bisecting fixing commit since 6dd0e32665e591e9debe3edaf73c2f8135bf047e building syzkaller on 17a986e54c507287c078a70fa9eea0be9f191f84 testing commit 6dd0e32665e591e9debe3edaf73c2f8135bf047e with gcc (GCC) 8.1.0 kernel signature: b60476405ad06ca4e6a5b7c986eab5be12d1cc502bf8bae466b30faecf615f9d all runs: crashed: WARNING in bpf_warn_invalid_xdp_action testing current HEAD c14d30dc9987047b439b03d6e6db7d54d9f7f180 testing commit c14d30dc9987047b439b03d6e6db7d54d9f7f180 with gcc (GCC) 8.1.0 kernel signature: a8181a216145bc3cd11fb203dd718fb20d7756f6abea3109396e5215ec936935 all runs: crashed: WARNING in bpf_warn_invalid_xdp_action revisions tested: 2, total time: 25m42.755445091s (build: 18m22.198265619s, test: 6m14.300945634s) the crash still happens on HEAD commit msg: Linux 4.19.139 crash: WARNING in bpf_warn_invalid_xdp_action batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready ------------[ cut here ]------------ Illegal XDP return value 2835492128, expect packet loss! WARNING: CPU: 0 PID: 8067 at net/core/filter.c:5539 bpf_warn_invalid_xdp_action+0x38/0x40 net/core/filter.c:5537 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 8067 Comm: syz-executor.3 Not tainted 4.19.139-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 panic+0x1cd/0x375 kernel/panic.c:186 __warn.cold.8+0x1b/0x3e kernel/panic.c:541 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:bpf_warn_invalid_xdp_action+0x38/0x40 net/core/filter.c:5537 Code: c7 c0 e0 65 c0 87 55 89 fa 48 c7 c6 a0 65 c0 87 48 89 e5 48 c7 c7 20 66 c0 87 c6 05 48 55 ae 03 01 48 0f 46 f0 e8 db 19 cb fb <0f> 0b 5d c3 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 RSP: 0018:ffff8880aea07c40 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888090bf1906 RCX: 0000000000000000 RDX: 0000000000000004 RSI: ffffffff87679040 RDI: ffffffff8a18a960 RBP: ffff8880aea07c40 R08: ffffed1015d45079 R09: ffffed1015d45078 R10: ffffed1015d45078 R11: ffff8880aea283c7 R12: dffffc0000000000 R13: ffff8880aea07d40 R14: ffff888090bf1840 R15: ffff88808c90c146 veth_xdp_rcv_skb drivers/net/veth.c:551 [inline] veth_xdp_rcv drivers/net/veth.c:602 [inline] veth_poll+0xfea/0x2e50 drivers/net/veth.c:622 napi_poll net/core/dev.c:6271 [inline] net_rx_action+0x470/0xe20 net/core/dev.c:6337 __do_softirq+0x260/0x92d kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:544 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1094 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:check_memory_region+0x14/0x1b0 mm/kasan/kasan.c:266 Code: e0 07 38 c2 40 0f 9e c6 eb c5 66 90 66 2e 0f 1f 84 00 00 00 00 00 48 85 f6 0f 84 3c 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 55 <0f> b6 d2 48 39 c7 48 89 e5 41 55 41 54 53 0f 86 11 01 00 00 4c 8d RSP: 0018:ffff8880a4ed75a0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: ffff7fffffffffff RBX: dffffc0000000000 RCX: ffffffff817dc9f4 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea0002022534 RBP: ffff8880a4ed75b0 R08: fffff940004043d7 R09: ffffea0002022508 R10: fffff940004043d6 R11: ffffea0002021eb7 R12: ffffea0002022534 R13: 0000000000000000 R14: ffff8880a505f028 R15: ffffea0002022500 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] page_ref_count include/linux/page_ref.h:67 [inline] put_page_testzero include/linux/mm.h:519 [inline] release_pages+0x144/0x1430 mm/swap.c:760 free_pages_and_swap_cache+0x17a/0x370 mm/swap_state.c:320 tlb_flush_mmu_free+0xb3/0x150 mm/memory.c:249 zap_pte_range mm/memory.c:1405 [inline] zap_pmd_range mm/memory.c:1440 [inline] zap_pud_range mm/memory.c:1469 [inline] zap_p4d_range mm/memory.c:1490 [inline] unmap_page_range+0x1005/0x17c0 mm/memory.c:1511 unmap_single_vma+0x121/0x300 mm/memory.c:1556 unmap_vmas+0xe7/0x1a0 mm/memory.c:1586 exit_mmap+0x251/0x450 mm/mmap.c:3091 __mmput kernel/fork.c:1015 [inline] mmput+0x107/0x3f0 kernel/fork.c:1036 exit_mm kernel/exit.c:546 [inline] do_exit+0x9cd/0x2dc0 kernel/exit.c:874 do_group_exit+0xf4/0x2f0 kernel/exit.c:990 get_signal+0x313/0x1a30 kernel/signal.c:2588 do_signal+0x87/0x1960 arch/x86/kernel/signal.c:821 exit_to_usermode_loop+0x114/0x200 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c909 Code: Bad RIP value. RSP: 002b:00007facfd971cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000076bfa8 RCX: 000000000045c909 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000076bfa8 RBP: 000000000076bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000076bfac R13: 00007ffe4b538fff R14: 00007facfd9729c0 R15: 000000000076bfac Kernel Offset: disabled Rebooting in 86400 seconds..