syzbot


BUG: unable to handle kernel paging request in gro_cells_destroy (3)

Status: fixed on 2019/03/28 12:00
Subsystems: net
[Documentation on labels]
Fix commit: 2a5ff07a0eb9 gro_cells: make sure device is up in gro_cells_receive()
First crash: 1933d, last: 1917d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (5) net 2 1850d 1856d 0/27 closed as invalid on 2019/06/15 03:25
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (4) net 1 1884d 1884d 0/27 closed as invalid on 2019/05/15 23:07
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (2) net 2 1978d 1990d 0/27 closed as invalid on 2019/02/06 03:52
upstream BUG: unable to handle kernel paging request in gro_cells_destroy net 5 2120d 2178d 0/27 closed as invalid on 2018/09/05 12:51

Sample crash report:
BUG: unable to handle kernel paging request at ffffffe8ffffd65e
#PF error: [WRITE]
PGD 8874067 P4D 8874067 PUD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 9735 Comm: kworker/u4:7 Not tainted 5.0.0+ #108
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:__skb_unlink include/linux/skbuff.h:1983 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:1999 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2710 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:103 [inline]
RIP: 0010:gro_cells_destroy+0x1ab/0x360 net/core/gro_cells.c:92
Code: 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 42 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 <48> 89 42 08 48 c1 e9 03 42 80 3c 21 00 0f 85 dd 00 00 00 48 89 10
RSP: 0018:ffff88809a2979a8 EFLAGS: 00010246
RAX: 0000000000ffffff RBX: ffffe8ffffd64dc0 RCX: 0000000000ffffff
RDX: ffffffe8ffffd656 RSI: ffffffff858d739a RDI: ffffffe8ffffd65e
RBP: ffff88809a297a08 R08: ffff88808db500c0 R09: fffffbfff1265435
R10: fffffbfff1265434 R11: ffffffff8932a1a3 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffe8ffffd64dd0 R15: ffffe8ffffd64dc9
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffe8ffffd65e CR3: 000000005cbf1000 CR4: 00000000001406e0
Call Trace:
 ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1013
 netdev_run_todo+0x51c/0x7d0 net/core/dev.c:8977
 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:116
 ip_tunnel_delete_nets+0x423/0x5f0 net/ipv4/ip_tunnel.c:1127
 ipip_exit_batch_net+0x23/0x30 net/ipv4/ipip.c:663
 ops_exit_list.isra.0+0x105/0x160 net/core/net_namespace.c:156
 cleanup_net+0x3fb/0x960 net/core/net_namespace.c:551
 process_one_work+0x98e/0x1790 kernel/workqueue.c:2269
 worker_thread+0x98/0xe40 kernel/workqueue.c:2415
 kthread+0x357/0x430 kernel/kthread.c:253
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffffe8ffffd65e
---[ end trace f0ec347be3441aad ]---
RIP: 0010:__skb_unlink include/linux/skbuff.h:1983 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:1999 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2710 [inline]
RIP: 0010:gro_cells_destroy net/core/gro_cells.c:103 [inline]
RIP: 0010:gro_cells_destroy+0x1ab/0x360 net/core/gro_cells.c:92
Code: 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 42 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 <48> 89 42 08 48 c1 e9 03 42 80 3c 21 00 0f 85 dd 00 00 00 48 89 10
RSP: 0018:ffff88809a2979a8 EFLAGS: 00010246
RAX: 0000000000ffffff RBX: ffffe8ffffd64dc0 RCX: 0000000000ffffff
RDX: ffffffe8ffffd656 RSI: ffffffff858d739a RDI: ffffffe8ffffd65e
RBP: ffff88809a297a08 R08: ffff88808db500c0 R09: fffffbfff1265435
R10: fffffbfff1265434 R11: ffffffff8932a1a3 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffe8ffffd64dd0 R15: ffffe8ffffd64dc9
FS:  0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffe8ffffd65e CR3: 000000005cbf1000 CR4: 00000000001406e0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/26 15:37 net-next-old 68cc2999f692 55684ce1 .config console log report ci-upstream-net-kasan-gce
2019/03/17 17:46 net-next-old 3b319ee220a8 ba18afea .config console log report ci-upstream-net-kasan-gce
2019/03/10 01:49 net-next-old d9862cfbe209 12365b99 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.