kernel BUG at net/core/skbuff.c:LINE!

kernel BUG at net/core/skbuff.c:LINE!
Status: upstream: reported syz repro on 2019/04/27 20:12
Reported-by: syzbot+77d13153b9599a418a9c@syzkaller.appspotmail.com
First crash: 203d, last: 2d06h

similar bugs (7):
Kernel	Title	Repro	Count	Last	Reported	Patched	Status
android-44	kernel BUG at net/core/skbuff.c:LINE!	C	78	2d12h	220d	0/2	public: reported C repro on 2019/04/11 08:44
upstream	kernel BUG at net/core/skbuff.c:LINE! (2)	C	562	658d	747d	4/14	fixed on 2018/01/29 03:39
android-414	kernel BUG at net/core/skbuff.c:LINE!	C	2643	2h02m	220d	0/1	public: reported C repro on 2019/04/11 00:00
upstream	kernel BUG at net/core/skbuff.c:LINE! (3)	C	2961	11m	653d	0/14	upstream: reported C repro on 2018/02/01 19:21
upstream	kernel BUG at net/core/skbuff.c:LINE!		5	753d	824d	3/14	fixed on 2017/10/27 10:10
linux-4.14	kernel BUG at net/core/skbuff.c:LINE!	C	218	now	218d	0/1	upstream: reported C repro on 2019/04/12 15:43
android-49	kernel BUG at net/core/skbuff.c:LINE!	C	362	1h44m	219d	0/3	public: reported C repro on 2019/04/12 00:00

Sample crash report:

IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
skbuff: skb_over_panic: text:000000004606f2e0 len:232 put:72 head:00000000835d165f data:00000000835d165f tail:0xe8 end:0xc0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8284 Comm: syz-executor.2 Not tainted 4.19.37 #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_panic+0x17c/0x17e net/core/skbuff.c:104
Code: 4c 8b 4d b8 8b 8b 80 00 00 00 41 57 45 89 f0 4c 89 ea ff 75 d0 4c 89 e6 48 c7 c7 40 b9 dc 87 ff 75 c8 ff 75 c0 e8 bb 98 f2 fb <0f> 0b e8 10 11 08 fc 4c 8b 6d 08 e8 c7 5a 3e fc 48 c7 c1 80 c2 dc
RSP: 0018:ffff88807dabeae8 EFLAGS: 00010282
RAX: 0000000000000086 RBX: ffff88808f158c80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155e196 RDI: ffffed100fb57d4f
RBP: ffff88807dabeb50 R08: 0000000000000086 R09: ffffed1015d24fe9
R10: ffffed1015d24fe8 R11: ffff8880ae927f47 R12: ffffffff87dcc2c0
R13: ffffffff86160aa7 R14: 0000000000000048 R15: ffffffff87dcb900
FS:  00007f8e3e8a0700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffef6fe5c4c CR3: 0000000089a69000 CR4: 00000000001406e0
Call Trace:
 skb_over_panic net/core/skbuff.c:109 [inline]
 skb_put.cold+0x23/0x23 net/core/skbuff.c:1702
 dump_esp_combs net/key/af_key.c:2999 [inline]
 pfkey_send_acquire+0x1ba7/0x2600 net/key/af_key.c:3220
 km_query+0xd0/0x220 net/xfrm/xfrm_state.c:1988
 xfrm_state_find+0x1d4f/0x2dc0 net/xfrm/xfrm_state.c:1038
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:1413 [inline]
 xfrm_tmpl_resolve+0x32a/0xc90 net/xfrm/xfrm_policy.c:1458
 xfrm_resolve_and_create_bundle+0x137/0x2320 net/xfrm/xfrm_policy.c:1756
 xfrm_lookup_with_ifid+0x278/0x1cd0 net/xfrm/xfrm_policy.c:2079
 xfrm_lookup net/xfrm/xfrm_policy.c:2203 [inline]
 xfrm_lookup_route+0x3b/0x1f0 net/xfrm/xfrm_policy.c:2214
 ip_route_output_flow+0xad/0xc0 net/ipv4/route.c:2615
 udp_sendmsg+0x1ade/0x25f0 net/ipv4/udp.c:1090
 udpv6_sendmsg+0x13a4/0x28d0 net/ipv6/udp.c:1211
 inet_sendmsg+0x147/0x5d0 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xdd/0x130 net/socket.c:632
 ___sys_sendmsg+0x3e2/0x930 net/socket.c:2115
 __sys_sendmmsg+0x1bf/0x4e0 net/socket.c:2210
 __do_sys_sendmmsg net/socket.c:2239 [inline]
 __se_sys_sendmmsg net/socket.c:2236 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2236
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458da9
Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f8e3e89fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000458da9
RDX: 00000000000005c3 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000000f0 R11: 0000000000000246 R12: 00007f8e3e8a06d4
R13: 00000000004c5fac R14: 00000000004da760 R15: 00000000ffffffff
Modules linked in:
---[ end trace 3e9151c8cc5ae043 ]---
RIP: 0010:skb_panic+0x17c/0x17e net/core/skbuff.c:104
Code: 4c 8b 4d b8 8b 8b 80 00 00 00 41 57 45 89 f0 4c 89 ea ff 75 d0 4c 89 e6 48 c7 c7 40 b9 dc 87 ff 75 c8 ff 75 c0 e8 bb 98 f2 fb <0f> 0b e8 10 11 08 fc 4c 8b 6d 08 e8 c7 5a 3e fc 48 c7 c1 80 c2 dc
RSP: 0018:ffff88807dabeae8 EFLAGS: 00010282
RAX: 0000000000000086 RBX: ffff88808f158c80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155e196 RDI: ffffed100fb57d4f
RBP: ffff88807dabeb50 R08: 0000000000000086 R09: ffffed1015d24fe9
R10: ffffed1015d24fe8 R11: ffff8880ae927f47 R12: ffffffff87dcc2c0
R13: ffffffff86160aa7 R14: 0000000000000048 R15: ffffffff87dcb900
FS:  00007f8e3e8a0700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 0000000089a69000 CR4: 00000000001406f0

Crashes (144):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	Maintainers
ci2-linux-4-19	2019/04/27 21:56	linux-4.19.y	19bb613a	b617407b	.config	log	report	syz	davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/05/03 07:34	linux-4.19.y	a03957ab	1bfa09b9	.config	log	report	syz	davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/05/01 01:25	linux-4.19.y	19bb613a	618456b4	.config	log	report	syz	davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/04/28 01:52	linux-4.19.y	19bb613a	b617407b	.config	log	report	syz	davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/04/27 19:11	linux-4.19.y	19bb613a	b617407b	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/15 03:49	linux-4.19.y	c555efaf	048f2d49	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/13 00:52	linux-4.19.y	7d8dbefc	048f2d49	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/12 23:12	linux-4.19.y	7d8dbefc	048f2d49	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/12 01:19	linux-4.19.y	7d8dbefc	377d77fa	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/11 14:25	linux-4.19.y	5ee93551	dc438b91	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/11 06:41	linux-4.19.y	5ee93551	dc438b91	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/09 22:31	linux-4.19.y	5ee93551	dc438b91	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/09 21:14	linux-4.19.y	5ee93551	1e35461e	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/11/09 17:44	linux-4.19.y	5ee93551	1e35461e	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/09 02:56	linux-4.19.y	5ee93551	1e35461e	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/08 10:53	linux-4.19.y	5ee93551	1e35461e	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/08 02:48	linux-4.19.y	5ee93551	f39aff9e	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/08 00:24	linux-4.19.y	5ee93551	f39aff9e	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci2-linux-4-19	2019/11/07 03:01	linux-4.19.y	5ee93551	d797d201	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/06 10:29	linux-4.19.y	ef244c30	bc2c6e45	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci2-linux-4-19	2019/11/05 15:39	linux-4.19.y	ef244c30	af5c522d	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/05 05:56	linux-4.19.y	ef244c30	76630fc9	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/05 01:35	linux-4.19.y	ef244c30	76630fc9	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/03 21:37	linux-4.19.y	ef244c30	b35fad31	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/03 10:18	linux-4.19.y	ef244c30	c9610487	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/03 05:15	linux-4.19.y	ef244c30	d603afc9	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/11/02 18:19	linux-4.19.y	ef244c30	997ccc67	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/02 16:34	linux-4.19.y	ef244c30	997ccc67	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/01 18:50	linux-4.19.y	ef244c30	997ccc67	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/01 11:13	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/11/01 06:37	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/11/01 04:10	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/10/31 23:53	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci2-linux-4-19	2019/10/31 22:46	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/10/31 16:38	linux-4.19.y	ef244c30	a41ca8fa	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/30 11:13	linux-4.19.y	ef244c30	5ea87a66	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/10/29 19:09	linux-4.19.y	ef244c30	5ea87a66	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/28 13:45	linux-4.19.y	c3038e71	25bb509e	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/28 12:14	linux-4.19.y	c3038e71	25bb509e	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/10/27 13:05	linux-4.19.y	c3038e71	25bb509e	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/27 10:01	linux-4.19.y	c3038e71	25bb509e	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci2-linux-4-19	2019/10/26 03:26	linux-4.19.y	c3038e71	413926c5	.config	log	report		davem@davemloft.net, linux-kernel@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, netdev@vger.kernel.org, nhorman@tuxdriver.com, vyasevich@gmail.com
ci2-linux-4-19	2019/10/25 23:57	linux-4.19.y	c3038e71	413926c5	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/10/25 05:44	linux-4.19.y	c3038e71	d01bb02a	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/24 08:03	linux-4.19.y	c3038e71	d01bb02a	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/10/24 05:05	linux-4.19.y	c3038e71	b602d64b	.config	log	report		davem@davemloft.net, herbert@gondor.apana.org.au, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, steffen.klassert@secunet.com
ci2-linux-4-19	2019/10/23 14:48	linux-4.19.y	c3038e71	b602d64b	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/10/22 14:27	linux-4.19.y	c3038e71	4ee855e7	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org
ci2-linux-4-19	2019/10/22 00:41	linux-4.19.y	c3038e71	c59a7cd8	.config	log	report		davem@davemloft.net, kuznet@ms2.inr.ac.ru, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, yoshfuji@linux-ipv6.org