syzbot
WARNING in udp_v6_send_skb
Status:
upstream: reported on 2026/07/30 00:10
Subsystems:
net
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
Fix commit:
b83641e0ab8b
net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
0ae10b6be49b
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-rust-kasan-gce ci2-upstream-usb]
First crash: 57d, last: 22h45m
Sample crash report:
------------[ cut here ]------------
len >= 65536u
WARNING: ./include/linux/udp.h:49 at udp_set_len_short include/linux/udp.h:49 [inline], CPU#1: syz.2.512/8338
WARNING: ./include/linux/udp.h:49 at udp_v6_send_skb+0xf0f/0x13c0 net/ipv6/udp.c:1388, CPU#1: syz.2.512/8338
Modules linked in:
CPU: 1 UID: 0 PID: 8338 Comm: syz.2.512 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:udp_set_len_short include/linux/udp.h:49 [inline]
RIP: 0010:udp_v6_send_skb+0xf0f/0x13c0 net/ipv6/udp.c:1388
Code: 0b 90 49 8d af ff ff 00 00 48 89 e8 4c 29 f0 41 29 c5 44 89 6c 24 1c 45 8d 7d f8 90 0f 0b 90 e9 4a f2 ff ff e8 f2 b2 89 f7 90 <0f> 0b 90 e9 29 f3 ff ff e8 e4 b2 89 f7 89 de bf 97 ff ff ff e8 48
RSP: 0018:ffffc90003977910 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000001ffb4 RCX: 0000000000000000
RDX: ffff888028e94b00 RSI: ffffffff8a81aede RDI: ffff888028e94b00
RBP: ffff888023f3f780 R08: 0000000000000005 R09: 000000000000ffff
R10: 000000000001ffb4 R11: 0000000000000000 R12: ffff88802429f208
R13: 000000000000200e R14: ffff888023f3f758 R15: 000000000001ffac
FS: 0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f538bb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007fc2665ea6b0 CR3: 000000002911b000 CR4: 0000000000352ef0
Call Trace:
<TASK>
udp_v6_push_pending_frames+0x96/0x160 net/ipv6/udp.c:1464
udpv6_sendmsg+0x1d17/0x2c20 net/ipv6/udp.c:1753
inet6_sendmsg+0x105/0x140 net/ipv6/af_inet6.c:641
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:815 [inline]
__sys_sendto+0x36d/0x4e0 net/socket.c:2281
__do_sys_sendto net/socket.c:2288 [inline]
__se_sys_sendto net/socket.c:2284 [inline]
__ia32_sys_sendto+0xdd/0x1b0 net/socket.c:2284
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
__do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf6fdefec
Code: Unable to access opcode bytes at 0xf6fdefc2.
RSP: 002b:00000000f538b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000004010 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
* Struck through repros no longer work on HEAD.