syzbot
kernel BUG in net_dm_packet_work (2)
Status:
upstream: reported on 2026/09/11 11:45
Subsystems:
net
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+586af68eb819833c2d91@syzkaller.appspotmail.com
Fix commit:
a5117e1eccac
net: skbuff: do not leave stale header offsets after pskb_carve()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 35d, last: 14d
Sample crash report:
skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag: 00000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag: 00000110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
skb frag: 00000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
------------[ cut here ]------------
kernel BUG at ./include/linux/skbuff.h:2830!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 5708 Comm: kworker/0:5 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events net_dm_packet_work
RIP: 0010:__skb_pull include/linux/skbuff.h:2830 [inline]
RIP: 0010:skb_pull_inline include/linux/skbuff.h:2837 [inline]
RIP: 0010:skb_pull+0x1c4/0x1d0 net/core/skbuff.c:2677
Code: b7 11 f9 8b 44 24 04 89 43 70 48 c7 c7 60 88 71 8c 89 ee e8 7e 6b 06 f8 48 c7 c7 a0 88 71 8c 48 89 de 31 d2 e8 ad fb fe ff 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900062f7800 EFLAGS: 00010282
RAX: ffffffff89200950 RBX: ffff88806c8e0000 RCX: ffff888025da1f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000fe R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10170c490b R12: 000000000000401d
R13: dffffc0000000000 R14: 1ffff1100d91c00e R15: 0000000000003f1f
FS: 0000000000000000(0000) GS:ffff888125bc3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31e0fff8 CR3: 0000000060ece000 CR4: 00000000003526f0
Call Trace:
<TASK>
net_dm_packet_report net/core/drop_monitor.c:699 [inline]
net_dm_packet_work+0x52c/0x14b0 net/core/drop_monitor.c:738
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__skb_pull include/linux/skbuff.h:2830 [inline]
RIP: 0010:skb_pull_inline include/linux/skbuff.h:2837 [inline]
RIP: 0010:skb_pull+0x1c4/0x1d0 net/core/skbuff.c:2677
Code: b7 11 f9 8b 44 24 04 89 43 70 48 c7 c7 60 88 71 8c 89 ee e8 7e 6b 06 f8 48 c7 c7 a0 88 71 8c 48 89 de 31 d2 e8 ad fb fe ff 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc900062f7800 EFLAGS: 00010282
RAX: ffffffff89200950 RBX: ffff88806c8e0000 RCX: ffff888025da1f40
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00000000000000fe R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed10170c490b R12: 000000000000401d
R13: dffffc0000000000 R14: 1ffff1100d91c00e R15: 0000000000003f1f
FS: 0000000000000000(0000) GS:ffff888125bc3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055759558dee8 CR3: 000000002cfb0000 CR4: 00000000003526f0
* Struck through repros no longer work on HEAD.