syzbot
WARNING in gro_cell_poll
Status:
upstream: reported on 2026/09/18 16:57
Subsystems:
net
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+f0661448aa9511ce744a@syzkaller.appspotmail.com
Fix commit:
net: gro_cells: prevent enabling threaded NAPI on gro_cells
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 29d, last: 1d08h
Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(l->owner)
WARNING: ./include/linux/local_lock_internal.h:47 at local_lock_acquire include/linux/local_lock_internal.h:47 [inline], CPU#0: napi/tunl0-0/23871
WARNING: ./include/linux/local_lock_internal.h:47 at gro_cell_poll+0x5aa/0x6c0 net/core/gro_cells.c:66, CPU#0: napi/tunl0-0/23871
Modules linked in:
CPU: 0 UID: 0 PID: 23871 Comm: napi/tunl0-0 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:local_lock_acquire include/linux/local_lock_internal.h:47 [inline]
RIP: 0010:gro_cell_poll+0x5b1/0x6c0 net/core/gro_cells.c:66
Code: 8d 3d a3 52 98 07 48 c7 c6 20 df 3c 8d 67 48 0f b9 3a e9 59 fe ff ff e8 cd 76 50 f8 48 8d 3d 96 52 98 07 48 c7 c6 e0 de 3c 8d <67> 48 0f b9 3a eb be 31 db e9 88 fd ff ff 48 8b 7c 24 20 e8 07 e2
RSP: 0018:ffffc9000795fb70 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000200
RDX: ffff88803325a580 RSI: ffffffff8d3cdee0 RDI: ffffffff915420a0
RBP: ffffe8ffffda5be8 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff9b9a85c0 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888123b4f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb293a4e000 CR3: 00000000345cd000 CR4: 00000000003526f0
Call Trace:
<TASK>
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7798
napi_threaded_poll_loop+0x52f/0x870 net/core/dev.c:7918
napi_threaded_poll+0x3a8/0x4b0 net/core/dev.c:7973
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: 8d 3d a3 52 98 07 lea 0x79852a3(%rip),%edi # 0x79852a9
6: 48 c7 c6 20 df 3c 8d mov $0xffffffff8d3cdf20,%rsi
d: 67 48 0f b9 3a ud1 (%edx),%rdi
12: e9 59 fe ff ff jmp 0xfffffe70
17: e8 cd 76 50 f8 call 0xf85076e9
1c: 48 8d 3d 96 52 98 07 lea 0x7985296(%rip),%rdi # 0x79852b9
23: 48 c7 c6 e0 de 3c 8d mov $0xffffffff8d3cdee0,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb be jmp 0xffffffef
31: 31 db xor %ebx,%ebx
33: e9 88 fd ff ff jmp 0xfffffdc0
38: 48 8b 7c 24 20 mov 0x20(%rsp),%rdi
3d: e8 .byte 0xe8
3e: 07 (bad)
3f: e2 .byte 0xe2
Struck through repros no longer work on HEAD.