syzbot


BUG: unable to handle kernel paging request in gro_cells_destroy (5)

Status: closed as invalid on 2019/06/15 03:25
Subsystems: net
[Documentation on labels]
First crash: 1796d, last: 1790d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (3) net 3 1857d 1874d 11/26 fixed on 2019/03/28 12:00
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (4) net 1 1825d 1825d 0/26 closed as invalid on 2019/05/15 23:07
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (2) net 2 1919d 1930d 0/26 closed as invalid on 2019/02/06 03:52
upstream BUG: unable to handle kernel paging request in gro_cells_destroy net 5 2060d 2118d 0/26 closed as invalid on 2018/09/05 12:51

Sample crash report:
BUG: unable to handle page fault for address: ffffd6b23cfffff0
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 30930 Comm: kworker/u4:11 Not tainted 5.2.0-rc1+ #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:__skb_unlink include/linux/skbuff.h:1994 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2010 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2721 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:103 [inline]
RIP: 0010:gro_cells_destroy+0x1ab/0x360 net/core/gro_cells.c:92
Code: 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 42 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 <48> 89 42 08 48 c1 e9 03 42 80 3c 21 00 0f 85 dd 00 00 00 48 89 10
RSP: 0018:ffff888057acf9a8 EFLAGS: 00010246
RAX: 00ffffffffffffe8 RBX: ffffe8ffffd6ad50 RCX: 00ffffffffffffe8
RDX: ffffd6b23cffffe8 RSI: ffffffff85957eaa RDI: ffffd6b23cfffff0
RBP: ffff888057acfa08 R08: ffff888098a04100 R09: fffffbfff12a8ce1
R10: fffffbfff12a8ce0 R11: ffffffff89546703 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffe8ffffd6ad60 R15: ffffe8ffffd6ad55
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffd6b23cfffff0 CR3: 00000000a10cd000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1013
 netdev_run_todo+0x48b/0x7c0 net/core/dev.c:9002
 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:116
 ip_tunnel_delete_nets+0x423/0x5f0 net/ipv4/ip_tunnel.c:1127
 ipip_exit_batch_net+0x23/0x30 net/ipv4/ipip.c:663
 ops_exit_list.isra.0+0xfc/0x150 net/core/net_namespace.c:157
 cleanup_net+0x3fb/0x960 net/core/net_namespace.c:553
 process_one_work+0x989/0x1790 kernel/workqueue.c:2269
 worker_thread+0x98/0xe40 kernel/workqueue.c:2415
 kthread+0x354/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffd6b23cfffff0
---[ end trace 8c85c7242c5729d2 ]---
RIP: 0010:__skb_unlink include/linux/skbuff.h:1994 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:2010 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2721 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:103 [inline]
RIP: 0010:gro_cells_destroy+0x1ab/0x360 net/core/gro_cells.c:92
Code: 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 42 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 <48> 89 42 08 48 c1 e9 03 42 80 3c 21 00 0f 85 dd 00 00 00 48 89 10
RSP: 0018:ffff888057acf9a8 EFLAGS: 00010246
RAX: 00ffffffffffffe8 RBX: ffffe8ffffd6ad50 RCX: 00ffffffffffffe8
RDX: ffffd6b23cffffe8 RSI: ffffffff85957eaa RDI: ffffd6b23cfffff0
RBP: ffff888057acfa08 R08: ffff888098a04100 R09: fffffbfff12a8ce1
R10: fffffbfff12a8ce0 R11: ffffffff89546703 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffe8ffffd6ad60 R15: ffffe8ffffd6ad55
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffd6b23cfffff0 CR3: 00000000a10cd000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/05/26 14:50 net-old f4bcf14e3997 85c57315 .config console log report ci-upstream-net-this-kasan-gce
2019/06/01 11:41 net-next-old c9bb6165a16e 53c81ea5 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.