WARNING in ip_rt_bug

Status: upstream: reported C repro on 2020/04/03 11:53
Reported-by: syzbot+a3147d7c24d82b894fc2@syzkaller.appspotmail.com
First crash: 2316d, last: 1768d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 WARNING in ip_rt_bug -1 syz, C inconclusive 1 2244d 2304d 0/1 upstream: reported C repro on 2020/04/15 03:43
linux-6.1 WARNING in ip_rt_bug (2) -1 1 854d 854d 0/3 auto-obsoleted due to no activity on 2024/07/13 04:22
linux-6.1 WARNING in ip_rt_bug -1 1 1085d 1085d 0/3 auto-obsoleted due to no activity on 2023/11/25 06:32
upstream WARNING in ip_rt_bug (2) net -1 syz, C done error 612 92d 1394d 29/29 fixed on 2026/05/06 16:40
linux-5.15 WARNING in ip_rt_bug -1 7 458d 577d 0/3 auto-obsoleted due to no activity on 2025/08/13 17:11
linux-6.6 WARNING in ip_rt_bug -1 1 224d 224d 0/2 auto-obsoleted due to no activity on 2026/04/04 15:30
upstream WARNING in ip_rt_bug (3) prio:high net -1 syz, C error 54 68d 79d 29/29 fixed on 2026/07/15 08:27
upstream WARNING in ip_rt_bug net -1 1 3049d 3041d 0/29 auto-closed as invalid on 2019/02/22 10:34
linux-6.1 WARNING in ip_rt_bug (4) origin:lts-only -1 syz, C inconclusive 5 124d 332d 0/3 upstream: reported C repro on 2025/09/08 02:20
linux-6.1 WARNING in ip_rt_bug (3) -1 26 426d 593d 0/3 auto-obsoleted due to no activity on 2025/09/07 04:48
▶ ▼ Fix bisection attempts (19)
Created Duration User Patch Repo Result
2021/11/02 13:35 18m bisect fix linux-4.19.y error job log
2021/10/03 13:03 31m bisect fix linux-4.19.y OK (0) job log log
2021/09/03 11:20 31m bisect fix linux-4.19.y OK (0) job log log
2021/08/04 10:50 30m bisect fix linux-4.19.y OK (0) job log log
2021/06/28 08:19 31m bisect fix linux-4.19.y OK (0) job log log
2021/05/29 07:50 29m bisect fix linux-4.19.y OK (0) job log log
2021/04/29 07:23 27m bisect fix linux-4.19.y OK (0) job log log
2021/03/30 06:59 23m bisect fix linux-4.19.y OK (0) job log log
2021/02/28 06:34 25m bisect fix linux-4.19.y OK (0) job log log
2021/01/29 06:06 27m bisect fix linux-4.19.y OK (0) job log log
2020/12/30 01:01 24m bisect fix linux-4.19.y OK (0) job log log
2020/11/29 15:41 25m bisect fix linux-4.19.y OK (0) job log log
2020/10/30 15:17 24m bisect fix linux-4.19.y OK (0) job log log
2020/09/30 14:51 25m bisect fix linux-4.19.y OK (0) job log log
2020/08/31 14:24 26m bisect fix linux-4.19.y OK (0) job log log
2020/08/01 13:57 27m bisect fix linux-4.19.y OK (0) job log log
2020/07/02 13:33 24m bisect fix linux-4.19.y OK (0) job log log
2020/06/02 13:08 24m bisect fix linux-4.19.y OK (0) job log log
2020/05/03 12:38 29m bisect fix linux-4.19.y OK (0) job log log

Sample crash report:
syz-executor852 uses obsolete (PF_INET,SOCK_PACKET)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6458 at net/ipv4/route.c:1236 ip_rt_bug+0x1d/0x30 net/ipv4/route.c:1236
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 6458 Comm: syz-executor852 Not tainted 4.19.114-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 panic+0x26a/0x50e kernel/panic.c:186
 __warn.cold+0x20/0x46 kernel/panic.c:541
 report_bug+0x262/0x2a0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:ip_rt_bug+0x1d/0x30 net/ipv4/route.c:1236
Code: a5 fb e9 63 ff ff ff 66 0f 1f 44 00 00 55 48 89 d5 e8 47 e0 6f fb 48 89 ef e8 df 4b a0 ff 48 c7 c7 40 af 11 88 e8 7c fd 5a fb <0f> 0b 31 c0 5d c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 41 54 49
RSP: 0018:ffff8880a6667330 EFLAGS: 00010282
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8152d3a1 RDI: ffffed1014ccce58
RBP: ffff88809f0b1a00 R08: 0000000000000024 R09: ffffed1015ce5079
R10: ffffed1015ce5078 R11: ffff8880ae7283c7 R12: ffff88809e0b4100
R13: ffff88809f0b1a00 R14: ffff8880a623a600 R15: ffff88809f0b1a58
 dst_output include/net/dst.h:447 [inline]
 ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:124
 ip_send_skb+0x3e/0xe0 net/ipv4/ip_output.c:1446
 ip_push_pending_frames+0x5f/0x80 net/ipv4/ip_output.c:1466
 icmp_push_reply+0x3b8/0x530 net/ipv4/icmp.c:395
 __icmp_send+0xcb6/0x14a0 net/ipv4/icmp.c:744
 icmp_send include/net/icmp.h:47 [inline]
 ip_options_compile+0xad/0xf0 net/ipv4/ip_options.c:485
 ip_rcv_options net/ipv4/ip_input.c:282 [inline]
 ip_rcv_finish_core.isra.0+0x67f/0x1a90 net/ipv4/ip_input.c:356
 ip_rcv_finish+0x142/0x2e0 net/ipv4/ip_input.c:412
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 ip_rcv+0xd0/0x3d0 net/ipv4/ip_input.c:524
 __netif_receive_skb_one_core+0xf5/0x160 net/core/dev.c:4947
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5059
 netif_receive_skb_internal+0xf9/0x400 net/core/dev.c:5149
 tun_rx_batched.isra.0+0x483/0x7d0 drivers/net/tun.c:1535
 tun_get_user+0x1359/0x4930 drivers/net/tun.c:1960
 tun_chr_write_iter+0xb0/0x147 drivers/net/tun.c:1989
 call_write_iter include/linux/fs.h:1821 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x512/0x760 fs/read_write.c:487
 vfs_write+0x206/0x550 fs/read_write.c:549
 ksys_write+0x12b/0x2a0 fs/read_write.c:599
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440699
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc6bd7ff98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440699
RDX: 000000000000100c RSI: 0000000020000240 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000002c00 R09: 00007ffc0000000d
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401f20
R13: 0000000000401fb0 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/04/03 11:52 linux-4.19.y dda0e2920330 5ed396e6 .config console log report syz C ci2-linux-4-19
2021/07/05 10:49 linux-4.19.y 9f84340f012e 55aa55c2 .config console log report info ci2-linux-4-19 WARNING in ip_rt_bug
* Struck through repros no longer work on HEAD.