syzbot


WARNING in __alloc_skb

Status: fixed on 2021/04/09 19:46
Subsystems: arm-msm net
[Documentation on labels]
Reported-by: syzbot+80dccaee7c6630fa9dcf@syzkaller.appspotmail.com
Fix commit: 093b036aa94e net/qrtr: fix __netdev_alloc_skb call
First crash: 1393d, last: 1366d
Cause bisection: failed (error log, bisect log)
  
Discussions (8)
Title Replies (including bot) Last reply
[PATCH 5.11 000/120] 5.11.9-rc1 review 132 (132) 2021/04/02 09:27
[PATCH 5.10 000/157] 5.10.26-rc1 review 167 (167) 2021/03/24 14:28
[PATCH 4.14 00/43] 4.14.227-rc1 review 47 (47) 2021/03/24 00:56
[PATCH 4.9 00/25] 4.9.263-rc1 review 29 (29) 2021/03/23 13:12
[PATCH 4.19 00/43] 4.19.183-rc1 review 48 (48) 2021/03/23 10:31
[PATCH 5.4 00/60] 5.4.108-rc1 review 65 (65) 2021/03/23 10:20
[PATCH] net/core/skbuff.c: __netdev_alloc_skb fix when len is greater than KMALLOC_MAX_SIZE 17 (17) 2021/03/01 21:30
WARNING in __alloc_skb 0 (1) 2021/02/25 16:58
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __alloc_skb (3) ppp C 2 304d 304d 25/28 fixed on 2024/03/29 01:33
linux-6.1 WARNING in __alloc_skb origin:upstream C done 2 392d 392d 3/3 fixed on 2023/12/11 10:30
upstream WARNING in __alloc_skb (2) ppp C done 2 375d 389d 25/28 fixed on 2024/01/20 21:18
Last patch testing requests (3)
Created Duration User Patch Repo Result
2021/02/28 22:56 18m paskripkin@gmail.com https://linux.googlesource.com/linux/kernel/git/torvalds/linux refs/changes/99/8699/1 OK
2021/02/26 14:50 17m paskripkin@gmail.com https://linux.googlesource.com/linux/kernel/git/torvalds/linux refs/changes/56/8656/1 OK
2021/02/26 09:59 0m paskripkin@gmail.com https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/ 2c096ed0ecfb84913f2c08c4fdf017cac33b6761 error
Cause bisection attempts (2)
Created Duration User Patch Repo Result
2021/02/20 19:05 8h01m bisect upstream error job log
2021/02/11 14:45 0m bisect upstream error job log

Sample crash report:
netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8482 at mm/page_alloc.c:4979 __alloc_pages_nodemask+0x5f8/0x730 mm/page_alloc.c:5014
Modules linked in:
CPU: 0 PID: 8482 Comm: syz-executor948 Not tainted 5.11.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__alloc_pages_nodemask+0x5f8/0x730 mm/page_alloc.c:4979
Code: 00 00 0c 00 0f 85 a7 00 00 00 8b 3c 24 4c 89 f2 44 89 e6 c6 44 24 70 00 48 89 6c 24 58 e8 d0 d7 ff ff 49 89 c5 e9 ea fc ff ff <0f> 0b e9 b5 fd ff ff 89 74 24 14 4c 89 4c 24 08 4c 89 74 24 18 e8
RSP: 0018:ffffc90001777aa0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff920002eef58 RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000060a20
RBP: 0000000000020a20 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff86f1b13e R11: 0000000000000000 R12: 000000000000000b
R13: 0000000000400180 R14: 0000000000060a20 R15: ffff888018932dc0
FS:  000000000192b300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020400000 CR3: 0000000025ae7000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __alloc_pages include/linux/gfp.h:511 [inline]
 __alloc_pages_node include/linux/gfp.h:524 [inline]
 alloc_pages_node include/linux/gfp.h:538 [inline]
 kmalloc_large_node+0x60/0x110 mm/slub.c:3999
 __kmalloc_node_track_caller+0x319/0x3f0 mm/slub.c:4496
 __kmalloc_reserve net/core/skbuff.c:150 [inline]
 __alloc_skb+0x4e4/0x5a0 net/core/skbuff.c:210
 __netdev_alloc_skb+0x70/0x400 net/core/skbuff.c:446
 netdev_alloc_skb include/linux/skbuff.h:2832 [inline]
 qrtr_endpoint_post+0x84/0x11b0 net/qrtr/qrtr.c:442
 qrtr_tun_write_iter+0x11f/0x1a0 net/qrtr/tun.c:98
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write+0x426/0x650 fs/read_write.c:518
 vfs_write+0x791/0xa30 fs/read_write.c:605
 ksys_write+0x12d/0x250 fs/read_write.c:658
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x442fe9
Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc007c27a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ffc007c27b8 RCX: 0000000000442fe9
RDX: 0000000000400000 RSI: 0000000020000040 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc007c27c0
R13: 00007ffc007c27e0 R14: 00000000004b8018 R15: 00000000004004b8

Crashes (24):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/11 14:45 upstream 291009f656e8 a52ee10a .config console log report syz C ci-upstream-kasan-gce WARNING in __alloc_skb
2021/03/09 16:47 upstream 144c79ef3353 09fbf400 .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/03/04 01:18 upstream f69d02e37a85 06ed56cd .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/03/03 09:14 upstream 7a7fd0de4a98 e5b64d68 .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/03/01 03:02 upstream cd278456d4ca 4c37c133 .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/03/01 02:49 upstream cd278456d4ca 4c37c133 .config console log report info ci-upstream-kasan-gce-smack-root WARNING in __alloc_skb
2021/03/01 01:41 upstream cd278456d4ca 4c37c133 .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/02/25 06:36 upstream 719bbd4a509f fcc6d71b .config console log report info ci-upstream-kasan-gce-smack-root WARNING in __alloc_skb
2021/02/17 17:15 upstream f40ddce88593 052f8d9f .config console log report info ci-upstream-kasan-gce-smack-root WARNING in __alloc_skb
2021/02/17 17:14 upstream f40ddce88593 052f8d9f .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/02/17 17:10 upstream f40ddce88593 052f8d9f .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/02/14 23:13 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/02/14 22:54 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/02/14 22:48 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce-smack-root WARNING in __alloc_skb
2021/02/14 22:47 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/02/14 22:34 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce-root WARNING in __alloc_skb
2021/02/14 22:24 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/02/13 02:02 upstream dcc0b49040c7 98682e5e .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/02/11 14:25 upstream 291009f656e8 a52ee10a .config console log report info ci-upstream-kasan-gce WARNING in __alloc_skb
2021/03/01 02:02 upstream 06d5d309a3f1 4c37c133 .config console log report info ci-upstream-kasan-gce-386 WARNING in __alloc_skb
2021/02/17 17:15 upstream f40ddce88593 052f8d9f .config console log report info ci-upstream-kasan-gce-386 WARNING in __alloc_skb
2021/02/17 17:10 upstream f40ddce88593 052f8d9f .config console log report info ci-qemu-upstream-386 WARNING in __alloc_skb
2021/02/14 22:56 upstream 358feceebbf6 98682e5e .config console log report info ci-upstream-kasan-gce-386 WARNING in __alloc_skb
2021/03/01 01:42 linux-next d01f2f7e3557 4c37c133 .config console log report info ci-upstream-linux-next-kasan-gce-root WARNING in __alloc_skb
* Struck through repros no longer work on HEAD.