passt crashes a) hides error b) assert tripped

passt crashes a) hides error b) assert tripped

[contact]

Hi!

I am currently working on a project involving `crosvm`. To allow for 
rootless networking plumbing I am relying on `passt` (ver 
2026_10_02.cba3570).

I have found that prolonged (>5 seconds, max. 20 seconds) `https` 
transfers crash with `crosvm` claiming that the backend device (`passt`) 
was exiting early.

In the instant the program crashes I find this in my dmesg:
```
[Sun Nov  8 21:26:32 2026] audit: type=1326 audit(1794169582.685:13): 
auid=1005 uid=1005 gid=998 ses=1 subj=unconfined pid=15127 
comm="passt.avx2" 
exe="/gnu/store/cjdgl8d27afhnw34x2z3pwmaxa4sw4jg-passt-2026_10_02.cba3570/bin/passt.avx2" 
sig=31 arch=c000003e syscall=318 compat=0 ip=0x7f87c63b8735 
code=0x80000000
```

Debugging further my friend KI/AI, they said this expected under the 
seccomp confinement (no get_random, no brk).

Rebuilding with `EXTRA_SYSCALLS=getrandom brk`, shows:
```
60.4309: Flow 2 (TCP connection): STALLED dropped
passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < 
ARRAY_SIZE(iov_msg) - j' failed.
Bad system call
```

The log:

```
... spamy output:
342.5609: Flow 2 (TCP connection): timer expires in 1.000s
342.5609: Flow 2 (TCP connection): STALLED
342.5612: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
342.5612: Flow 2 (TCP connection): STALLED dropped
342.5645: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
342.5646: Flow 2 (TCP connection): timer expires in 1.000s
342.5646: Flow 2 (TCP connection): STALLED
342.5647: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
342.5647: Flow 2 (TCP connection): STALLED dropped
... lots more of the same spammy output...
343.0239: Flow 2 (TCP connection): timer expires in 1.000s
343.0249: Flow 2 (TCP connection): timer expires in 1.000s
343.0250: Flow 2 (TCP connection): timer expires in 1.000s
343.0252: Flow 2 (TCP connection): STALLED
343.0252: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
343.0252: Flow 2 (TCP connection): STALLED dropped
343.0257: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
343.0257: Flow 2 (TCP connection): timer expires in 1.000s
343.0258: Flow 2 (TCP connection): STALLED
343.0259: Flow 2 (TCP connection): STALLED dropped
343.0260: Flow 2 (TCP connection): timer expires in 1.000s
343.0261: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < 
ARRAY_SIZE(iov_msg) - j' failed.
Bad system call
```

Working diagnosis:
1. passt's tcp_vu.c assert in tcp_vu_sock_recv() compares a signed cnt 
against a size_t capacity, so a negative error return trips the assert 
and kills passt — which crosvm then reports as the backend disconnecting 
and stops the VM — while the underlying iov_tail_clone() failure never 
gets printed;

2. seccomp profiles omit getrandom/brk/gettid, so the process dies under 
SECCOMP_RET_KILL with no message at all.

This was all I had time for today, hope this helps!

Kind regards,

John

Re: passt crashes a) hides error b) assert tripped

[Laurent Vivier]

On 11/8/26 22:31, contact@jbartunek.de wrote:
> Hi!

Hi

> I am currently working on a project involving `crosvm`. To allow for rootless networking 
> plumbing I am relying on `passt` (ver 2026_10_02.cba3570).
> 
> I have found that prolonged (>5 seconds, max. 20 seconds) `https` transfers crash with 
> `crosvm` claiming that the backend device (`passt`) was exiting early.
> 
> In the instant the program crashes I find this in my dmesg:
> ```
> [Sun Nov  8 21:26:32 2026] audit: type=1326 audit(1794169582.685:13): auid=1005 uid=1005 
> gid=998 ses=1 subj=unconfined pid=15127 comm="passt.avx2" exe="/gnu/store/ 
> cjdgl8d27afhnw34x2z3pwmaxa4sw4jg-passt-2026_10_02.cba3570/bin/passt.avx2" sig=31 
> arch=c000003e syscall=318 compat=0 ip=0x7f87c63b8735 code=0x80000000
> ```
> 
> Debugging further my friend KI/AI, they said this expected under the seccomp confinement 
> (no get_random, no brk).
> 
> Rebuilding with `EXTRA_SYSCALLS=getrandom brk`, shows:
> ```
> 60.4309: Flow 2 (TCP connection): STALLED dropped
> passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < ARRAY_SIZE(iov_msg) - j' failed.
> Bad system call
> ```

In fact the assertion should be:

assert((size_t)cnt <= ARRAY_SIZE(iov_msg) - j);

Could you try to update it and move it after the "if (cnt < 0) die("Missing entries in 
iov_msg");"?

Thanks
Laurent
> 
> The log:
> 
> ```
> ... spamy output:
> 342.5609: Flow 2 (TCP connection): timer expires in 1.000s
> 342.5609: Flow 2 (TCP connection): STALLED
> 342.5612: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 342.5612: Flow 2 (TCP connection): STALLED dropped
> 342.5645: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
> 342.5646: Flow 2 (TCP connection): timer expires in 1.000s
> 342.5646: Flow 2 (TCP connection): STALLED
> 342.5647: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 342.5647: Flow 2 (TCP connection): STALLED dropped
> ... lots more of the same spammy output...
> 343.0239: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0249: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0250: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0252: Flow 2 (TCP connection): STALLED
> 343.0252: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> 343.0252: Flow 2 (TCP connection): STALLED dropped
> 343.0257: Flow 2 (TCP connection): ACK_FROM_TAP_DUE
> 343.0257: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0258: Flow 2 (TCP connection): STALLED
> 343.0259: Flow 2 (TCP connection): STALLED dropped
> 343.0260: Flow 2 (TCP connection): timer expires in 1.000s
> 343.0261: Flow 2 (TCP connection): ACK_FROM_TAP_DUE dropped
> passt.avx2: tcp_vu.c:294: tcp_vu_sock_recv: Assertion `cnt < ARRAY_SIZE(iov_msg) - j' failed.
> Bad system call
> ```
> 
> Working diagnosis:
> 1. passt's tcp_vu.c assert in tcp_vu_sock_recv() compares a signed cnt against a size_t 
> capacity, so a negative error return trips the assert and kills passt — which crosvm then 
> reports as the backend disconnecting and stops the VM — while the underlying 
> iov_tail_clone() failure never gets printed;
> 
> 2. seccomp profiles omit getrandom/brk/gettid, so the process dies under SECCOMP_RET_KILL 
> with no message at all.
> 
> This was all I had time for today, hope this helps!
> 
> Kind regards,
> 
> John

Re: passt crashes a) hides error b) assert tripped

[contact]

Hi Laurent,

Thanks for getting back to me so quickly!

On 2026-11-09 08:12, Laurent Vivier wrote:
> 
> In fact the assertion should be:
> 
> assert((size_t)cnt <= ARRAY_SIZE(iov_msg) - j);
> 
> Could you try to update it and move it after the "if (cnt < 0) 
> die("Missing entries in iov_msg");"?

Sure I used
```
diff --git a/tcp_vu.c b/tcp_vu.c
index 868a35b..cee9cf6 100644
--- a/tcp_vu.c
+++ b/tcp_vu.c
@@ -291,9 +291,9 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, 
struct vu_virtq *vq,

                 cnt = iov_tail_clone(&iov_msg[j], ARRAY_SIZE(iov_msg) - 
j,
                                      &data);
-               assert(cnt < ARRAY_SIZE(iov_msg) - j);
                 if (cnt < 0)
                         die("Missing entries in iov_msg");
+               assert((size_t)cnt <= ARRAY_SIZE(iov_msg) - (size_t)j);

                 j += cnt;
         }
```
on top of `2026_10_02.cba3570` (note the additional cast for j).

I tried it again with my setup: 0 crashes, it just works (TM), large 
download all. Thank you so much!

All the best,

John