WARNING in xfrm_state_fini

Status: fixed on 2019/12/06 10:33
Reported-by: syzbot+9c5d791e3a8e4d8e5e8a@syzkaller.appspotmail.com
Fix commit: dbb2483b2a46 xfrm: clean up xfrm protocol checks
First crash: 2671d, last: 2516d
Fix bisection: fixed by (bisect log) :
commit cd393b38514dc3caa916db3b4405d592bfd3c9ea
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date: Fri Mar 22 23:26:19 2019 +0000

  xfrm: clean up xfrm protocol checks

  
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 WARNING in xfrm_state_fini -1 34 306d 341d 0/2 auto-obsoleted due to no activity on 2025/12/11 11:32
upstream WARNING in xfrm_state_fini (4) net -1 syz, C done 89278 243d 296d 29/29 fixed on 2026/01/07 12:29
linux-4.19 WARNING in xfrm_state_fini -1 syz, C done 78 2648d 2672d 1/1 fixed on 2019/11/30 01:15
upstream WARNING in xfrm_state_fini (3) net -1 syz, C done 122008 300d 371d 29/29 fixed on 2025/10/09 01:15
android-414 WARNING in xfrm_state_fini -1 syz, C 2207 2514d 2673d 0/1 public: reported C repro on 2019/04/11 00:00
upstream WARNING in xfrm_state_fini net -1 syz, C 2231 3123d 3178d 4/29 fixed on 2018/01/31 00:24
android-44 WARNING in xfrm_state_fini -1 syz, C 3175 2462d 2672d 0/2 public: reported C repro on 2019/04/12 00:00
android-49 WARNING in xfrm_state_fini -1 syz, C 21956 2435d 2672d 0/3 public: reported C repro on 2019/04/12 00:00
upstream WARNING in xfrm_state_fini (2) net -1 syz, C 37510 2650d 3103d 12/29 fixed on 2019/05/27 12:48

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 2215 at net/xfrm/xfrm_state.c:2336 xfrm_state_fini+0x1f1/0x260 net/xfrm/xfrm_state.c:2336
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 2215 Comm: kworker/u4:3 Not tainted 4.14.141 #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 panic+0x1f2/0x426 kernel/panic.c:182
 __warn.cold+0x2f/0x36 kernel/panic.c:546
 report_bug+0x216/0x254 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:177 [inline]
 fixup_bug arch/x86/kernel/traps.c:172 [inline]
 do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:xfrm_state_fini+0x1f1/0x260 net/xfrm/xfrm_state.c:2336
RSP: 0018:ffff8880a3e3fbe0 EFLAGS: 00010297
RAX: ffff8880a3e2a680 RBX: ffff88808e774040 RCX: 1ffff110147c55ee
RDX: 0000000000000000 RSI: ffff8880a3e2af50 RDI: ffff8880a3e2aefc
RBP: ffff8880a3e3fbf8 R08: ffff8880a3e2a680 R09: ffff8880a3e2af70
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808e775c80
R13: ffff8880a3e3fcf0 R14: ffffffff880b7c38 R15: dffffc0000000000
 xfrm_net_exit+0x25/0x70 net/xfrm/xfrm_policy.c:2857
 ops_exit_list.isra.0+0xaa/0x150 net/core/net_namespace.c:142
 cleanup_net+0x3ba/0x880 net/core/net_namespace.c:484
 process_one_work+0x863/0x1600 kernel/workqueue.c:2114
 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (193):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/05 17:30 linux-4.14.y 01fd1694b93c bf6bcce4 .config console log report syz C ci2-linux-4-14
2019/08/01 14:53 linux-4.14.y 10d6aa565d05 835dffe7 .config console log report syz C ci2-linux-4-14
2019/07/31 14:19 linux-4.14.y 10d6aa565d05 995b2a26 .config console log report syz C ci2-linux-4-14
2019/04/24 12:57 linux-4.14.y 68d7a45eec10 8e3c52b1 .config console log report syz C ci2-linux-4-14
2019/04/17 16:49 linux-4.14.y 58b454ebf81e b0e8efcb .config console log report syz ci2-linux-4-14
2019/09/14 04:42 linux-4.14.y e2cd24b62938 32d59357 .config console log report ci2-linux-4-14
2019/09/12 08:11 linux-4.14.y e2cd24b62938 0b7672ee .config console log report ci2-linux-4-14
2019/09/05 21:20 linux-4.14.y 01fd1694b93c bf6bcce4 .config console log report ci2-linux-4-14
2019/09/05 11:45 linux-4.14.y 01fd1694b93c 040fda58 .config console log report ci2-linux-4-14
2019/09/05 03:24 linux-4.14.y 01fd1694b93c 040fda58 .config console log report ci2-linux-4-14
2019/09/04 12:30 linux-4.14.y 01fd1694b93c d994512d .config console log report ci2-linux-4-14
2019/09/03 12:02 linux-4.14.y 01fd1694b93c 48448e71 .config console log report ci2-linux-4-14
2019/09/03 09:35 linux-4.14.y 01fd1694b93c 14544a56 .config console log report ci2-linux-4-14
2019/09/03 05:52 linux-4.14.y 01fd1694b93c 14544a56 .config console log report ci2-linux-4-14
2019/09/03 03:35 linux-4.14.y 01fd1694b93c 14544a56 .config console log report ci2-linux-4-14
2019/09/03 01:27 linux-4.14.y 01fd1694b93c 14544a56 .config console log report ci2-linux-4-14
2019/09/02 16:51 linux-4.14.y 01fd1694b93c 14544a56 .config console log report ci2-linux-4-14
2019/09/02 13:49 linux-4.14.y 01fd1694b93c db7c31ca .config console log report ci2-linux-4-14
2019/09/01 23:31 linux-4.14.y 01fd1694b93c bad3cce2 .config console log report ci2-linux-4-14
2019/09/01 13:16 linux-4.14.y 01fd1694b93c bad3cce2 .config console log report ci2-linux-4-14
2019/09/01 11:57 linux-4.14.y 01fd1694b93c bad3cce2 .config console log report ci2-linux-4-14
2019/09/01 02:19 linux-4.14.y 01fd1694b93c bad3cce2 .config console log report ci2-linux-4-14
2019/08/31 01:51 linux-4.14.y 01fd1694b93c bcd7bcc2 .config console log report ci2-linux-4-14
2019/08/30 01:40 linux-4.14.y 01fd1694b93c cd626f3b .config console log report ci2-linux-4-14
2019/08/28 21:05 linux-4.14.y b5260801526c 1eb076e9 .config console log report ci2-linux-4-14
2019/08/27 19:27 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/27 14:44 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/27 10:28 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/27 05:43 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/27 04:21 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/26 19:48 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/26 14:45 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/26 13:36 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/26 10:32 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/26 07:20 linux-4.14.y b5260801526c d21c5d9d .config console log report ci2-linux-4-14
2019/08/24 21:33 linux-4.14.y 45f092f9e9cb d21c5d9d .config console log report ci2-linux-4-14
2019/08/24 20:14 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/24 16:17 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/24 12:25 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/24 05:07 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/23 19:33 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/23 14:24 linux-4.14.y 45f092f9e9cb 78ded196 .config console log report ci2-linux-4-14
2019/08/20 16:29 linux-4.14.y 45f092f9e9cb cfc9868f .config console log report ci2-linux-4-14
2019/08/19 17:15 linux-4.14.y 45f092f9e9cb ae348fb7 .config console log report ci2-linux-4-14
2019/08/19 05:33 linux-4.14.y 45f092f9e9cb b8ceabfc .config console log report ci2-linux-4-14
2019/08/19 03:41 linux-4.14.y 45f092f9e9cb b8ceabfc .config console log report ci2-linux-4-14
2019/08/18 11:40 linux-4.14.y 45f092f9e9cb 55bf8926 .config console log report ci2-linux-4-14
2019/08/17 15:10 linux-4.14.y 45f092f9e9cb 55bf8926 .config console log report ci2-linux-4-14
2019/04/12 14:54 linux-4.14.y 1ec8f1f0bffe 4f421599 .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.