syzbot


kernel BUG in pskb_expand_head (2)

Status: upstream: reported C repro on 2025/07/18 14:25
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+49fbf22a9769a1d5038e@syzkaller.appspotmail.com
First crash: 1d22h, last: 1d09h
Bug presence (2)
Date Name Commit Repro Result
2025/07/19 linux-5.15.y (ToT) c79648372d02 C [report] kernel BUG in pskb_expand_head
2025/07/19 upstream (ToT) 27c2570359d6 C Didn't crash
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 kernel BUG in pskb_expand_head -1 1 773d 773d 0/2 auto-obsoleted due to no activity on 2023/09/05 19:11
upstream kernel BUG in pskb_expand_head (4) intel-wired-lan -1 1 143d 143d 28/29 fixed on 2025/06/10 16:19
upstream kernel BUG in pskb_expand_head (3) net -1 1 392d 392d 0/29 closed as invalid on 2024/09/04 18:07
upstream kernel BUG in pskb_expand_head (2) bpf net -1 10 786d 802d 0/29 auto-obsoleted due to no activity on 2023/08/23 09:08
linux-5.15 kernel BUG in pskb_expand_head -1 1 825d 825d 0/3 auto-obsoleted due to no activity on 2023/08/14 13:19
upstream kernel BUG in llc_sap_action_send_xid_c net -1 C error 61 1348d 1562d 20/29 fixed on 2021/11/10 00:50
upstream kernel BUG in pskb_expand_head net -1 C done 1600 892d 1343d 22/29 fixed on 2023/02/25 08:02
linux-6.1 kernel BUG in pskb_expand_head -1 1 781d 781d 0/3 auto-obsoleted due to no activity on 2023/09/07 17:22

Sample crash report:
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:1703!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4295 Comm: kworker/0:9 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events sk_psock_backlog
RIP: 0010:pskb_expand_head+0x10c1/0x10f0 net/core/skbuff.c:1703
Code: 7d ec f9 e9 32 f4 ff ff e8 7c 1a a8 f9 4c 89 ef 48 c7 c6 20 3c fe 8a e8 3d 85 da f9 0f 0b e8 66 1a a8 f9 0f 0b e8 5f 1a a8 f9 <0f> 0b 48 8b 0c 24 80 e1 07 80 c1 03 38 c1 0f 8c bf fa ff ff 48 8b
RSP: 0018:ffffc900031af8f0 EFLAGS: 00010293
RAX: ffffffff87cfa9c1 RBX: 0000000000000ec0 RCX: ffff88807e733b80
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed100e9ad26c
R10: ffffed100e9ad26c R11: 1ffff1100e9ad26b R12: 0000000000008080
R13: ffff888074d6935c R14: 0000000000000002 R15: 0000000000000a20
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000283000 CR3: 0000000074dfe000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __pskb_pull_tail+0xb6/0x1530 net/core/skbuff.c:2257
 __skb_linearize include/linux/skbuff.h:3508 [inline]
 skb_linearize include/linux/skbuff.h:3520 [inline]
 sk_psock_skb_ingress_enqueue+0x67/0x690 net/core/skmsg.c:537
 sk_psock_skb_ingress net/core/skmsg.c:581 [inline]
 sk_psock_handle_skb net/core/skmsg.c:619 [inline]
 sk_psock_backlog+0xaef/0x1330 net/core/skmsg.c:676
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
---[ end trace c9910daf832e466d ]---
RIP: 0010:pskb_expand_head+0x10c1/0x10f0 net/core/skbuff.c:1703
Code: 7d ec f9 e9 32 f4 ff ff e8 7c 1a a8 f9 4c 89 ef 48 c7 c6 20 3c fe 8a e8 3d 85 da f9 0f 0b e8 66 1a a8 f9 0f 0b e8 5f 1a a8 f9 <0f> 0b 48 8b 0c 24 80 e1 07 80 c1 03 38 c1 0f 8c bf fa ff ff 48 8b
RSP: 0018:ffffc900031af8f0 EFLAGS: 00010293
RAX: ffffffff87cfa9c1 RBX: 0000000000000ec0 RCX: ffff88807e733b80
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed100e9ad26c
R10: ffffed100e9ad26c R11: 1ffff1100e9ad26b R12: 0000000000008080
R13: ffff888074d6935c R14: 0000000000000002 R15: 0000000000000a20
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000283000 CR3: 000000002ab1e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/18 15:37 linux-5.15.y c79648372d02 88248e14 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf kernel BUG in pskb_expand_head
2025/07/18 14:25 linux-5.15.y c79648372d02 88248e14 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf kernel BUG in pskb_expand_head
* Struck through repros no longer work on HEAD.