kernel BUG in ipgre_header

Status: fixed on 2024/06/24 19:50
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+b00d8e27a887add75dac@syzkaller.appspotmail.com
Fix commit: 3cffa2ddc4d3 bonding: stop the device in bond_setup_by_slave()
First crash: 1000d, last: 840d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2023/11/18 upstream (ToT) 791c8ab095f7 C [report] kernel BUG in ipgre_header
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in ipgre_header net -1 syz, C 4 986d 1000d 25/29 fixed on 2024/01/20 21:18
upstream kernel BUG in ipgre_header (2) net -1 8 707d 767d 0/29 closed as invalid on 2024/10/09 09:35
upstream kernel BUG in ipgre_header (3) net -1 syz, C 99 219d 298d 29/29 fixed on 2026/01/07 12:29
upstream kernel BUG in ipgre_header (4) net -1 syz, C 9 209d 217d 29/29 fixed on 2026/05/06 16:40
upstream kernel BUG in llc_sap_action_send_xid_c net -1 syz, C error 61 1739d 1952d 20/29 fixed on 2021/11/10 00:50
upstream kernel BUG in pskb_expand_head net -1 syz, C done 1600 1282d 1733d 22/29 fixed on 2023/02/25 08:02
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2024/06/21 09:30 1h17m sebek.zoltek@gmail.com linux-6.1.y error
▶ ▼ Fix bisection attempts (5)
Created Duration User Patch Repo Result
2024/05/30 18:06 12m bisect fix linux-6.1.y error job log
2024/04/25 17:34 3h24m bisect fix linux-6.1.y OK (0) job log log
2024/02/27 01:10 1h37m bisect fix linux-6.1.y OK (0) job log log
2024/01/18 15:02 2h05m bisect fix linux-6.1.y OK (0) job log log
2023/12/18 02:44 1h37m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
skbuff: skb_under_panic: text:ffff800010d8aaac len:-32748 put:-32748 head:ffff0000cf929800 data:fffeffffcf9318ac tail:0xc0 end:0xc0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:120!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4222 Comm: syz-executor360 Not tainted 6.1.82-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : skb_panic net/core/skbuff.c:116 [inline]
pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:130
lr : skb_panic net/core/skbuff.c:116 [inline]
lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:130
sp : ffff80001e0374b0
x29: ffff80001e0374c0 x28: 1ffff00003c06f08 x27: dfff800000000000
x26: ffff0000c4626a10 x25: 00000000000000c0 x24: fffeffffcf9318ac
x23: ffff0000cf929800 x22: 00000000ffff8014 x21: 00000000000000c0
x20: 00000000ffff8014 x19: ffff800010d8aaac x18: 1fffe0003686b776
x17: ffff80001583d000 x16: ffff80001214de8c x15: ffff0001b435bbbc
x14: 1ffff00002b080b0 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : 4181b71a957ffd00
x8 : 4181b71a957ffd00 x7 : ffff80000827c8d4 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000aa8c1ec
x2 : ffff0001b435bcd0 x1 : 0000000100000000 x0 : 000000000000008e
Call trace:
 skb_panic net/core/skbuff.c:116 [inline]
 skb_under_panic+0x13c/0x140 net/core/skbuff.c:130
 skb_push+0x104/0x11c net/core/skbuff.c:2180
 ipgre_header+0x78/0x3c4 net/ipv4/ip_gre.c:855
 dev_hard_header include/linux/netdevice.h:3073 [inline]
 packet_snd net/packet/af_packet.c:3028 [inline]
 packet_sendmsg+0x3068/0x4cd8 net/packet/af_packet.c:3108
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x55c/0x848 net/socket.c:2514
 ___sys_sendmsg net/socket.c:2568 [inline]
 __sys_sendmsg+0x26c/0x33c net/socket.c:2597
 __do_sys_sendmsg net/socket.c:2606 [inline]
 __se_sys_sendmsg net/socket.c:2604 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2604
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1803e6 aa1903e7 a90023f5 94751eca (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/25 21:16 linux-6.1.y d7543167affd 0ea90952 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ipgre_header
2024/03/25 17:28 linux-6.1.y d7543167affd 0ea90952 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ipgre_header
2023/11/18 02:37 linux-6.1.y fb2635ac69ab cb976f63 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ipgre_header
2024/02/27 05:35 linux-6.1.y 81e1dc2f7001 05e69c83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ipgre_header
2023/11/18 02:07 linux-6.1.y fb2635ac69ab cb976f63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ipgre_header
* Struck through repros no longer work on HEAD.