syzbot
WARNING in xfrm_policy_inexact_gc_tree
Status:
fixed on 2019/03/06 07:43
Subsystems:
net
[Documentation on labels]
Reported-by: syzbot+0b2f1bc876d301440d44@syzkaller.appspotmail.com
Fix commit:
12750abad517
xfrm: policy: fix infinite loop when merging src-nodes
First crash: 2798d, last: 2745d
Sample crash report:
autofs4:pid:24076:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1.16777216), cmd(0x0000937e)
autofs4:pid:24076:validate_dev_ioctl: invalid device control module version supplied for cmd(0x0000937e)
WARNING: CPU: 0 PID: 14735 at net/xfrm/xfrm_policy.c:1066 xfrm_policy_inexact_gc_tree+0x233/0x290 net/xfrm/xfrm_policy.c:1066
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 14735 Comm: kworker/u4:3 Not tainted 5.0.0-rc4+ #50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
IPVS: ftp: loaded support on port[0] = 21
panic+0x2cb/0x65c kernel/panic.c:214
kobject: 'lo' (0000000006d64efe): kobject_add_internal: parent: 'net', set: 'devices'
kobject: 'lo' (0000000006d64efe): kobject_uevent_env
__warn.cold+0x20/0x48 kernel/panic.c:571
kobject: 'lo' (0000000006d64efe): fill_kobj_path: path = '/devices/virtual/net/lo'
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290
kobject: 'queues' (00000000f773393f): kobject_add_internal: parent: 'lo', set: '<NULL>'
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:xfrm_policy_inexact_gc_tree+0x233/0x290 net/xfrm/xfrm_policy.c:1066
kobject: 'queues' (00000000f773393f): kobject_uevent_env
Code: 81 c4 a0 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 31 5b c3 fa 31 ff 44 89 fe e8 67 5c c3 fa 45 84 ff 74 99 e8 1d 5b c3 fa <0f> 0b eb 90 48 8d 7d 98 48 89 b5 50 ff ff ff e8 b9 58 07 fb 48 8b
RSP: 0018:ffff888051e2f448 EFLAGS: 00010293
RAX: ffff88804e866540 RBX: 0000000000000000 RCX: ffffffff86bea939
RDX: 0000000000000000 RSI: ffffffff86bea943 RDI: 0000000000000001
RBP: ffff888051e2f510 R08: ffff88804e866540 R09: ffff88804e866e80
R10: ffff88804e866e60 R11: 0000000000000001 R12: ffff888094472580
R13: dffffc0000000000 R14: ffffed100a3c5e95 R15: 0000000000000001
kobject: 'queues' (00000000f773393f): kobject_uevent_env: filter function caused the event to drop!
kobject: 'rx-0' (00000000b882f1ee): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'rx-0' (00000000b882f1ee): kobject_uevent_env
__xfrm_policy_inexact_prune_bin+0x126/0xa60 net/xfrm/xfrm_policy.c:1078
kobject: 'rx-0' (00000000b882f1ee): fill_kobj_path: path = '/devices/virtual/net/lo/queues/rx-0'
kobject: 'tx-0' (00000000d3403da8): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'tx-0' (00000000d3403da8): kobject_uevent_env
kobject: 'tx-0' (00000000d3403da8): fill_kobj_path: path = '/devices/virtual/net/lo/queues/tx-0'
xfrm_policy_fini+0x463/0x640 net/xfrm/xfrm_policy.c:3887
kobject: 'tunl0' (00000000addc7091): kobject_add_internal: parent: 'net', set: 'devices'
kobject: 'tunl0' (00000000addc7091): kobject_uevent_env
xfrm_net_exit+0x1d/0x70 net/xfrm/xfrm_policy.c:3928
kobject: 'tunl0' (00000000addc7091): fill_kobj_path: path = '/devices/virtual/net/tunl0'
ops_exit_list.isra.0+0xb0/0x160 net/core/net_namespace.c:153
cleanup_net+0x51d/0xb10 net/core/net_namespace.c:551
kobject: 'queues' (000000001c763449): kobject_add_internal: parent: 'tunl0', set: '<NULL>'
kobject: 'queues' (000000001c763449): kobject_uevent_env
process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
kobject: 'queues' (000000001c763449): kobject_uevent_env: filter function caused the event to drop!
kobject: 'rx-0' (000000004ac6d866): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'rx-0' (000000004ac6d866): kobject_uevent_env
kobject: 'rx-0' (000000004ac6d866): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/rx-0'
kobject: 'tx-0' (00000000e1812989): kobject_add_internal: parent: 'queues', set: 'queues'
worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
kobject: 'tx-0' (00000000e1812989): kobject_uevent_env
kobject: 'tx-0' (00000000e1812989): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/tx-0'
kobject: 'gre0' (00000000fcf57751): kobject_add_internal: parent: 'net', set: 'devices'
kthread+0x357/0x430 kernel/kthread.c:246
kobject: 'gre0' (00000000fcf57751): kobject_uevent_env
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
kobject: 'gre0' (00000000fcf57751): fill_kobj_path: path = '/devices/virtual/net/gre0'
Kernel Offset: disabled
Rebooting in 86400 seconds..
* Struck through repros no longer work on HEAD.