syzbot


WARNING: ODEBUG bug in xfrm_policy_destroy

Status: public: reported syz repro on 2019/04/14 08:51
Reported-by: syzbot+e46535f5f0913f55b44d@syzkaller.appspotmail.com
First crash: 1994d, last: 1629d

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 2253 at lib/debugobjects.c:260 debug_print_object+0x181/0x210 lib/debugobjects.c:260()
ODEBUG: activate active (active state 1) object type: rcu_head hint:           (null)
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 2253 Comm: syz-executor.0 Not tainted 4.4.174+ #4
 0000000000000000 17b9571e87229455 ffff8801db707298 ffffffff81aad1a1
 ffff8801db7073e8 ffffffff82835ee0 ffffffff8292c440 0000000000000104
 ffffffff81b0b3d1 ffff8801db707378 ffffffff813a48c2 0000000041b58ab3
Call Trace:
 <IRQ>  [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff813a48c2>] panic+0x1b9/0x37b kernel/panic.c:112
 [<ffffffff813a4ab9>] warn_slowpath_common kernel/panic.c:455 [inline]
 [<ffffffff813a4ab9>] warn_slowpath_common.cold+0x20/0x20 kernel/panic.c:435
 [<ffffffff810d394f>] warn_slowpath_fmt+0xbf/0x100 kernel/panic.c:471
 [<ffffffff81b0b3d1>] debug_print_object+0x181/0x210 lib/debugobjects.c:260
 [<ffffffff81b0c380>] debug_object_activate+0x2f0/0x470 lib/debugobjects.c:418
 [<ffffffff812446c5>] debug_rcu_head_queue kernel/rcu/rcu.h:75 [inline]
 [<ffffffff812446c5>] __call_rcu.constprop.0+0x35/0x930 kernel/rcu/tree.c:3059
 [<ffffffff81244fd2>] call_rcu+0x12/0x20 kernel/rcu/tree_plugin.h:662
 [<ffffffff82548147>] xfrm_policy_destroy+0x77/0x90 net/xfrm/xfrm_policy.c:323
 [<ffffffff82553c1a>] xfrm_pol_put include/net/xfrm.h:797 [inline]
 [<ffffffff82553c1a>] xfrm_pols_put include/net/xfrm.h:804 [inline]
 [<ffffffff82553c1a>] __xfrm_policy_check+0x137a/0x1640 net/xfrm/xfrm_policy.c:2579
 [<ffffffff82481afb>] __xfrm_policy_check2 include/net/xfrm.h:1067 [inline]
 [<ffffffff82481afb>] xfrm_policy_check include/net/xfrm.h:1076 [inline]
 [<ffffffff82481afb>] xfrm4_policy_check include/net/xfrm.h:1081 [inline]
 [<ffffffff82481afb>] udp_queue_rcv_skb+0x8cb/0x14e0 net/ipv4/udp.c:1520
 [<ffffffff824836e3>] __udp4_lib_rcv+0x4e3/0x21f0 net/ipv4/udp.c:1830
 [<ffffffff824869e2>] udp_rcv+0x22/0x30 net/ipv4/udp.c:2043
 [<ffffffff823b59c0>] ip_local_deliver_finish+0x3c0/0xa70 net/ipv4/ip_input.c:216
 [<ffffffff823b797f>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff823b797f>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff823b797f>] ip_local_deliver+0x1af/0x390 net/ipv4/ip_input.c:257
 [<ffffffff823b67d8>] dst_input include/net/dst.h:504 [inline]
 [<ffffffff823b67d8>] ip_rcv_finish+0x768/0x1220 net/ipv4/ip_input.c:365
 [<ffffffff823b845a>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff823b845a>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff823b845a>] ip_rcv+0x8fa/0xe70 net/ipv4/ip_input.c:456
 [<ffffffff82230640>] __netif_receive_skb_core+0x1300/0x2950 net/core/dev.c:4041
 [<ffffffff82238bd8>] __netif_receive_skb+0x58/0x1c0 net/core/dev.c:4076
 [<ffffffff8223fec0>] process_backlog+0x200/0x630 net/core/dev.c:4673
 [<ffffffff8223f2f7>] napi_poll net/core/dev.c:4911 [inline]
 [<ffffffff8223f2f7>] net_rx_action+0x367/0xd30 net/core/dev.c:4976
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff82719cdc>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:956
 <EOI>  [<ffffffff810e1744>] do_softirq.part.0+0x54/0x60 kernel/softirq.c:317
 [<ffffffff810e18a8>] do_softirq+0x18/0x20 kernel/softirq.c:305
 [<ffffffff8222ec4b>] netif_rx_ni+0xeb/0x3b0 net/core/dev.c:3675
 [<ffffffff81e22f6f>] tun_get_user+0xdbf/0x2640 drivers/net/tun.c:1264
 [<ffffffff81e24a0a>] tun_chr_write_iter+0xda/0x190 drivers/net/tun.c:1283
 [<ffffffff81497941>] do_iter_readv_writev+0x141/0x1e0 fs/read_write.c:666
 [<ffffffff81498cf7>] do_readv_writev+0x387/0x6e0 fs/read_write.c:810
 [<ffffffff8149917d>] vfs_writev+0x7d/0xb0 fs/read_write.c:849
 [<ffffffff8149b5fc>] SYSC_writev fs/read_write.c:882 [inline]
 [<ffffffff8149b5fc>] SyS_writev+0xdc/0x260 fs/read_write.c:874
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/08 10:29 https://android.googlesource.com/kernel/common android-4.4 62872f952d6b 1e35461e .config console log report syz ci-android-44-kasan-gce
2019/08/01 12:08 https://android.googlesource.com/kernel/common android-4.4 62872f952d6b c692b5bd .config console log report syz ci-android-44-kasan-gce
2018/11/08 21:58 https://android.googlesource.com/kernel/common android-4.4 1bdb20fcd457 e85d2a61 .config console log report syz ci-android-44-kasan-gce
* Struck through repros no longer work on HEAD.