kernel BUG at net/core/skbuff.c:LINE!

kernel BUG at net/core/skbuff.c:LINE!
Status: public: reported C repro on 2019/04/11 08:44
Reported-by: syzbot+4e061abd11510de9f6c6@syzkaller.appspotmail.com
First crash: 602d, last: 13d

similar bugs (7):
Kernel	Title	Repro	Count	Last	Reported	Patched	Status
linux-4.19	kernel BUG at net/core/skbuff.c:LINE!	syz	62	2d16h	144d	0/1	upstream: reported syz repro on 2019/04/27 20:12
upstream	kernel BUG at net/core/skbuff.c:LINE! (2)	C	562	599d	688d	4/13	fixed on 2018/01/29 03:39
android-414	kernel BUG at net/core/skbuff.c:LINE!	C	1794	29m	161d	0/1	public: reported C repro on 2019/04/11 00:00
upstream	kernel BUG at net/core/skbuff.c:LINE! (3)	C	2602	8m	594d	0/13	upstream: reported C repro on 2018/02/01 19:21
upstream	kernel BUG at net/core/skbuff.c:LINE!		5	694d	764d	3/13	fixed on 2017/10/27 10:10
linux-4.14	kernel BUG at net/core/skbuff.c:LINE!	C	91	8h40m	159d	0/1	upstream: reported C repro on 2019/04/12 15:43
android-49	kernel BUG at net/core/skbuff.c:LINE!	C	240	4d09h	160d	0/3	public: reported C repro on 2019/04/12 00:00

Sample crash report:

------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2192!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 7712 Comm: syz-executor759 Not tainted 4.4.132-gc3c51ea #47
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cb108000 task.stack: ffff8801b2c88000
RIP: 0010:[<ffffffff82f3b04a>]  [<ffffffff82f3b04a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2192
RSP: 0000:ffff8801db307260  EFLAGS: 00010206
RAX: ffff8801cb108000 RBX: 0000000099babfd0 RCX: 1ffff1003713ddf9
RDX: 0000000000000100 RSI: ffffffff82f3b04a RDI: ffff8801b89eefc8
RBP: ffff8801db3072e0 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003c R11: ffff8801b96c9ddf R12: 0000000000000000
R13: 0000000000000224 R14: 0000000000000000 R15: ffff8801b89eefc0
FS:  00007f55c074a700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020deb000 CR3: 000000009c82c000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8129085c ffff8801d2270844 ffffffff838c36ec ffffffff8113f75d
 ffff8801d2270848 ffff8801b96c9b68 99babfd00000003c 000001e80000003c
 0000003c0000003c ffff8801d2270780 0000000000000000 ffff8801cda5f0c0
Call Trace:
 <IRQ> 
 [<ffffffff832e296f>] icmp_glue_bits+0x7f/0x1e0 net/ipv4/icmp.c:344
 [<ffffffff83212842>] __ip_append_data.isra.44+0x1e22/0x2920 net/ipv4/ip_output.c:1043
 [<ffffffff83213424>] ip_append_data.part.46+0xe4/0x150 net/ipv4/ip_output.c:1192
 [<ffffffff8321b878>] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1181
 [<ffffffff832e257e>] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362
 [<ffffffff832e6f1a>] icmp_send+0xaca/0x13d0 net/ipv4/icmp.c:727
 [<ffffffff832173ba>] ip_fragment.constprop.50+0x1aa/0x200 net/ipv4/ip_output.c:509
 [<ffffffff83217ad4>] ip_finish_output+0x6c4/0xbc0 net/ipv4/ip_output.c:286
 [<ffffffff8321b569>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff8321b569>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff832184ab>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff832184ab>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff832197ae>] ip_queue_xmit+0x88e/0x1ab0 net/ipv4/ip_output.c:461
 [<ffffffff8327f352>] tcp_transmit_skb+0x1642/0x2bf0 net/ipv4/tcp_output.c:1029
 [<ffffffff83289dac>] __tcp_retransmit_skb+0x5fc/0x1860 net/ipv4/tcp_output.c:2647
 [<ffffffff8328b703>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2664
 [<ffffffff83290fed>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff832928f1>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff83292eaa>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff8129085c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff81291582>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81291582>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838c36ec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff8113f75d>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113f75d>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838c2e51>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff838c2e51>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838c1d90>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff811a4447>] ___might_sleep+0x1c7/0x260 kernel/sched/core.c:7960
 [<ffffffff8149f0ee>] clear_huge_page+0x8e/0x470 mm/memory.c:3860
 [<ffffffff815087df>] __do_huge_pmd_anonymous_page mm/huge_memory.c:739 [inline]
 [<ffffffff815087df>] do_huge_pmd_anonymous_page+0x21f/0x9d0 mm/huge_memory.c:867
 [<ffffffff8149cf82>] create_huge_pmd mm/memory.c:3259 [inline]
 [<ffffffff8149cf82>] __handle_mm_fault mm/memory.c:3378 [inline]
 [<ffffffff8149cf82>] handle_mm_fault+0x2852/0x30b0 mm/memory.c:3472
 [<ffffffff810d7aa0>] __do_page_fault+0x360/0xa10 arch/x86/mm/fault.c:1245
 [<ffffffff810d8177>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308
 [<ffffffff838c1608>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1037
Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 1b ff ff ff 8b 5d b4 e8 a6 61 41 fe 8b 45 bc 85 c0 0f 84 7f fe ff ff e8 96 61 41 fe <0f> 0b 8b 5d b4 e9 70 fe ff ff c7 45 b0 00 00 00 00 e9 8c fa ff 
RIP  [<ffffffff82f3b04a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2192
 RSP <ffff8801db307260>
---[ end trace 4567effcfd8fa14e ]---

All crashes (60):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-android-44-kasan-gce	2018/05/24 18:50	android-4.4	c3c51ea3	f48c20b8	.config	log	report	syz	C
ci-android-44-kasan-gce-386	2018/05/24 18:48	android-4.4	c3c51ea3	f48c20b8	.config	log	report	syz
ci-android-44-kasan-gce	2019/08/25 10:40	android-4.4	62872f95	d21c5d9d	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/08/21 17:47	android-4.4	62872f95	4ea67ff8	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/06/26 03:00	android-4.4	62872f95	0a8d1a96	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/06/25 11:25	android-4.4	62872f95	82c13b6b	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce	2019/06/09 04:07	android-4.4	62872f95	0159583c	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce	2019/06/07 08:45	android-4.4	62872f95	698773cb	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/05/11 19:58	android-4.4	62872f95	0637a7f0	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/04/15 15:59	android-4.4	62872f95	505ab413	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/04/04 13:42	android-4.4	62872f95	6a475fff	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce	2019/03/19 13:25	android-4.4	62872f95	e4549234	.config	log	report			davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci-android-44-kasan-gce	2019/02/28 01:47	android-4.4	62872f95	34ec456b	.config	log	report
ci-android-44-kasan-gce	2019/02/18 05:48	android-4.4	62872f95	59f36113	.config	log	report
ci-android-44-kasan-gce	2019/01/21 15:50	android-4.4	24189101	badbbeee	.config	log	report
ci-android-44-kasan-gce	2019/01/19 04:15	android-4.4	3fcfb1ac	2103a236	.config	log	report
ci-android-44-kasan-gce	2018/12/27 16:24	android-4.4	dfca92ba	43cf01dd	.config	log	report
ci-android-44-kasan-gce	2018/12/10 22:10	android-4.4	c680c9a4	6565f24d	.config	log	report
ci-android-44-kasan-gce	2018/11/12 06:36	android-4.4	0ca3fcab	7b5f8621	.config	log	report
ci-android-44-kasan-gce	2018/11/09 09:54	android-4.4	64102d34	8fd01d3a	.config	log	report
ci-android-44-kasan-gce	2018/11/03 03:34	android-4.4	c4b00eb7	8bd6bd63	.config	log	report
ci-android-44-kasan-gce	2018/10/07 16:14	android-4.4	ea3a6005	8b311eaf	.config	log	report
ci-android-44-kasan-gce	2018/08/24 11:55	android-4.4	727cface	95b5c82b	.config	log	report
ci-android-44-kasan-gce	2018/08/23 09:26	android-4.4	37af2ff3	95b5c82b	.config	log	report
ci-android-44-kasan-gce	2018/08/19 18:04	android-4.4	5541782c	2dc4378f	.config	log	report
ci-android-44-kasan-gce	2018/08/14 17:40	android-4.4	a5fc6659	5084a625	.config	log	report
ci-android-44-kasan-gce	2018/07/30 21:40	android-4.4	9664bdef	1a381291	.config	log	report
ci-android-44-kasan-gce	2018/07/06 11:42	android-4.4	7ba55570	18403e65	.config	log	report
ci-android-44-kasan-gce	2018/06/28 11:22	android-4.4	cf21a9ac	dba0b50e	.config	log	report
ci-android-44-kasan-gce	2018/06/23 13:27	android-4.4	226f96b0	2064fc5c	.config	log	report
ci-android-44-kasan-gce	2018/06/19 15:05	android-4.4	226f96b0	732e4256	.config	log	report
ci-android-44-kasan-gce	2018/06/04 20:52	android-4.4	e75204cc	a50d873b	.config	log	report
ci-android-44-kasan-gce	2018/06/02 04:23	android-4.4	e75204cc	2f93b54f	.config	log	report
ci-android-44-kasan-gce	2018/05/15 21:09	android-4.4	aa3863d2	68ce85f1	.config	log	report
ci-android-44-kasan-gce-386	2019/09/05 06:31	android-4.4	62872f95	040fda58	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce-386	2019/08/24 12:03	android-4.4	62872f95	78ded196	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce-386	2019/08/06 18:57	android-4.4	62872f95	c6f01e54	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce-386	2019/05/11 02:34	android-4.4	62872f95	46caad94	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce-386	2019/04/05 20:15	android-4.4	62872f95	40f2363e	.config	log	report			davem@davemloft.net, jmorris@namei.org, kaber@trash.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci-android-44-kasan-gce-386	2019/02/27 13:55	android-4.4	62872f95	083cfd0e	.config	log	report
ci-android-44-kasan-gce-386	2019/01/14 23:41	android-4.4	c69bfa0f	ebacf5cb	.config	log	report
ci-android-44-kasan-gce-386	2018/12/25 05:06	android-4.4	dfca92ba	8a41a0ad	.config	log	report
ci-android-44-kasan-gce-386	2018/09/12 04:43	android-4.4	b3f777ef	3c88136c	.config	log	report
ci-android-44-kasan-gce-386	2018/08/23 22:40	android-4.4	3a2ec581	95b5c82b	.config	log	report
ci-android-44-kasan-gce-386	2018/08/18 21:02	android-4.4	5541782c	de20bcbb	.config	log	report
ci-android-44-kasan-gce-386	2018/08/10 16:13	android-4.4	a5fc6659	1fb62d58	.config	log	report
ci-android-44-kasan-gce-386	2018/08/09 16:35	android-4.4	a5fc6659	1fb62d58	.config	log	report
ci-android-44-kasan-gce-386	2018/08/06 18:18	android-4.4	13962260	1beb8136	.config	log	report
ci-android-44-kasan-gce-386	2018/07/23 21:25	android-4.4	1b37d68f	912c93d7	.config	log	report
ci-android-44-kasan-gce-386	2018/06/20 01:43	android-4.4	226f96b0	095ef806	.config	log	report
ci-android-44-kasan-gce-386	2018/06/13 16:25	android-4.4	a2e2217b	27c5f59f	.config	log	report
ci-android-44-kasan-gce-386	2018/06/08 06:40	android-4.4	fb7e3196	f7b27b7a	.config	log	report
ci-android-44-kasan-gce-386	2018/06/02 19:49	android-4.4	e75204cc	2f93b54f	.config	log	report
ci-android-44-kasan-gce-386	2018/05/30 13:48	android-4.4	54f36ead	2f93b54f	.config	log	report
ci-android-44-kasan-gce-386	2018/05/29 20:49	android-4.4	54f36ead	e276de77	.config	log	report
ci-android-44-kasan-gce-386	2018/05/29 05:39	android-4.4	3f51ea2d	f48c20b8	.config	log	report
ci-android-44-kasan-gce-386	2018/05/28 22:19	android-4.4	3f51ea2d	f48c20b8	.config	log	report
ci-android-44-kasan-gce-386	2018/05/18 10:31	android-4.4	46155cc7	c992b767	.config	log	report
ci-android-44-kasan-gce-386	2018/05/15 23:52	android-4.4	aa3863d2	68ce85f1	.config	log	report
ci-android-44-kasan-gce-386	2018/01/25 00:36	android-4.4	e70c132b	866f1102	.config	log	report