syzbot


BUG: using __this_cpu_read() in preemptible code in ipcomp4_init_state

Status: auto-closed as invalid on 2019/02/22 15:19
First crash: 2266d, last: 2266d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-44 BUG: using __this_cpu_read() in preemptible code in ipcomp4_init_state 3 2188d 2233d 2/2 fixed on 2018/04/23 15:29

Sample crash report:
BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor0/7181
caller is __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
CPU: 1 PID: 7181 Comm: syz-executor0 Not tainted 4.9.78-g7be1985 #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cd137490 ffffffff81d94409 0000000000000001 ffffffff83c18800
 ffffffff83f45480 ffff8801cda2c800 0000000000000003 ffff8801cd1374d0
 ffffffff81dfb9d4 ffff8801cd1374e8 ffffffff83f45480 dffffc0000000000
Call Trace:
 [<ffffffff81d94409>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94409>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81dfb9d4>] check_preemption_disabled+0x1d4/0x200 lib/smp_processor_id.c:46
 [<ffffffff81dfba3c>] __this_cpu_preempt_check+0x1c/0x20 lib/smp_processor_id.c:62
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7199 at net/core/dev.c:2466 skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2461
syz3: caps=(0x00000400000058c1, 0x0000000000000000) len=14 data_len=0 gso_size=574 gso_type=5 ip_summed=0
Kernel panic - not syncing: panic_on_warn set ...

 [<ffffffff833fc778>] ipcomp_alloc_tfms net/xfrm/xfrm_ipcomp.c:286 [inline]
 [<ffffffff833fc778>] ipcomp_init_state+0x188/0x930 net/xfrm/xfrm_ipcomp.c:363
 [<ffffffff83368b90>] ipcomp4_init_state+0xb0/0x7d0 net/ipv4/ipcomp.c:137
 [<ffffffff833dae67>] __xfrm_init_state+0x3e7/0xb30 net/xfrm/xfrm_state.c:2096
 [<ffffffff833f9fc6>] xfrm_state_construct net/xfrm/xfrm_user.c:590 [inline]
 [<ffffffff833f9fc6>] xfrm_add_sa+0x1916/0x2e40 net/xfrm/xfrm_user.c:639
 [<ffffffff833ea613>] xfrm_user_rcv_msg+0x413/0x6a0 net/xfrm/xfrm_user.c:2525
 [<ffffffff8309513e>] netlink_rcv_skb+0x13e/0x370 net/netlink/af_netlink.c:2351
 [<ffffffff833e6b0f>] xfrm_netlink_rcv+0x6f/0x90 net/xfrm/xfrm_user.c:2533
 [<ffffffff83093cc1>] netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline]
 [<ffffffff83093cc1>] netlink_unicast+0x511/0x750 net/netlink/af_netlink.c:1301
 [<ffffffff830947e8>] netlink_sendmsg+0x8e8/0xc50 net/netlink/af_netlink.c:1847
 [<ffffffff82ed7baa>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ed7baa>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ed97a1>] ___sys_sendmsg+0x6d1/0x7e0 net/socket.c:1969
 [<ffffffff82edb7d6>] __sys_sendmsg+0xd6/0x190 net/socket.c:2003
 [<ffffffff82edb8bd>] SYSC_sendmsg net/socket.c:2014 [inline]
 [<ffffffff82edb8bd>] SyS_sendmsg+0x2d/0x50 net/socket.c:2010
 [<ffffffff838b2c6e>] entry_SYSCALL_64_fastpath+0x29/0xe8
CPU: 0 PID: 7199 Comm: syz-executor3 Not tainted 4.9.78-g7be1985 #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cd38f428 ffffffff81d94409 ffffffff83a47c40 ffff8801cd38f500
 ffffffff83ee2a00 ffffffff82f3531f 0000000000000009 ffff8801cd38f4f0
 ffffffff8142f4a1 0000000041b58ab3 ffffffff8418ac30 ffffffff8142f2e5
Call Trace:
 [<ffffffff81d94409>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94409>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8142f4a1>] panic+0x1bc/0x3a8 kernel/panic.c:179
 [<ffffffff81131164>] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [<ffffffff81131244>] warn_slowpath_fmt+0xc4/0x110 kernel/panic.c:565
 [<ffffffff82f3531f>] skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2461
 [<ffffffff82f48ebb>] __skb_gso_segment+0x52b/0x670 net/core/dev.c:2767
 [<ffffffff82f49d5e>] skb_gso_segment include/linux/netdevice.h:4000 [inline]
 [<ffffffff82f49d5e>] validate_xmit_skb+0x44e/0x980 net/core/dev.c:3003
 [<ffffffff82f4a347>] validate_xmit_skb_list+0xb7/0x120 net/core/dev.c:3052
 [<ffffffff82fe3f1a>] sch_direct_xmit+0x34a/0x5d0 net/sched/sch_generic.c:177
 [<ffffffff82f4c54d>] __dev_xmit_skb net/core/dev.c:3133 [inline]
 [<ffffffff82f4c54d>] __dev_queue_xmit+0x15fd/0x1e60 net/core/dev.c:3393
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff82f4cdc7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3458
 [<ffffffff835593cc>] packet_snd net/packet/af_packet.c:2953 [inline]
 [<ffffffff835593cc>] packet_sendmsg+0x2ccc/0x4760 net/packet/af_packet.c:2978
 [<ffffffff82ed7baa>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ed7baa>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ed8b08>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82edaff0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838b2c6e>] entry_SYSCALL_64_fastpath+0x29/0xe8
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/29 17:29 https://android.googlesource.com/kernel/common android-4.9 7be198545491 08d47756 .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.