syzbot


WARNING in ip6gre_tunnel_xmit

Status: fixed on 2024/03/26 00:54
Subsystems: net
[Documentation on labels]
Fix commit: 5ae1e9922bbd net: ip_tunnel: prevent perpetual headroom growth
First crash: 62d, last: 61d
Cause bisection: introduced by (bisect log) :
commit 219eee9c0d16f1b754a8b85275854ab17df0850a
Author: Florian Westphal <fw@strlen.de>
Date: Fri Feb 16 11:36:57 2024 +0000

  net: skbuff: add overflow debug check to pull/push helpers

Crash: WARNING in ip6gre_tunnel_xmit (log)
Repro: C syz .config
  

Sample crash report:
protocol 894f is buggy, dev ip6gretap0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5085 at include/linux/skbuff.h:2723 pskb_may_pull_reason include/linux/skbuff.h:2723 [inline]
WARNING: CPU: 0 PID: 5085 at include/linux/skbuff.h:2723 pskb_may_pull include/linux/skbuff.h:2739 [inline]
WARNING: CPU: 0 PID: 5085 at include/linux/skbuff.h:2723 pskb_network_may_pull include/linux/skbuff.h:3059 [inline]
WARNING: CPU: 0 PID: 5085 at include/linux/skbuff.h:2723 pskb_inet_may_pull include/net/ip_tunnels.h:361 [inline]
WARNING: CPU: 0 PID: 5085 at include/linux/skbuff.h:2723 ip6gre_tunnel_xmit+0x11d6/0x1740 net/ipv6/ip6_gre.c:901
Modules linked in:
CPU: 0 PID: 5085 Comm: syz-executor338 Not tainted 6.8.0-rc5-syzkaller-01567-gd662c5b3ce6d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:pskb_may_pull_reason include/linux/skbuff.h:2723 [inline]
RIP: 0010:pskb_may_pull include/linux/skbuff.h:2739 [inline]
RIP: 0010:pskb_network_may_pull include/linux/skbuff.h:3059 [inline]
RIP: 0010:pskb_inet_may_pull include/net/ip_tunnels.h:361 [inline]
RIP: 0010:ip6gre_tunnel_xmit+0x11d6/0x1740 net/ipv6/ip6_gre.c:901
Code: 02 00 00 00 31 d2 e8 d9 91 01 00 bb ff ff ff ff e9 fd fc ff ff e8 4a de 65 f7 bb ff ff ff ff e9 ee fc ff ff e8 3b de 65 f7 90 <0f> 0b 90 e9 e5 ef ff ff 44 89 f7 44 89 fe e8 e7 df 65 f7 45 39 fe
RSP: 0018:ffffc90003a5f240 EFLAGS: 00010293
RAX: ffffffff8a2d8f35 RBX: 0000000000000000 RCX: ffff88802aab9dc0
RDX: 0000000000000000 RSI: 00000000ffffff5a RDI: 0000000000000000
RBP: ffffc90003a5f528 R08: ffffffff8a2d7f15 R09: 1ffffffff1f0bc0d
R10: dffffc0000000000 R11: ffffffff8a2d7d60 R12: ffff88802bd40000
R13: ffff88802bd400d8 R14: dffffc0000000000 R15: 00000000ffffff5a
FS:  0000555556214380(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020003000 CR3: 000000002cc64000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __netdev_start_xmit include/linux/netdevice.h:4990 [inline]
 netdev_start_xmit include/linux/netdevice.h:5004 [inline]
 xmit_one net/core/dev.c:3530 [inline]
 dev_hard_start_xmit+0x242/0x770 net/core/dev.c:3546
 sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3759 [inline]
 __dev_queue_xmit+0x1912/0x3b10 net/core/dev.c:4300
 packet_snd net/packet/af_packet.c:3081 [inline]
 packet_sendmsg+0x46a9/0x6130 net/packet/af_packet.c:3113
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a4/0x4f0 net/socket.c:2191
 __do_sys_sendto net/socket.c:2203 [inline]
 __se_sys_sendto net/socket.c:2199 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2199
 do_syscall_64+0xf9/0x240
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f781bf64b69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff10e503b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f781bf64b69
RDX: 0000000000003287 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00000000000f4240 R08: 0000000000000000 R09: 00000000000002ff
R10: 0000000004000002 R11: 0000000000000246 R12: 00007fff10e50420
R13: 0000000000010459 R14: 00007fff10e503ec R15: 0000000000000003
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/25 07:05 net-next d662c5b3ce6d 8d446f15 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ip6gre_tunnel_xmit
2024/02/25 12:08 net-next d662c5b3ce6d 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in ip6gre_tunnel_xmit
* Struck through repros no longer work on HEAD.