek.de wrote:
> Hi!

Hi

> I am currently working on a project involving `crosvm`. To allow for rootless networking 
> plumbing I am relying on `passt` (ver 2026_10_02.cba3570).
> 
> I have found that prolonged (>5 seconds, max. 20 seconds) `https` transfers crash with 
> `crosvm` claiming that the backend device (`passt`) was exiting early.
> 
> In the instant the program crashes I find this in my dmesg:
> ```
> [Sun Nov  8 21:26:32 2026] audit: type=1326 audit(1794169582.685:13): auid=1005 uid=1005 
> gid=998 ses=1 subj=unconfined pid=15127 comm="passt.avx2" exe="/gnu/store/ 
> cjdgl8d27afhnw34x2z3pwmaxa4sw4jg-passt-2026_10_02.cba3570/bin/passt.avx2" sig=31 
> arch=c000003e syscall=318 compat=0 ip=0x7f87c63b8735 code=0x80000000
> ```
> 
> Debugging further my friend KI/AI, they said this expected under the seccomp confinement 
> (no get_random, no brk).
> 
> Rebuilding with `EXTRA_SYSCALLS=getrandom brk`, shows:
> ```
> 60.4309: Flow 2 (TCP connection): STALLED dropped
> passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < ARRAY_SIZE(iov_msg) - j' failed.
> Bad system call
> ```

In fact the assertion should be:

assert((size_t)cnt <= ARRAY_SIZE(iov_msg) - j);

Could you try to update it and move it after the "if (cnt < 0) die("Missing entries in 
iov_msg");"?

Thanks
Laurent
> 
> The log:
> 
> ```
> ... spamy output:
> 342.5609: Flow 2 (TCP connection): timer expires in 1.000s
> 342.5609: Flow 2 (TCP connection): STALLED
> 342.5612: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 342.5612: Flow 2 (TCP connection): STALLED dropped
> 342.5645: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
> 342.5646: Flow 2 (TCP connection): timer expires in 1.000s
> 342.5646: Flow 2 (TCP connection): STALLED
> 342.5647: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 342.5647: Flow 2 (TCP connection): STALLED dropped
> ... lots more of the same spammy output...
> 343.0239: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0249: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0250: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0252: Flow 2 (TCP connection): STALLED
> 343.0252: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 343.0252: Flow 2 (TCP connection): STALLED dropped
> 343.0257: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
> 343.0257: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0258: Flow 2 (TCP connection): STALLED
> 343.0259: Flow 2 (TCP connection): STALLED dropped
> 343.0260: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0261: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < ARRAY_SIZE(iov_msg) - j' failed.
> Bad system call
> ```
> 
> Working diagnosis:
> 1. passt's tcp_vu.c assert in tcp_vu_sock_recv() compares a signed cnt against a size_t 
> capacity, so a negative error return trips the assert and kills passt — which crosvm then 
> reports as the backend disconnecting and stops the VM — while the underlying 
> iov_tail_clone() failure never gets printed;
> 
> 2. seccomp profiles omit getrandom/brk/gettid, so the process dies under SECCOMP_RET_KILL 
> with no message at all.
> 
> This was all I had time for today, hope this helps!
> 
> Kind regards,
> 
> John