WARNING in xfrm_policy_insert

Status: fixed on 2020/07/28 19:58
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+5cfc132a76d844973259@syzkaller.appspotmail.com
Fix commit: ed17b8d377ea xfrm: fix a warning in xfrm_policy_insert_list
First crash: 3122d, last: 2232d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in xfrm_policy_insert (log)
Repro: C syz .config
  
Fix bisection: fixed by (bisect log) :
commit ed17b8d377eaf6b4a01d46942b4c647378a79bdd
Author: Xin Long <lucien.xin@gmail.com>
Date: Mon May 25 05:53:37 2020 +0000

  xfrm: fix a warning in xfrm_policy_insert_list

  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
WARNING in xfrm_policy_insert 1 (3) 2020/07/27 06:47
Reminder: 26 open syzbot bugs in "net/xfrm" subsystem 1 (1) 2019/07/24 01:42
Reminder: 27 open syzbot bugs in "net/xfrm" subsystem 1 (1) 2019/06/25 05:51
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 WARNING in xfrm_policy_insert -1 syz done 8 2264d 2522d 1/1 fixed on 2020/06/15 08:02
linux-4.19 WARNING in xfrm_policy_insert -1 C error 8 2256d 2505d 0/1 upstream: reported C repro on 2019/09/17 18:21
android-414 WARNING in xfrm_policy_insert -1 C 7 2428d 2516d 0/1 public: reported C repro on 2019/09/06 10:33
android-44 WARNING in xfrm_policy_insert -1 C 13 2469d 2662d 0/2 public: reported C repro on 2019/04/14 00:02
android-49 WARNING in xfrm_policy_insert -1 C 27 2428d 2662d 0/3 public: reported C repro on 2019/04/14 00:00
▶ ▼ Fix bisection attempts (9)
Created Duration User Patch Repo Result
2020/07/26 15:35 4h34m bisect fix net-next-old OK (1) job log
2020/06/16 07:51 29m bisect fix net-next-old OK (0) job log log
2020/05/17 01:25 28m bisect fix net-next-old OK (0) job log log
2020/04/16 16:20 24m bisect fix net-next-old OK (0) job log log
2020/03/17 02:34 29m bisect fix net-next-old OK (0) job log log
2020/02/12 04:09 25m bisect fix net-next-old OK (0) job log log
2020/01/13 02:29 29m bisect fix net-next-old OK (0) job log log
2019/12/11 08:12 28m bisect fix net-next-old OK (0) job log log
2019/08/09 09:11 28m bisect fix net-next-old OK (0) job log log

Sample crash report:
WARNING: CPU: 0 PID: 9447 at net/xfrm/xfrm_policy.c:753 xfrm_policy_insert+0x883/0x1140 net/xfrm/xfrm_policy.c:753
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 9447 Comm: syzkaller232283 Not tainted 4.16.0-rc1+ #225
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988
RIP: 0010:xfrm_policy_insert+0x883/0x1140 net/xfrm/xfrm_policy.c:753
RSP: 0018:ffff8801cee97250 EFLAGS: 00010293
RAX: ffff8801c6b7a380 RBX: ffff8801c6a6d240 RCX: ffffffff84bc7033
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8801c6a6d460
RBP: ffff8801cee973e0 R08: 0000000000000000 R09: 0000000000000004
R10: ffff8801cee97108 R11: 0000000000000004 R12: dffffc0000000000
R13: 0000000000000000 R14: 000000000000007f R15: 0000000000000000
 xfrm_add_policy+0x3dc/0x8a0 net/xfrm/xfrm_user.c:1605
 xfrm_user_rcv_msg+0x41c/0x860 net/xfrm/xfrm_user.c:2595
 netlink_rcv_skb+0x14b/0x380 net/netlink/af_netlink.c:2442
 xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2603
 netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline]
 netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334
 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897
 sock_sendmsg_nosec net/socket.c:630 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:640
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081
 SYSC_sendmsg net/socket.c:2092 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2088
 do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x446cf9
RSP: 002b:00007fb756bb7db8 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006e168c RCX: 0000000000446cf9
RDX: 0000000000000000 RSI: 000000002014dfc8 RDI: 0000000000000009
RBP: 00000000006e1688 R08: 00007fb756bb8700 R09: 0000000000000000
R10: 00007fb756bb8700 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffe45c5ddaf R14: 00007fb756bb89c0 R15: 0000000000000008
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/02/14 07:21 net-next-old 6c677750f22d 88bc17df .config console log report syz C ci-upstream-net-kasan-gce
2018/02/14 07:27 upstream 61f14c015f5b 88bc17df .config console log report syz ci-upstream-kasan-gce
2018/11/02 12:41 upstream 8adcc59974b8 1f38e9ae .config console log report ci-upstream-kasan-gce-smack-root
2018/11/26 13:16 net-next-old 4bffc669d624 ac912200 .config console log report ci-upstream-net-kasan-gce
2018/08/05 03:47 net-next-old d89d41556141 3476a2df .config console log report ci-upstream-net-kasan-gce
2018/01/08 20:01 net-next-old 0c3b34d80494 93b4c6f1 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.