syzbot |
sign-in | mailing list | source | docs |
------------[ cut here ]------------ WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 kfree_skb include/linux/skbuff.h:1232 [inline] WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 ip_rt_bug+0x29/0x100 net/ipv4/route.c:1282 Modules linked in: CPU: 0 PID: 7737 Comm: syz.4.347 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:ip_rt_bug+0x29/0x100 net/ipv4/route.c:1283 Code: 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 d3 e8 9b c0 a3 f8 66 90 e8 94 c0 a3 f8 48 89 df be 02 00 00 00 e8 97 86 7a ff <0f> 0b 31 c0 5b 41 5c 41 5d 41 5e 41 5f c3 f3 0f 1e fa 49 bd 00 00 RSP: 0000:ffffc90000007678 EFLAGS: 00010296 RAX: 3512b860b81f0d00 RBX: ffff8880244cdb40 RCX: 3512b860b81f0d00 RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80 RBP: ffff88807a041f00 R08: ffffffff90d9459f R09: 1ffffffff21b28b3 R10: dffffc0000000000 R11: fffffbfff21b28b4 R12: ffff88807a041f30 R13: ffff8880244cdb98 R14: ffff8880244cdb40 R15: ffff8881416a0d00 FS: 00007ff1428206c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffe70 CR3: 0000000075c0a000 CR4: 00000000003506f0 Call Trace: <IRQ> dst_output include/net/dst.h:467 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x12f/0x1d0 net/ipv4/ip_output.c:1491 __icmp_send+0xfc1/0x1320 net/ipv4/icmp.c:785 ipv4_send_dest_unreach net/ipv4/route.c:1263 [inline] ipv4_link_failure+0x64f/0xa20 net/ipv4/route.c:1270 dst_link_failure include/net/dst.h:437 [inline] arp_error_report+0x112/0x160 net/ipv4/arp.c:296 neigh_invalidate+0x22c/0x450 net/core/neighbour.c:1064 neigh_timer_handler+0x914/0xff0 net/core/neighbour.c:1151 call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701 expire_timers kernel/time/timer.c:1752 [inline] __run_timers+0x52d/0x7d0 kernel/time/timer.c:2023 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036 handle_softirqs+0x280/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:cap_vm_enough_memory+0x0/0x240 security/commoncap.c:1401 Code: ff e8 24 f0 ac fd be 01 00 00 00 48 c7 c7 e0 79 34 8d 4c 89 f2 e8 c0 64 79 00 e9 cc fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 <f3> 0f 1e fa 55 41 57 41 56 41 55 41 54 53 50 49 bd 00 00 00 00 00 RSP: 0000:ffffc90003946de8 EFLAGS: 00000246 RAX: 1ffffffff18f931c RBX: 0000000000000001 RCX: ffff888029305a00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88807d4c7200 RBP: 0000000000000001 R08: ffff888029305a00 R09: 0000000000000003 R10: 0000000000000003 R11: 0000000000000000 R12: ffffffff8c7c98e0 R13: dffffc0000000000 R14: ffff88807d4c7200 R15: ffffffff8c7c98c8 security_vm_enough_memory_mm+0x6b/0xa0 security/security.c:1035 shmem_acct_block mm/shmem.c:199 [inline] shmem_inode_acct_block+0xd8/0x460 mm/shmem.c:215 shmem_alloc_and_acct_folio+0xb2/0x630 mm/shmem.c:1697 shmem_get_folio_gfp+0xcde/0x2ac0 mm/shmem.c:2041 shmem_get_folio mm/shmem.c:2164 [inline] shmem_write_begin+0xf2/0x420 mm/shmem.c:2706 generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4031 shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883 __kernel_write_iter+0x274/0x670 fs/read_write.c:517 dump_emit_page fs/coredump.c:957 [inline] dump_user_range+0x3f6/0x800 fs/coredump.c:984 elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184 do_coredump+0x1755/0x2480 fs/coredump.c:833 get_signal+0x1133/0x1400 kernel/signal.c:2888 arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210 irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315 exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608 RIP: 0033:0x7ff14198f751 Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f RSP: 002b:fffffffffffffe70 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007ff141be6090 RCX: 00007ff14198f749 RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000 RBP: 00007ff141a13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ff141be6128 R14: 00007ff141be6090 R15: 00007ffef4762628 </TASK> ---------------- Code disassembly (best guess), 1 bytes skipped: 0: e8 24 f0 ac fd call 0xfdacf029 5: be 01 00 00 00 mov $0x1,%esi a: 48 c7 c7 e0 79 34 8d mov $0xffffffff8d3479e0,%rdi 11: 4c 89 f2 mov %r14,%rdx 14: e8 c0 64 79 00 call 0x7964d9 19: e9 cc fc ff ff jmp 0xfffffcea 1e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 25: 00 00 00 28: 90 nop * 29: f3 0f 1e fa endbr64 <-- trapping instruction 2d: 55 push %rbp 2e: 41 57 push %r15 30: 41 56 push %r14 32: 41 55 push %r13 34: 41 54 push %r12 36: 53 push %rbx 37: 50 push %rax 38: 49 rex.WB 39: bd 00 00 00 00 mov $0x0,%ebp
| Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets (help?) | Manager | Title |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2025/12/25 15:30 | linux-6.6.y | 5fa4793a2d2d | d6526ea3 | .config | console log | report | info | [disk image] [vmlinux] [kernel image] | ci2-linux-6-6-kasan | WARNING in ip_rt_bug |