kernel BUG at net/core/skbuff.c:LINE!

Status: upstream: reported C repro on 2019/04/27 20:12
Reported-by: syzbot+77d13153b9599a418a9c@syzkaller.appspotmail.com
First crash: 2675d, last: 1455d
Fix bisection: fixed by (bisect log) [no-op commit]:
commit 4f12385298d474541a794f4c47980861299f20e7
Author: Sibi Sankar <sibis@codeaurora.org>
Date: Wed Jul 22 20:10:45 2020 +0000

  remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load

  
▶ ▼ Similar bugs (25)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 kernel BUG at net/core/skbuff.c:LINE! -1 syz, C 79 2466d 2691d 0/2 public: reported C repro on 2019/04/11 08:44
android-54 kernel BUG in pfkey_send_acquire -1 syz, C 278 1379d 2044d 0/2 auto-obsoleted due to no activity on 2023/04/19 14:24
upstream kernel BUG at net/core/skbuff.c:LINE! (2) net -1 syz, C 562 3130d 3219d 4/29 fixed on 2018/01/29 03:39
android-5-10 kernel BUG in add_grec -1 syz, C error 83 1609d 1683d 2/2 fixed on 2022/03/29 10:01
android-54 kernel BUG at net/core/skbuff.c:LINE! -1 syz, C 267 1195d 2415d 0/2 auto-obsoleted due to no activity on 2023/08/22 15:17
android-414 kernel BUG at net/core/skbuff.c:LINE! -1 syz, C 2743 2454d 2691d 0/1 public: reported C repro on 2019/04/11 00:00
android-5-10 kernel BUG in add_grec (2) -1 syz, C error inconclusive 1039 1369d 1369d 2/2 fixed on 2023/02/24 12:10
upstream kernel BUG in netem_enqueue net -1 9 1347d 1572d 22/29 fixed on 2023/02/24 13:50
android-5-10 kernel BUG in cdc_ncm_fill_tx_frame -1 syz, C error 40 1701d 1767d 1/2 fixed on 2021/12/29 12:20
upstream kernel BUG at net/core/skbuff.c:LINE! (3) -1 syz, C done 4399 2008d 3125d 19/29 fixed on 2021/03/10 01:48
upstream kernel BUG at net/core/skbuff.c:LINE! sctp -1 5 3225d 3295d 3/29 fixed on 2017/10/27 10:10
linux-4.19 kernel BUG in pfkey_send_acquire -1 syz, C done 56 2015d 2044d 1/1 fixed on 2021/03/18 08:30
linux-4.14 kernel BUG at net/core/skbuff.c:LINE! -1 syz, C 3066 1271d 2690d 0/1 upstream: reported C repro on 2019/04/12 15:43
upstream kernel BUG in llc_sap_action_send_xid_c net -1 syz, C error 61 1748d 1962d 20/29 fixed on 2021/11/10 00:50
upstream kernel BUG in pskb_expand_head net -1 syz, C done 1600 1291d 1742d 22/29 fixed on 2023/02/25 08:02
android-49 kernel BUG at net/core/skbuff.c:LINE! -1 syz, C 391 2454d 2690d 0/3 public: reported C repro on 2019/04/12 00:00
upstream kernel BUG in fou_build_udp net -1 syz, C 1 1207d 1207d 22/29 fixed on 2023/06/08 14:41
upstream kernel BUG in icmp_glue_bits net -1 2 1178d 1242d 22/29 fixed on 2023/06/08 14:41
upstream kernel BUG in ip6gre_header (6) net -1 syz, C 127 237d 255d 29/29 fixed on 2026/01/26 05:07
upstream kernel BUG in ip6gre_header (2) net -1 syz, C 2 1045d 1059d 25/29 fixed on 2024/01/20 21:18
upstream kernel BUG in ip6gre_header net -1 syz, C 5 1096d 1166d 23/29 fixed on 2023/09/28 17:51
upstream kernel BUG in ip6gre_header (5) net -1 1 748d 748d 0/29 closed as invalid on 2024/08/29 14:58
upstream kernel BUG in ip6gre_header (3) net -1 1 929d 929d 0/29 closed as invalid on 2024/03/01 17:31
upstream kernel BUG in ip6gre_header (4) net -1 1 837d 837d 0/29 closed as invalid on 2024/06/03 15:58
linux-6.1 kernel BUG in ip6gre_header origin:upstream -1 syz, C error 1 711d 1166d 0/3 upstream: reported C repro on 2023/06/14 11:11
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2021/02/22 20:18 4h26m bisect fix linux-4.19.y OK (1) job log
2021/02/19 00:08 19m bisect fix linux-4.19.y error job log
2021/02/16 04:09 0m bisect fix linux-4.19.y error job log

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
skbuff: skb_under_panic: text:00000000e93ca143 len:48 put:8 head:00000000946fb9c9 data:0000000094f10a8e tail:0x2c end:0xc0 dev:sit1
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8171 Comm: syz-executor886 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_panic+0x172/0x174 net/core/skbuff.c:104
Code: 4c 24 10 8b 8b 80 00 00 00 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 60 4f 4c 89 ff 74 24 10 ff 74 24 20 e8 f1 18 e2 ff <0f> 0b e8 7f e7 50 f9 4c 8b 64 24 18 e8 c5 aa 86 f9 48 c7 c1 c0 58
RSP: 0018:ffff888091c4eb30 EFLAGS: 00010282
RAX: 0000000000000083 RBX: ffff8880a2c5c200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed1012389d58
RBP: ffffffff894c58c0 R08: 0000000000000083 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86eec28f
R13: 0000000000000008 R14: ffff8880b0566700 R15: 00000000000000c0
FS:  00005555558d8300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000009bb95000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 skb_under_panic net/core/skbuff.c:114 [inline]
 skb_push.cold+0x24/0x24 net/core/skbuff.c:1730
 fou_build_udp+0x2f/0x360 net/ipv4/fou.c:960
 gue_build_header+0xf7/0x140 net/ipv4/fou.c:1003
 ip_tunnel_encap include/net/ip_tunnels.h:384 [inline]
 ip_tunnel_xmit+0x7ed/0x3850 net/ipv4/ip_tunnel.c:722
 sit_tunnel_xmit__ net/ipv6/sit.c:1017 [inline]
 sit_tunnel_xmit+0x4ef/0x28d0 net/ipv6/sit.c:1033
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 neigh_output include/net/neighbour.h:501 [inline]
 ip_finish_output2+0xd76/0x15a0 net/ipv4/ip_output.c:230
 ip_finish_output+0xae9/0x10b0 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip_mc_output+0x268/0xec0 net/ipv4/ip_output.c:391
 dst_output include/net/dst.h:455 [inline]
 ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125
 ip_send_skb+0x3e/0xe0 net/ipv4/ip_output.c:1452
 udp_send_skb+0x6a4/0x1170 net/ipv4/udp.c:848
 udp_sendmsg+0x1cb4/0x2550 net/ipv4/udp.c:1135
 udpv6_sendmsg+0x14b2/0x2ae0 net/ipv6/udp.c:1224
 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 ___sys_sendmsg+0x3b3/0x8e0 net/socket.c:2227
 __sys_sendmmsg+0x195/0x470 net/socket.c:2322
 __do_sys_sendmmsg net/socket.c:2351 [inline]
 __se_sys_sendmmsg net/socket.c:2348 [inline]
 __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2348
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f60d3630499
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcd81b9eb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f60d3630499
RDX: 0000000000000001 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00000000d369de40 R09: 00000000d369de40
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000008b1f
R13: 00007ffcd81b9ee0 R14: 00007ffcd81b9ed0 R15: 00007ffcd81b9ec4
Modules linked in:
---[ end trace 70e215b8f1dc5818 ]---
RIP: 0010:skb_panic+0x172/0x174 net/core/skbuff.c:104
Code: 4c 24 10 8b 8b 80 00 00 00 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 60 4f 4c 89 ff 74 24 10 ff 74 24 20 e8 f1 18 e2 ff <0f> 0b e8 7f e7 50 f9 4c 8b 64 24 18 e8 c5 aa 86 f9 48 c7 c1 c0 58
RSP: 0018:ffff888091c4eb30 EFLAGS: 00010282
RAX: 0000000000000083 RBX: ffff8880a2c5c200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed1012389d58
RBP: ffffffff894c58c0 R08: 0000000000000083 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86eec28f
R13: 0000000000000008 R14: ffff8880b0566700 R15: 00000000000000c0
FS:  00005555558d8300(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000009bb95000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (494):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/06/14 10:27 linux-4.19.y 3f8a27f9e27b 0f087040 .config console log report syz C ci2-linux-4-19 kernel BUG in fou_build_udp
2022/01/24 04:37 linux-4.19.y 3f8a27f9e27b 214351e1 .config console log report syz C ci2-linux-4-19 kernel BUG in __ip6_append_data
2021/12/14 21:46 linux-4.19.y 3f8a27f9e27b d018dd31 .config console log report syz C ci2-linux-4-19 kernel BUG in fou_build_udp
2021/05/18 14:25 linux-4.19.y 3c8c23092588 a343ba6b .config console log report syz C ci2-linux-4-19 kernel BUG in llc_sap_action_send_xid_c
2020/10/06 03:06 linux-4.19.y b09c34517e1a 1880b4a9 .config console log report syz C ci2-linux-4-19
2019/12/24 10:07 linux-4.19.y 672481c2deff be5c2c81 .config console log report syz C ci2-linux-4-19
2020/01/28 06:33 linux-4.19.y 88d6de67e390 56cd6c9b .config console log report syz ci2-linux-4-19
2019/05/03 07:34 linux-4.19.y a03957ab0fd5 1bfa09b9 .config console log report syz ci2-linux-4-19
2019/05/01 01:25 linux-4.19.y 19bb613acb9a 618456b4 .config console log report syz ci2-linux-4-19
2019/04/28 01:52 linux-4.19.y 19bb613acb9a b617407b .config console log report syz ci2-linux-4-19
2019/04/27 21:56 linux-4.19.y 19bb613acb9a b617407b .config console log report syz ci2-linux-4-19
2022/08/29 02:51 linux-4.19.y 3f8a27f9e27b 07177916 .config console log report info ci2-linux-4-19 kernel BUG in ip6gre_header
2021/11/09 21:11 linux-4.19.y 3f8a27f9e27b 59bcaf9a .config console log report info ci2-linux-4-19 kernel BUG in icmp_glue_bits
2021/10/28 07:17 linux-4.19.y 3f8a27f9e27b be531bb4 .config console log report info ci2-linux-4-19 kernel BUG in fou_build_udp
2021/10/12 01:59 linux-4.19.y e34184f53363 838e7e2c .config console log report info ci2-linux-4-19 kernel BUG in __skb_to_sgvec
2021/07/26 04:25 linux-4.19.y 4938296e03bd 4d1b57d4 .config console log report info ci2-linux-4-19 kernel BUG in __skb_to_sgvec
2021/07/23 21:31 linux-4.19.y 4938296e03bd bc5f1d88 .config console log report info ci2-linux-4-19 kernel BUG in __skb_to_sgvec
2021/01/17 03:51 linux-4.19.y 675cc038067f 65a7a854 .config console log report info ci2-linux-4-19
2021/01/16 14:39 linux-4.19.y 675cc038067f 65a7a854 .config console log report info ci2-linux-4-19
2021/01/15 22:08 linux-4.19.y 675cc038067f 65a7a854 .config console log report info ci2-linux-4-19
2021/01/15 12:32 linux-4.19.y 675cc038067f 65a7a854 .config console log report info ci2-linux-4-19
2021/01/15 07:42 linux-4.19.y 675cc038067f 65a7a854 .config console log report info ci2-linux-4-19
2021/01/15 01:56 linux-4.19.y 675cc038067f 468dbb55 .config console log report info ci2-linux-4-19
2021/01/14 15:20 linux-4.19.y 675cc038067f 468dbb55 .config console log report info ci2-linux-4-19
2021/01/12 13:57 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/12 09:52 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/12 06:44 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/11 19:47 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/11 11:28 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/11 05:48 linux-4.19.y 610bdbf6a174 2c1f2513 .config console log report info ci2-linux-4-19
2021/01/09 05:42 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/08 22:20 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/08 20:38 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/08 12:56 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/08 07:05 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/07 20:42 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/07 17:02 linux-4.19.y 4143d798313f c104d4a3 .config console log report info ci2-linux-4-19
2021/01/06 17:13 linux-4.19.y 4143d798313f fff20c29 .config console log report info ci2-linux-4-19
2021/01/06 11:05 linux-4.19.y 3207316b3bee fff20c29 .config console log report info ci2-linux-4-19
2021/01/05 23:09 linux-4.19.y 3207316b3bee b1c228e1 .config console log report info ci2-linux-4-19
2021/01/05 22:16 linux-4.19.y 3207316b3bee b1c228e1 .config console log report info ci2-linux-4-19
2021/01/05 11:53 linux-4.19.y 3207316b3bee a0234d98 .config console log report info ci2-linux-4-19
2021/01/05 09:07 linux-4.19.y 3207316b3bee 2a28ff1f .config console log report info ci2-linux-4-19
2021/01/04 17:35 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/04 12:33 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/03 22:04 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/03 18:07 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/03 05:00 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/03 03:34 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 23:10 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 22:07 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 14:32 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 11:34 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 07:30 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/02 04:27 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2021/01/01 18:09 linux-4.19.y 3207316b3bee 79264ae3 .config console log report info ci2-linux-4-19
2019/04/27 19:11 linux-4.19.y 19bb613acb9a b617407b .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.