bisecting fixing commit since 4fccc2503536a564a4ba31a1d50439854201659f
building syzkaller on 2c36e7a75f8689b3da20e1a81a2ee5391f3af6e5
testing commit 4fccc2503536a564a4ba31a1d50439854201659f
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 1c4a88c17f98d6e8d2c4c505572319b01219f893459f8ad0c57156dfd73f9a3b
all runs: crashed: general protection fault in macvlan_hard_header
testing current HEAD 4938296e03bd227e5020d63d418956fe52baf97c
testing commit 4938296e03bd227e5020d63d418956fe52baf97c
compiler: gcc version 8.4.1 20210217 (GCC)
kernel signature: 8e2611148311b39eb3ab1bcc3e1cd0590b703b6d09b87274eb3d482d019629b9
all runs: crashed: general protection fault in macvlan_hard_header
revisions tested: 2, total time: 29m21.941744741s (build: 22m7.231738689s, test: 6m31.5994099s)
the crash still happens on HEAD
commit msg: Linux 4.19.198
crash: general protection fault in macvlan_hard_header
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
netlink: 'syz-executor.5': attribute type 10 has an invalid length.
team0: Device macvtap0 is up. Set it down before adding it as a team port
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 3149 Comm: kworker/0:2 Not tainted 4.19.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:dev_hard_header include/linux/netdevice.h:2883 [inline]
RIP: 0010:macvlan_hard_header+0x7e/0x190 drivers/net/macvlan.c:593
Code: c1 ee 03 80 3c 06 00 0f 85 82 00 00 00 4c 8b a3 20 02 00 00 4d 85 e4 74 3a 48 b8 00 00 00 00 00 fc ff df 4c 89 e6 48 c1 ee 03 <80> 3c 06 00 0f 85 b3 00 00 00 49 8b 04 24 48 85 c0 74 16 48 89 de
RSP: 0018:ffff8881f68078d8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffffffff895b5420 RCX: ffff8881d9eee1b8
RDX: 00000000000086dd RSI: 00000006e0044006 RDI: ffffffff895b5640
RBP: ffff8881f6807918 R08: ffff8881d4483810 R09: 0000000000000060
R10: 1ffff1103a2c0e5e R11: 0000000000000000 R12: 0000003700220037
R13: ffff8881d9cc0640 R14: ffff8881d9cc0640 R15: ffff8881d9eee040
FS:  0000000000000000(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200000c0 CR3: 000000000846d005 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 dev_hard_header include/linux/netdevice.h:2886 [inline]
 neigh_resolve_output net/core/neighbour.c:1369 [inline]
 neigh_resolve_output+0x46c/0x810 net/core/neighbour.c:1354
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0x8f6/0x2200 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x3c8/0xf90 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x1bf/0x660 net/ipv6/ip6_output.c:209
 dst_output include/net/dst.h:455 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 mld_sendpack+0x87c/0xcd0 net/ipv6/mcast.c:1681
 mld_send_cr net/ipv6/mcast.c:1977 [inline]
 mld_ifc_timer_expire+0x372/0x740 net/ipv6/mcast.c:2476
 call_timer_fn+0x14c/0x510 kernel/time/timer.c:1338
 expire_timers kernel/time/timer.c:1375 [inline]
 __run_timers kernel/time/timer.c:1696 [inline]
 __run_timers kernel/time/timer.c:1664 [inline]
 run_timer_softirq+0xb63/0x1180 kernel/time/timer.c:1709
 __do_softirq+0x25f/0x919 kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1092
 </IRQ>
 do_softirq.part.13+0x126/0x160 kernel/softirq.c:336
 do_softirq kernel/softirq.c:328 [inline]
 __local_bh_enable_ip+0x21d/0x260 kernel/softirq.c:189
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
 _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:200
 spin_unlock_bh include/linux/spinlock.h:374 [inline]
 __fib6_clean_all+0xe3/0x1d0 net/ipv6/ip6_fib.c:2065
 fib6_flush_trees+0x1b/0x20 net/ipv6/ip6_fib.c:2081
 rt_genid_bump_ipv6 include/net/net_namespace.h:422 [inline]
 addrconf_dad_completed+0x513/0xba0 net/ipv6/addrconf.c:4166
 addrconf_dad_work+0x63e/0xfb0 net/ipv6/addrconf.c:4063
 process_one_work+0x830/0x1670 kernel/workqueue.c:2153
 worker_thread+0x85/0xb60 kernel/workqueue.c:2296
 kthread+0x347/0x410 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace cacd3081e511d297 ]---
kasan: CONFIG_KASAN_INLINE enabled
RIP: 0010:dev_hard_header include/linux/netdevice.h:2883 [inline]
RIP: 0010:macvlan_hard_header+0x7e/0x190 drivers/net/macvlan.c:593
kasan: GPF could be caused by NULL-ptr deref or user memory access
Code: c1 ee 03 80 3c 06 00 0f 85 82 00 00 00 4c 8b a3 20 02 00 00 4d 85 e4 74 3a 48 b8 00 00 00 00 00 fc ff df 4c 89 e6 48 c1 ee 03 <80> 3c 06 00 0f 85 b3 00 00 00 49 8b 04 24 48 85 c0 74 16 48 89 de
general protection fault: 0000 [#2] PREEMPT SMP KASAN
RSP: 0018:ffff8881f68078d8 EFLAGS: 00010207
CPU: 1 PID: 3395 Comm: systemd-journal Tainted: G      D           4.19.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:dev_hard_header include/linux/netdevice.h:2883 [inline]
RIP: 0010:macvlan_hard_header+0x7e/0x190 drivers/net/macvlan.c:593
Code: c1 ee 03 80 3c 06 00 0f 85 82 00 00 00 4c 8b a3 20 02 00 00 4d 85 e4 74 3a 48 b8 00 00 00 00 00 fc ff df 4c 89 e6 48 c1 ee 03 <80> 3c 06 00 0f 85 b3 00 00 00 49 8b 04 24 48 85 c0 74 16 48 89 de
RAX: dffffc0000000000 RBX: ffffffff895b5420 RCX: ffff8881d9eee1b8
RSP: 0000:ffff8881f6907888 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffffffff895b5420 RCX: ffff8881d9e62178
RDX: 00000000000086dd RSI: 00000006e0044006 RDI: ffffffff895b5640
RBP: ffff8881f69078c8 R08: ffff8881f3d92e90 R09: 0000000000000060
R10: 1ffff1103a4765a6 R11: 0000000000000000 R12: 0000003700220037
R13: ffff8881daba0440 R14: ffff8881daba0440 R15: ffff8881d9e62000
FS:  00007ff8974748c0(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000
RDX: 00000000000086dd RSI: 00000006e0044006 RDI: ffffffff895b5640
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff894845000 CR3: 00000001e14ed004 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
RBP: ffff8881f6807918 R08: ffff8881d4483810 R09: 0000000000000060
 <IRQ>
R10: 1ffff1103a2c0e5e R11: 0000000000000000 R12: 0000003700220037
 dev_hard_header include/linux/netdevice.h:2886 [inline]
 neigh_resolve_output net/core/neighbour.c:1369 [inline]
 neigh_resolve_output+0x46c/0x810 net/core/neighbour.c:1354
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0x8f6/0x2200 net/ipv6/ip6_output.c:120
R13: ffff8881d9cc0640 R14: ffff8881d9cc0640 R15: ffff8881d9eee040
 ip6_finish_output+0x3c8/0xf90 net/ipv6/ip6_output.c:192
FS:  0000000000000000(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x1bf/0x660 net/ipv6/ip6_output.c:209
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 dst_output include/net/dst.h:455 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 NF_HOOK include/linux/netfilter.h:283 [inline]
 mld_sendpack+0x87c/0xcd0 net/ipv6/mcast.c:1681
CR2: 00000000200000c0 CR3: 000000000846d005 CR4: 00000000001606f0
 mld_send_cr net/ipv6/mcast.c:1977 [inline]
 mld_ifc_timer_expire+0x372/0x740 net/ipv6/mcast.c:2476
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 call_timer_fn+0x14c/0x510 kernel/time/timer.c:1338
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 expire_timers kernel/time/timer.c:1375 [inline]
 __run_timers kernel/time/timer.c:1696 [inline]
 __run_timers kernel/time/timer.c:1664 [inline]
 run_timer_softirq+0xb63/0x1180 kernel/time/timer.c:1709