syzbot
kernel BUG in pskb_expand_head (2)
Status:
upstream: reported C repro on 2025/07/18 14:25
Bug presence:
origin:lts-only
[Documentation on labels]
Reported-by: syzbot+49fbf22a9769a1d5038e@syzkaller.appspotmail.com
Fix commit:
5ca2e29f6834
bpf, sockmap: Fix panic when calling skb_linearize
Patched on: [ci2-linux-5-15-kasan ci2-linux-5-15-kasan-perf], missing on: [ci2-linux-5-15-kasan-arm64]
First crash: 373d, last: 340d
Sample crash report:
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:1703!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 1107 Comm: kworker/1:2 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events sk_psock_backlog
RIP: 0010:pskb_expand_head+0x10c1/0x10f0 net/core/skbuff.c:1703
Code: 7d ec f9 e9 32 f4 ff ff e8 7c 1a a8 f9 4c 89 ef 48 c7 c6 20 3c fe 8a e8 3d 85 da f9 0f 0b e8 66 1a a8 f9 0f 0b e8 5f 1a a8 f9 <0f> 0b 48 8b 0c 24 80 e1 07 80 c1 03 38 c1 0f 8c bf fa ff ff 48 8b
RSP: 0018:ffffc900049278f0 EFLAGS: 00010293
RAX: ffffffff87cfa9c1 RBX: 0000000000000ec0 RCX: ffff888020ba5940
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed1003fdd694
R10: ffffed1003fdd694 R11: 1ffff11003fdd693 R12: 0000000000008080
R13: ffff88801feeb49c R14: 0000000000000002 R15: 0000000000000a20
FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f56d40e42c5 CR3: 000000001ec59000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<TASK>
__pskb_pull_tail+0xb6/0x1530 net/core/skbuff.c:2257
__skb_linearize include/linux/skbuff.h:3508 [inline]
skb_linearize include/linux/skbuff.h:3520 [inline]
sk_psock_skb_ingress_enqueue+0x67/0x690 net/core/skmsg.c:537
sk_psock_skb_ingress net/core/skmsg.c:581 [inline]
sk_psock_handle_skb net/core/skmsg.c:619 [inline]
sk_psock_backlog+0xaef/0x1330 net/core/skmsg.c:676
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Modules linked in:
---[ end trace 0eb286dea0e421a8 ]---
RIP: 0010:pskb_expand_head+0x10c1/0x10f0 net/core/skbuff.c:1703
Code: 7d ec f9 e9 32 f4 ff ff e8 7c 1a a8 f9 4c 89 ef 48 c7 c6 20 3c fe 8a e8 3d 85 da f9 0f 0b e8 66 1a a8 f9 0f 0b e8 5f 1a a8 f9 <0f> 0b 48 8b 0c 24 80 e1 07 80 c1 03 38 c1 0f 8c bf fa ff ff 48 8b
RSP: 0018:ffffc900049278f0 EFLAGS: 00010293
RAX: ffffffff87cfa9c1 RBX: 0000000000000ec0 RCX: ffff888020ba5940
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed1003fdd694
R10: ffffed1003fdd694 R11: 1ffff11003fdd693 R12: 0000000000008080
R13: ffff88801feeb49c R14: 0000000000000002 R15: 0000000000000a20
FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbd29e0d198 CR3: 000000002a18d000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
* Struck through repros no longer work on HEAD.