| 0/0 |
2026/03/06 00:31 |
flow |
repro |
10m
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
} ReproSyz:r0 = socket(0x11, 0x2, 0x300)
r1 = socket(0x2, 0x2, 0x0)
ioctl$SIOCADDTUNNEL(r1, 0x89f0, &(0x7f0000000000)={'sit1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0}})
sendto(r0, &(0x7f0000000040)='aa', 0xe, 0x0, &(0x7f0000000080)={0x11, 0x0, 0x3, 0x0, 0x0, 0x0, ""}, 0x14)
ioctl$SIOCADDTUNNEL(r1, 0x89f0, &(0x7f0000000100)={'gre1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0}})
sendto(r0, &(0x7f0000000040), 0xe, 0x0, &(0x7f00000000a0)={0x11, 0x0, 0x4, 0x0, 0x0, 0x0, ""}, 0x14)
SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 1/1 |
2026/03/06 00:31 |
action |
provide-var |
0m
Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
|
| 2/1 |
2026/03/06 00:31 |
action |
kernel-checkouter |
0m
Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/d9e8c43b044552d1e91d2202bef5aecf290aedaf]
|
| 3/1 |
2026/03/06 00:32 |
action |
kernel-builder |
6m
Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/a3f5d9b83231ee4054c9d82699cf5cc96f34830e]
|
| 4/1 |
2026/03/06 00:38 |
agent |
crash-repro-finder |
3m
Model:
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
Instruction:
You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt:
Bug Title: WARNING in packet_sendmsg
Original Crash Report:
------------[ cut here ]------------
WARNING: ./include/linux/skbuff.h:3122 at skb_reset_network_header include/linux/skbuff.h:3122 [inline], CPU#3: syz.1.2496/14488
WARNING: ./include/linux/skbuff.h:3122 at packet_snd net/packet/af_packet.c:3035 [inline], CPU#3: syz.1.2496/14488
WARNING: ./include/linux/skbuff.h:3122 at packet_sendmsg+0x49eb/0x54a0 net/packet/af_packet.c:3108, CPU#3: syz.1.2496/14488
Modules linked in:
CPU: 3 UID: 0 PID: 14488 Comm: syz.1.2496 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:skb_reset_network_header include/linux/skbuff.h:3122 [inline]
RIP: 0010:packet_snd net/packet/af_packet.c:3035 [inline]
RIP: 0010:packet_sendmsg+0x49eb/0x54a0 net/packet/af_packet.c:3108
Code: 48 89 c8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 59 08 00 00 41 8b 9e cc 00 00 00 48 01 eb e9 88 c5 ff ff e8 56 64 7d f7 90 <0f> 0b 90 e9 a3 df ff ff e8 48 64 7d f7 48 8b 54 24 18 48 b8 00 00
RSP: 0018:ffffc90006e9fae0 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffc90006e9fd58 RCX: ffffffff8a416439
RDX: ffff88802f7bc980 RSI: ffffffff8a41849a RDI: 0000000000000007
RBP: ffffffffffffff84 R08: 0000000000000007 R09: 000000000000ffff
R10: ffffffffffffff84 R11: 0000000000000000 R12: ffff888053ce0a00
R13: 000000000000002c R14: ffff888022c8c000 R15: 000000000000000e
FS: 00007fcfe64ac6c0(0000) GS:ffff8880d6bf5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcfe64abf98 CR3: 000000004eb64000 CR4: 0000000000352ef0
Call Trace:
<TASK>
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x4a3/0x520 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcfe558f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcfe64ac038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fcfe57e6090 RCX: 00007fcfe558f7c9
RDX: 000000000000000e RSI: 0000200000000180 RDI: 0000000000000004
RBP: 00007fcfe5613f91 R08: 0000200000000140 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcfe57e6128 R14: 00007fcfe57e6090 R15: 00007ffdd27ec0e8
</TASK>
The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt
Reply: r0 = socket(0x11, 0x2, 0x300)
r1 = socket(0x2, 0x2, 0x0)
ioctl$SIOCADDTUNNEL(r1, 0x89f0, &(0x7f0000000000)={'sit1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0}})
sendto(r0, &(0x7f0000000040)='aa', 0xe, 0x0, &(0x7f0000000080)={0x11, 0x0, 0x3, 0x0, 0x0, 0x0, ""}, 0x14)
ioctl$SIOCADDTUNNEL(r1, 0x89f0, &(0x7f0000000100)={'gre1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, 0x0, 0x0}})
sendto(r0, &(0x7f0000000040), 0xe, 0x0, &(0x7f00000000a0)={0x11, 0x0, 0x4, 0x0, 0x0, 0x0, ""}, 0x14)
|
| 5/2 |
2026/03/06 00:38 |
llm |
crash-repro-finder |
2m
Model:
Tokens:
input: 3682
output: 43
thoughts: 20786
Thoughts: **AF_PACKET SOCK_DGRAM Vulnerability Analysis and Reproduction Strategy**
Okay, so I've been given a crash report with a warning in `skb_reset_network_header`, and it looks like a `sendto` syscall on an `AF_PACKET` socket. The goal is to generate a syzkaller program to trigger this same warning. The warning is usually related to a condition where `skb->data - skb->head` results in an offset that is larger than the maximum value that the `network_header` field (typically a `__u16` type) can hold.
The crash occurs within `packet_snd`. Looking at the code for that function, and the call trace provided, I'm making the following assumptions:
1. This is a `SOCK_DGRAM` packet socket, as the `packet_snd` logic differs for `SOCK_RAW` vs `SOCK_DGRAM`. I have to bind to a device when calling the `sendto` function.
2. The key part is the calculation of the `reserve` value, which is derived from the netdevice `hard_header_len` and the `needed_headroom` plus possibly other parameters that syzkaller controls when creating a virtual device.
3. The crucial condition for the warning is that `reserve` needs to be larger than 65535 to trigger the overflow within the `skb_reset_network_header` calculation. If the calculation's value becomes truncated into an unsigned 16 bit value, and this is where the `WARN_ON` check is.
The report also shows a specific `sendto` with `len=14` and some flags, so I will target that as well.
I'm looking for a network device, or a method to create a device that will result in a larger header. A standard device like `lo` won't work, so I'll need to use tunnels or stacks to increase header lengths. The crash report shows ifindex is 4.
I will try these approaches in my syzkaller program:
1. Create a standard `AF_PACKET`, `SOCK_DGRAM` socket.
2. Create a `sit` tunnel using `ioctl(SIOCADDTUNNEL)`, as this has been shown to cause issues in similar reports and is common. Send to this device.
3. Create a `gre` tunnel, and test sending to that.
4. Bind the socket to `lo` and send.
The main challenge is to create a device with a large `hard_header_len` or, more realistically, with a large `needed_headroom`. I'll try tunnels like `sit` which I can set, and experiment with multiple configurations for the `sit` tunnel, to see what triggers the warning. I will use the `sendto` flags `0x200000000180` that was provided by the trace. The `buf` pointer does not matter in this case. The key is setting `ifindex`.
My program will try to bind to all available interfaces, as the ifindex=4 seems important.
|
| 6/2 |
2026/03/06 00:41 |
tool |
set-results |
0m
Args: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
Results: map[ReproOpts:{
"procs": 1,
"type": "none",
"repeat": true
}]
|
| 7/2 |
2026/03/06 00:41 |
llm |
crash-repro-finder |
0m
Model:
Tokens:
input: 25235
output: 474
thoughts: 0
|