bisecting fixing commit since 5631c5e0eb9035d92ceb20fcd9cdb7779a3f5cc7
building syzkaller on ff51e5229e0ee846d2fd687cb0dbca13de758c66
testing commit 5631c5e0eb9035d92ceb20fcd9cdb7779a3f5cc7 with gcc (GCC) 8.1.0
kernel signature: 614fa130ed682761ae96a6eed809ee2a90d9bdb6982686eaef5dc23e61afac1b
run #0: crashed: general protection fault in if_nlmsg_size
run #1: crashed: general protection fault in if_nlmsg_size
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing current HEAD b5fc7a89e58bcc059a3d5e4db79c481fb437de59
testing commit b5fc7a89e58bcc059a3d5e4db79c481fb437de59 with gcc (GCC) 8.1.0
kernel signature: e49362afc973b0f48d8f266d42cce349988fb5e2a41484a26661b8e3c4320bc5
run #0: crashed: general protection fault in if_nlmsg_size
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
revisions tested: 2, total time: 29m47.613210686s (build: 10m3.602276878s, test: 19m11.112179465s)
the crash still happens on HEAD
commit msg: Merge tag 'overflow-v5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
crash: general protection fault in if_nlmsg_size
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
general protection fault, probably for non-canonical address 0xff88810fa6ebd0ef: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 297 Comm: kworker/u4:3 Not tainted 5.9.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:rtnl_prop_list_size net/core/rtnetlink.c:998 [inline]
RIP: 0010:if_nlmsg_size+0x20a/0x3f0 net/core/rtnetlink.c:1060
Code: 8b 51 10 48 8d 41 10 48 83 e6 f4 48 83 c6 14 48 39 c2 0f 84 e2 01 00 00 48 8b 41 10 48 8d 50 f0 b8 04 00 00 00 48 39 ca 74 13 <48> 8b 52 10 48 05 84 00 00 00 48 83 ea 10 48 39 ca 75 ed 48 8d 65
RSP: 0018:ffffc9000156fc28 EFLAGS: 00010287
RAX: 0000000000000004 RBX: ffffffff8461e480 RCX: ffff88810fa6ebbf
RDX: ff88810fa6ebd0ef RSI: 0000000000000008 RDI: 0000000000000282
RBP: ffffc9000156fc58 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000754
R13: 0000000000000014 R14: 0000000000000344 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88812c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555954be0ed8 CR3: 000000012af2b000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rtmsg_ifinfo_build_skb+0x37/0xe0 net/core/rtnetlink.c:3804
 rtmsg_ifinfo_event.part.42+0x12/0x40 net/core/rtnetlink.c:3840
 rtmsg_ifinfo_event net/core/rtnetlink.c:3851 [inline]
 rtmsg_ifinfo+0x19/0x20 net/core/rtnetlink.c:3849
 dev_close_many+0xd1/0x140 net/core/dev.c:1633
 rollback_registered_many+0x118/0x4e0 net/core/dev.c:9324
 unregister_netdevice_many+0x12/0x70 net/core/dev.c:10509
 default_device_exit_batch+0x14b/0x170 net/core/dev.c:10992
 cleanup_net+0x273/0x3d0 net/core/net_namespace.c:603
 process_one_work+0x273/0x600 kernel/workqueue.c:2269
 worker_thread+0x38/0x380 kernel/workqueue.c:2415
 kthread+0x148/0x170 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
---[ end trace 3850796ea130ec99 ]---
RIP: 0010:rtnl_prop_list_size net/core/rtnetlink.c:998 [inline]
RIP: 0010:if_nlmsg_size+0x20a/0x3f0 net/core/rtnetlink.c:1060
Code: 8b 51 10 48 8d 41 10 48 83 e6 f4 48 83 c6 14 48 39 c2 0f 84 e2 01 00 00 48 8b 41 10 48 8d 50 f0 b8 04 00 00 00 48 39 ca 74 13 <48> 8b 52 10 48 05 84 00 00 00 48 83 ea 10 48 39 ca 75 ed 48 8d 65
RSP: 0018:ffffc9000156fc28 EFLAGS: 00010287
RAX: 0000000000000004 RBX: ffffffff8461e480 RCX: ffff88810fa6ebbf
RDX: ff88810fa6ebd0ef RSI: 0000000000000008 RDI: 0000000000000282
RBP: ffffc9000156fc58 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000754
R13: 0000000000000014 R14: 0000000000000344 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88812c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555954be0ed8 CR3: 000000012af2b000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400