kernel BUG at net/core/skbuff.c:LINE!

kernel BUG at net/core/skbuff.c:LINE!
Status: upstream: reported C repro on 2019/04/27 20:12
Reported-by: syzbot+77d13153b9599a418a9c@syzkaller.appspotmail.com
First crash: 999d, last: 37d

Fix bisection: fixed by (bisect log) [no-op commit]:
commit 4f12385298d474541a794f4c47980861299f20e7
Author: Sibi Sankar <sibis@codeaurora.org>
Date: Wed Jul 22 20:10:45 2020 +0000

remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load

similar bugs (14):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-44	kernel BUG at net/core/skbuff.c:LINE!	C			79	790d	1016d	0/2	public: reported C repro on 2019/04/11 08:44
android-54	kernel BUG in pfkey_send_acquire	syz			32	341d	368d	0/1	upstream: reported syz repro on 2021/01/17 15:19
upstream	kernel BUG at net/core/skbuff.c:LINE! (2)	C			562	1454d	1543d	4/22	fixed on 2018/01/29 03:39
android-5-10	kernel BUG in add_grec	C	error		3	1d06h	7d18h	0/1	upstream: reported C repro on 2022/01/13 18:16
android-54	kernel BUG at net/core/skbuff.c:LINE!	C			128	8h47m	740d	0/1	upstream: reported C repro on 2020/01/12 09:43
android-414	kernel BUG at net/core/skbuff.c:LINE!	C			2743	779d	1016d	0/1	public: reported C repro on 2019/04/11 00:00
android-5-10	kernel BUG in cdc_ncm_fill_tx_frame	C	error		40	26d	91d	1/1	fixed on 2021/12/29 12:20
upstream	kernel BUG at net/core/skbuff.c:LINE! (3)	C	done		4399	332d	1449d	21/22	fixed on 2021/03/10 01:48
upstream	kernel BUG at net/core/skbuff.c:LINE!				5	1550d	1620d	3/22	fixed on 2017/10/27 10:10
linux-4.19	kernel BUG in pfkey_send_acquire	C		done	56	339d	368d	1/1	fixed on 2021/03/18 08:30
linux-4.14	kernel BUG at net/core/skbuff.c:LINE!	C			2837	10d	1014d	0/1	upstream: reported C repro on 2019/04/12 15:43
upstream	kernel BUG in llc_sap_action_send_xid_c	C	error		61	72d	286d	22/22	fixed on 2021/11/10 00:50
upstream	kernel BUG in pskb_expand_head	C	done		39	19h27m	67d	19/22	upstream: reported C repro on 2021/11/15 08:38
android-49	kernel BUG at net/core/skbuff.c:LINE!	C			391	779d	1015d	0/3	public: reported C repro on 2019/04/12 00:00

Sample crash report:

IPVS: ftp: loaded support on port[0] = 21
nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
skbuff: skb_under_panic: text:00000000004ad155 len:48 put:8 head:00000000ccce9973 data:0000000088195784 tail:0x2c end:0xc0 dev:sit1
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8152 Comm: syz-executor008 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:skb_panic+0x172/0x174 net/core/skbuff.c:104
Code: 4c 24 10 8b 8b 80 00 00 00 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 60 4f 4c 89 ff 74 24 10 ff 74 24 20 e8 f1 18 e2 ff <0f> 0b e8 7f e7 50 f9 4c 8b 64 24 18 e8 c5 aa 86 f9 48 c7 c1 c0 58
RSP: 0018:ffff888096a0eb50 EFLAGS: 00010286
RAX: 0000000000000083 RBX: ffff888098a84d00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed1012d41d5c
RBP: ffffffff894c58c0 R08: 0000000000000083 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86eec28f
R13: 0000000000000008 R14: ffff8880953d6880 R15: 00000000000000c0
FS:  00005555561d7300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200004c0 CR3: 00000000b4a65000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 skb_under_panic net/core/skbuff.c:114 [inline]
 skb_push.cold+0x24/0x24 net/core/skbuff.c:1730
 fou_build_udp+0x2f/0x360 net/ipv4/fou.c:960
 gue_build_header+0xf7/0x140 net/ipv4/fou.c:1003
 ip_tunnel_encap include/net/ip_tunnels.h:384 [inline]
 ip_tunnel_xmit+0x7ed/0x3850 net/ipv4/ip_tunnel.c:722
 sit_tunnel_xmit__ net/ipv6/sit.c:1017 [inline]
 sit_tunnel_xmit+0x4ef/0x28d0 net/ipv6/sit.c:1033
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 neigh_output include/net/neighbour.h:501 [inline]
 ip_finish_output2+0xd76/0x15a0 net/ipv4/ip_output.c:230
 ip_finish_output+0xae9/0x10b0 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip_output+0x203/0x5f0 net/ipv4/ip_output.c:406
 dst_output include/net/dst.h:455 [inline]
 ip_local_out+0xaf/0x170 net/ipv4/ip_output.c:125
 ip_send_skb+0x3e/0xe0 net/ipv4/ip_output.c:1452
 udp_send_skb+0x6a4/0x1170 net/ipv4/udp.c:848
 udp_sendmsg+0x1cb4/0x2550 net/ipv4/udp.c:1135
 udpv6_sendmsg+0x14b2/0x2ae0 net/ipv6/udp.c:1224
 inet_sendmsg+0x132/0x5a0 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xc3/0x120 net/socket.c:661
 ___sys_sendmsg+0x3b3/0x8e0 net/socket.c:2227
 __sys_sendmmsg+0x195/0x470 net/socket.c:2322
 __do_sys_sendmmsg net/socket.c:2351 [inline]
 __se_sys_sendmmsg net/socket.c:2348 [inline]
 __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2348
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2b861d0459
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe758271c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2b861d0459
RDX: 0000000000000001 RSI: 00000000200017c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000008623de40 R09: 000000008623de40
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000907b
R13: 00007ffe758271f0 R14: 00007ffe758271e0 R15: 00007ffe758271d4
Modules linked in:
---[ end trace 2484b37f1607e532 ]---
RIP: 0010:skb_panic+0x172/0x174 net/core/skbuff.c:104
Code: 4c 24 10 8b 8b 80 00 00 00 41 56 45 89 e8 4c 89 e2 41 57 48 89 ee 48 c7 c7 60 4f 4c 89 ff 74 24 10 ff 74 24 20 e8 f1 18 e2 ff <0f> 0b e8 7f e7 50 f9 4c 8b 64 24 18 e8 c5 aa 86 f9 48 c7 c1 c0 58
RSP: 0018:ffff888096a0eb50 EFLAGS: 00010286
RAX: 0000000000000083 RBX: ffff888098a84d00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed1012d41d5c
RBP: ffffffff894c58c0 R08: 0000000000000083 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffffffff86eec28f
R13: 0000000000000008 R14: ffff8880953d6880 R15: 00000000000000c0
FS:  00005555561d7300(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200004c0 CR3: 00000000b4a65000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (491):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-linux-4-19	2021/12/14 21:46	linux-4.19.y	3f8a27f9e27b	d018dd31	.config	log	report	syz	C		kernel BUG in fou_build_udp
ci2-linux-4-19	2021/05/18 14:25	linux-4.19.y	3c8c23092588	a343ba6b	.config	log	report	syz	C		kernel BUG in llc_sap_action_send_xid_c
ci2-linux-4-19	2020/10/06 03:06	linux-4.19.y	b09c34517e1a	1880b4a9	.config	log	report	syz	C
ci2-linux-4-19	2019/12/24 10:07	linux-4.19.y	672481c2deff	be5c2c81	.config	log	report	syz	C
ci2-linux-4-19	2020/01/28 06:33	linux-4.19.y	88d6de67e390	56cd6c9b	.config	log	report	syz
ci2-linux-4-19	2019/05/03 07:34	linux-4.19.y	a03957ab0fd5	1bfa09b9	.config	log	report	syz
ci2-linux-4-19	2019/05/01 01:25	linux-4.19.y	19bb613acb9a	618456b4	.config	log	report	syz
ci2-linux-4-19	2019/04/28 01:52	linux-4.19.y	19bb613acb9a	b617407b	.config	log	report	syz
ci2-linux-4-19	2019/04/27 21:56	linux-4.19.y	19bb613acb9a	b617407b	.config	log	report	syz
ci2-linux-4-19	2021/11/09 21:11	linux-4.19.y	3f8a27f9e27b	59bcaf9a	.config	log	report			info	kernel BUG in icmp_glue_bits
ci2-linux-4-19	2021/10/28 07:17	linux-4.19.y	3f8a27f9e27b	be531bb4	.config	log	report			info	kernel BUG in fou_build_udp
ci2-linux-4-19	2021/10/12 01:59	linux-4.19.y	e34184f53363	838e7e2c	.config	log	report			info	kernel BUG in __skb_to_sgvec
ci2-linux-4-19	2021/07/26 04:25	linux-4.19.y	4938296e03bd	4d1b57d4	.config	log	report			info	kernel BUG in __skb_to_sgvec
ci2-linux-4-19	2021/07/23 21:31	linux-4.19.y	4938296e03bd	bc5f1d88	.config	log	report			info	kernel BUG in __skb_to_sgvec
ci2-linux-4-19	2021/01/17 03:51	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2021/01/16 14:39	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2021/01/15 22:08	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2021/01/15 12:32	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2021/01/15 07:42	linux-4.19.y	675cc038067f	65a7a854	.config	log	report			info
ci2-linux-4-19	2021/01/15 01:56	linux-4.19.y	675cc038067f	468dbb55	.config	log	report			info
ci2-linux-4-19	2021/01/14 15:20	linux-4.19.y	675cc038067f	468dbb55	.config	log	report			info
ci2-linux-4-19	2021/01/12 13:57	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/12 09:52	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/12 06:44	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/11 19:47	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/11 11:28	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/11 05:48	linux-4.19.y	610bdbf6a174	2c1f2513	.config	log	report			info
ci2-linux-4-19	2021/01/09 05:42	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/08 22:20	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/08 20:38	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/08 12:56	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/08 07:05	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/07 20:42	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/07 17:02	linux-4.19.y	4143d798313f	c104d4a3	.config	log	report			info
ci2-linux-4-19	2021/01/06 17:13	linux-4.19.y	4143d798313f	fff20c29	.config	log	report			info
ci2-linux-4-19	2021/01/06 11:05	linux-4.19.y	3207316b3bee	fff20c29	.config	log	report			info
ci2-linux-4-19	2021/01/05 23:09	linux-4.19.y	3207316b3bee	b1c228e1	.config	log	report			info
ci2-linux-4-19	2021/01/05 22:16	linux-4.19.y	3207316b3bee	b1c228e1	.config	log	report			info
ci2-linux-4-19	2021/01/05 11:53	linux-4.19.y	3207316b3bee	a0234d98	.config	log	report			info
ci2-linux-4-19	2021/01/05 09:07	linux-4.19.y	3207316b3bee	2a28ff1f	.config	log	report			info
ci2-linux-4-19	2021/01/04 17:35	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/04 12:33	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/03 22:04	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/03 18:07	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/03 05:00	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/03 03:34	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 23:10	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 22:07	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 14:32	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 11:34	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 07:30	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/02 04:27	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2021/01/01 18:09	linux-4.19.y	3207316b3bee	79264ae3	.config	log	report			info
ci2-linux-4-19	2019/04/27 19:11	linux-4.19.y	19bb613acb9a	b617407b	.config	log	report