syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1281]
≡ Subsystems
🐞 Fixed [7228]
🐞 Invalid [19105]
⬇ Missing Backports [222]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

BUG: using smp_processor_id() in preemptible code in cpu_mt

Status: upstream: reported on 2026/05/19 11:56
Subsystems: netfilter
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+690d3e3ffa7335ac10eb@syzkaller.appspotmail.com
Fix commit: c376f07e16c0 netfilter: xt_cpu: prefer raw_smp_processor_id
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm]
First crash: 65d, last: 30d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
a50d30b8-8ed3-43e7-95de-eaacd34e02ca assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: using smp_processor_id() in preemptible code in cpu_mt 2026/05/15 18:34 2026/05/15 18:34 2026/05/15 19:06 efdaf0f9b8bfc56ea6d17bea15a64f4591cc712d 

			
				
	

	
	



			

		

	

	
	

		

			▶
			▼
			Discussions (3)
		

		

			
			
			



	
	

		Title
		Replies (including bot)
		Last reply
	

	
	
	
		

			[PATCH net 04/10] netfilter: xt_cpu: prefer raw_smp_processor_id
			2 (2)
			2026/05/22 11:06
		

	
		

			[PATCH nf] netfilter: xt_cpu: prefer raw_smp_processor_id
			4 (4)
			2026/05/22 10:31
		

	
		

			[syzbot] [netfilter?] BUG: using smp_processor_id() in preemptible code in cpu_mt
			0 (1)
			2026/05/19 11:56
		

	
	




			
			
		

	

	

	
	
Sample crash report:

	
BUG: using smp_processor_id() in preemptible [00000000] code: syz.1.869/9584
caller is cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37
CPU: 0 UID: 0 PID: 9584 Comm: syz.1.869 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 check_preemption_disabled+0xd3/0xe0 lib/smp_processor_id.c:47
 cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37
 __nft_match_eval net/netfilter/nft_compat.c:412 [inline]
 nft_match_eval+0x1ad/0x2b0 net/netfilter/nft_compat.c:442
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 nft_do_chain+0x48d/0x1ad0 net/netfilter/nf_tables_core.c:285
 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:273
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:534
 __tcp_transmit_skb+0x2d18/0x47c0 net/ipv4/tcp_output.c:1716
 tcp_transmit_skb net/ipv4/tcp_output.c:1733 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:4284 [inline]
 tcp_connect+0x3486/0x53c0 net/ipv4/tcp_output.c:4373
 tcp_v4_connect+0x1051/0x1950 net/ipv4/tcp_ipv4.c:345
 __inet_stream_connect+0x258/0xe00 net/ipv4/af_inet.c:684
 tcp_sendmsg_fastopen+0x3af/0x5f0 net/ipv4/tcp.c:1086
 tcp_sendmsg_locked+0x4cdc/0x55c0 net/ipv4/tcp.c:1182
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1452
 sock_sendmsg_nosec net/socket.c:788 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x853/0xa20 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd2dd9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd2ec3d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007efd2e015fa0 RCX: 00007efd2dd9ce59
RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007efd2de32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efd2e016038 R14: 00007efd2e015fa0 R15: 00007fffdaffa118
 </TASK>
BUG: using smp_processor_id() in preemptible [00000000] code: syz.1.869/9584
caller is cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37
CPU: 1 UID: 0 PID: 9584 Comm: syz.1.869 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 check_preemption_disabled+0xd3/0xe0 lib/smp_processor_id.c:47
 cpu_mt+0x53/0xd0 net/netfilter/xt_cpu.c:37
 __nft_match_eval net/netfilter/nft_compat.c:412 [inline]
 nft_match_eval+0x1ad/0x2b0 net/netfilter/nft_compat.c:442
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 nft_do_chain+0x48d/0x1ad0 net/netfilter/nf_tables_core.c:285
 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:273
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 nf_send_reset+0xd47/0x14d0 net/ipv4/netfilter/nf_reject_ipv4.c:337
 nft_reject_inet_eval+0x3b2/0x690 net/netfilter/nft_reject_inet.c:31
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 nft_do_chain+0x48d/0x1ad0 net/netfilter/nf_tables_core.c:285
 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
 nf_hook+0x22a/0x3a0 include/linux/netfilter.h:273
 __ip_local_out+0x558/0x6a0 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x190 net/ipv4/ip_output.c:129
 __ip_queue_xmit+0x10df/0x1b10 net/ipv4/ip_output.c:534
 __tcp_transmit_skb+0x2d18/0x47c0 net/ipv4/tcp_output.c:1716
 tcp_transmit_skb net/ipv4/tcp_output.c:1733 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:4284 [inline]
 tcp_connect+0x3486/0x53c0 net/ipv4/tcp_output.c:4373
 tcp_v4_connect+0x1051/0x1950 net/ipv4/tcp_ipv4.c:345
 __inet_stream_connect+0x258/0xe00 net/ipv4/af_inet.c:684
 tcp_sendmsg_fastopen+0x3af/0x5f0 net/ipv4/tcp.c:1086
 tcp_sendmsg_locked+0x4cdc/0x55c0 net/ipv4/tcp.c:1182
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1452
 sock_sendmsg_nosec net/socket.c:788 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x853/0xa20 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efd2dd9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd2ec3d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007efd2e015fa0 RCX: 00007efd2dd9ce59
RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007efd2de32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efd2e016038 R14: 00007efd2e015fa0 R15: 00007fffdaffa118
 </TASK>



	

	



	Crashes (4):
		
		

			Time
			Kernel
			Commit
			Syzkaller
			Config
			Log
			Report
			Syz repro
			C repro
			VM info
			Assets (help?)
			Manager
			Title
		

		
		
		
		

			2026/06/14 10:22
			bpf-next
			7bfb93e3475b
			1d2f3589
			.config
			console log
			report
			
			
			info
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-bpf-next-kasan-gce
			BUG: using smp_processor_id() in preemptible code in cpu_mt
		

		
		

			2026/05/17 11:58
			bpf-next
			50d00ea66086
			de5aae85
			.config
			console log
			report
			
			
			info
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-bpf-next-kasan-gce
			BUG: using smp_processor_id() in preemptible code in cpu_mt
		

		
		

			2026/05/13 12:17
			bpf-next
			6318f11d53a3
			fec2a7ee
			.config
			console log
			report
			
			
			info
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-bpf-next-kasan-gce
			BUG: using smp_processor_id() in preemptible code in cpu_mt
		

		
		

			2026/05/10 05:39
			bpf-next
			2ca6723a5f7b
			29233ece
			.config
			console log
			report
			
			
			info
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-bpf-next-kasan-gce
			BUG: using smp_processor_id() in preemptible code in cpu_mt
		

		
		


* Struck through repros no longer work on HEAD.