BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all

Status: upstream: reported on 2024/06/04 09:15
Reported-by: syzbot+8613615616552a1b83b8@syzkaller.appspotmail.com
First crash: 782d, last: 1h30m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all 10 3 737d 796d 0/3 auto-obsoleted due to no activity on 2024/10/26 12:47
linux-5.15 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all (2) 10 30 345d 634d 0/3 auto-obsoleted due to no activity on 2025/11/22 19:01
upstream KASAN: slab-use-after-free Read in bq_xmit_all bpf net 19 C done 29 723d 737d 27/29 fixed on 2024/08/23 02:59

Sample crash report:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
  ESR = 0x0000000086000006
  EC = 0x21: IABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
user pgtable: 4k pages, 48-bit VAs, pgdp=000000012bc98000
[0000000000000000] pgd=0800000144213003, p4d=0800000144213003, pud=0800000141951003, pmd=0000000000000000
Internal error: Oops: 0000000086000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 7292 Comm: syz.0.978 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 22400805 (nzCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=-c)
pc : 0x0
lr : bond_xdp_xmit+0x284/0x480 drivers/net/bonding/bond_main.c:5675
sp : ffff800021d57220
x29: ffff800021d572e0 x28: ffff800021d57248 x27: dfff800000000000
x26: ffff7000043aae50 x25: ffff800012fd2a18 x24: ffff0000f4600000
x23: fffffbffeffb8d90 x22: ffff0000df6b4000 x21: fffffbffeffb8d90
x20: 0000000000000001 x19: 0000000000000000 x18: 0000000000080000
x17: 0000000000000f34 x16: ffff8000082dbd38 x15: ffff80002290a000
x14: 0000000000000001 x13: 000000000001e808 x12: 0000000000000001
x11: ff0080000c7a5ec8 x10: 0000000000000003 x9 : ffff800021d57280
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000001
x2 : ffff800021d572a0 x1 : 0000000000000001 x0 : ffff0000f4600000
Call trace:
 0x0
 bq_xmit_all+0xb0c/0xf8c kernel/bpf/devmap.c:392
 __dev_flush+0xc4/0x18c kernel/bpf/devmap.c:422
 xdp_do_flush+0x14/0x28 net/core/filter.c:4278
 xdp_test_run_batch net/bpf/test_run.c:332 [inline]
 bpf_test_run_xdp_live+0x11b0/0x1610 net/bpf/test_run.c:362
 bpf_prog_test_run_xdp+0x618/0xd10 net/bpf/test_run.c:1457
 bpf_prog_test_run+0x2dc/0x36c kernel/bpf/syscall.c:3695
 __sys_bpf+0x504/0x660 kernel/bpf/syscall.c:5050
 __do_sys_bpf kernel/bpf/syscall.c:5136 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5134 [inline]
 __arm64_sys_bpf+0x80/0x98 kernel/bpf/syscall.c:5134
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: bad PC value
---[ end trace 0000000000000000 ]---

Crashes (181):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/26 07:45 linux-6.1.y dc5c83b7f5f8 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/07/04 02:02 linux-6.1.y fdb6fcb41cc7 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/07/01 23:44 linux-6.1.y fdb6fcb41cc7 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/06/09 16:13 linux-6.1.y 228da13e907e c36c07f6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/06/06 12:35 linux-6.1.y 228da13e907e cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/06/05 16:17 linux-6.1.y 228da13e907e 48b6c3fa .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/27 01:03 linux-6.1.y dcbcab9d7079 2b01f00e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/25 18:02 linux-6.1.y dcbcab9d7079 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/23 16:55 linux-6.1.y dcbcab9d7079 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/22 23:31 linux-6.1.y c27210688955 5f091fcc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/22 17:33 linux-6.1.y c27210688955 5f091fcc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/21 16:06 linux-6.1.y c27210688955 e195359d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/19 14:24 linux-6.1.y c27210688955 223544dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/17 01:05 linux-6.1.y c27210688955 de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/16 00:57 linux-6.1.y c27210688955 81fb92f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/16 00:57 linux-6.1.y c27210688955 81fb92f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/15 19:23 linux-6.1.y c27210688955 9cd3beaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/15 01:11 linux-6.1.y ad16b162f21d 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/14 01:00 linux-6.1.y ad16b162f21d 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/13 13:11 linux-6.1.y ad16b162f21d fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/12 23:58 linux-6.1.y ad16b162f21d a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/12 12:03 linux-6.1.y ad16b162f21d 07aeade5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/11 23:18 linux-6.1.y ad16b162f21d d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/10 05:20 linux-6.1.y 128a674368bf 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/09 19:05 linux-6.1.y 128a674368bf 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/07 16:09 linux-6.1.y 4931e0e1673d cbf9e0fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/05/02 23:30 linux-6.1.y 4931e0e1673d a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/04/30 04:43 linux-6.1.y 7c87defbd336 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/04/07 09:56 linux-6.1.y 1989cd3d56e2 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/03/20 01:50 linux-6.1.y f2ddafa93a25 bd6dcb30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/03/07 20:31 linux-6.1.y f2ddafa93a25 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/03/07 04:26 linux-6.1.y f2ddafa93a25 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/25 02:53 linux-6.1.y 779f9571ac3e 787dfb7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/20 21:58 linux-6.1.y 779f9571ac3e 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/20 09:29 linux-6.1.y 779f9571ac3e 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/19 21:25 linux-6.1.y 779f9571ac3e c8d8c52d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/18 20:12 linux-6.1.y 8ce36b2849ef 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/17 19:32 linux-6.1.y 8ce36b2849ef 06ec4f7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/13 20:08 linux-6.1.y 8ce36b2849ef 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/13 07:55 linux-6.1.y 8ce36b2849ef 6a673c50 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/12 19:29 linux-6.1.y 8ce36b2849ef 504cb1bf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2026/02/11 19:02 linux-6.1.y 8ce36b2849ef 75707236 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
2024/06/04 09:14 linux-6.1.y 88690811da69 a1feae05 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: unable to handle kernel NULL pointer dereference in bq_xmit_all
* Struck through repros no longer work on HEAD.