syzbot


BUG: unable to handle kernel paging request in gro_cells_destroy

Status: closed as invalid on 2018/09/05 12:51
Subsystems: net
[Documentation on labels]
First crash: 2125d, last: 2067d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (5) net 2 1797d 1803d 0/26 closed as invalid on 2019/06/15 03:25
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (3) net 3 1864d 1881d 11/26 fixed on 2019/03/28 12:00
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (4) net 1 1832d 1832d 0/26 closed as invalid on 2019/05/15 23:07
upstream BUG: unable to handle kernel paging request in gro_cells_destroy (2) net 2 1926d 1937d 0/26 closed as invalid on 2019/02/06 03:52

Sample crash report:
BUG: unable to handle kernel paging request at ffffe8ff00000000
PGD 1d04c9067 P4D 1d04c9067 PUD 0 
Oops: 0000 [#1] SMP PTI
CPU: 1 PID: 265 Comm: kworker/u4:6 Not tainted 4.19.0-rc1+ #40
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:__skb_unlink include/linux/skbuff.h:1853 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:1873 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2596 [inline]
RIP: 0010:gro_cells_destroy+0x2bd/0x640 net/core/gro_cells.c:88
Code: 00 41 83 c4 ff 4c 89 f7 e8 a0 7d d9 fa 89 18 85 db 0f 85 89 01 00 00 45 89 26 48 8b 5d a0 48 85 db 0f 85 8c 01 00 00 4d 89 ec <4d> 8b 7d 00 4c 89 ef e8 97 7d d9 fa 4d 8d 75 08 4c 8b 28 8b 02 89
RSP: 0018:ffff8801d4f1f900 EFLAGS: 00010246
RAX: ffff880127f8d010 RBX: 0000000000000000 RCX: ffff880127f8c010
RDX: ffff880127f8c010 RSI: aaaaaaaaaaaab000 RDI: ffffea0006efd420
RBP: ffff8801d4f1f998 R08: 0000000000480000 R09: ffff88021fd39250
R10: 0000000000000000 R11: ffffffff87887060 R12: ffffe8ff00000000
R13: ffffe8ff00000000 R14: ffffe8ffffc83010 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ff00000000 CR3: 0000000074d96000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ip_tunnel_dev_free+0x3b/0xa0 net/ipv4/ip_tunnel.c:960
 netdev_run_todo+0x10c5/0x14d0 net/core/dev.c:8736
 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:117
 ip_tunnel_delete_nets+0x68a/0x6a0 net/ipv4/ip_tunnel.c:1074
 erspan_exit_batch_net+0x6c/0x80 net/ipv4/ip_gre.c:1657
 ops_exit_list net/core/net_namespace.c:156 [inline]
 cleanup_net+0xbbb/0x16c0 net/core/net_namespace.c:551
 process_one_work+0x1605/0x1f40 kernel/workqueue.c:2153
 worker_thread+0x11a2/0x2590 kernel/workqueue.c:2296
 kthread+0x465/0x4a0 kernel/kthread.c:247
 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:416
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: ffffe8ff00000000
---[ end trace 7a5700e3e3e6c9a8 ]---
RIP: 0010:__skb_unlink include/linux/skbuff.h:1853 [inline]
RIP: 0010:__skb_dequeue include/linux/skbuff.h:1873 [inline]
RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2596 [inline]
RIP: 0010:gro_cells_destroy+0x2bd/0x640 net/core/gro_cells.c:88
Code: 00 41 83 c4 ff 4c 89 f7 e8 a0 7d d9 fa 89 18 85 db 0f 85 89 01 00 00 45 89 26 48 8b 5d a0 48 85 db 0f 85 8c 01 00 00 4d 89 ec <4d> 8b 7d 00 4c 89 ef e8 97 7d d9 fa 4d 8d 75 08 4c 8b 28 8b 02 89
RSP: 0018:ffff8801d4f1f900 EFLAGS: 00010246
RAX: ffff880127f8d010 RBX: 0000000000000000 RCX: ffff880127f8c010
RDX: ffff880127f8c010 RSI: aaaaaaaaaaaab000 RDI: ffffea0006efd420
RBP: ffff8801d4f1f998 R08: 0000000000480000 R09: ffff88021fd39250
R10: 0000000000000000 R11: ffffffff87887060 R12: ffffe8ff00000000
R13: ffffe8ff00000000 R14: ffffe8ffffc83010 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88021fd00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe8ff00000000 CR3: 0000000074d96000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/09/04 14:47 https://github.com/google/kmsan.git master 28f0ca98eadf a4718693 .config console log report ci-upstream-kmsan-gce
2018/09/01 02:23 https://github.com/google/kmsan.git master 28f0ca98eadf a4718693 .config console log report ci-upstream-kmsan-gce
2018/08/14 04:39 https://github.com/google/kmsan.git master 0cc51dc9a291 7a88b141 .config console log report ci-upstream-kmsan-gce
2018/07/24 02:50 https://github.com/google/kmsan.git master d1c2a46a46f6 912c93d7 .config console log report ci-upstream-kmsan-gce
2018/07/08 11:05 https://github.com/google/kmsan.git master a00de5aa4da3 c9a7a4dc .config console log report ci-upstream-kmsan-gce
* Struck through repros no longer work on HEAD.