bisecting fixing commit since 252c765bd764a246a8bd516fabf6d6123df4a24f
building syzkaller on be531bb42381b245eed805e49fd889d1c2118c76
testing commit 252c765bd764a246a8bd516fabf6d6123df4a24f
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 543ba0a1ebee28ece5036b149a6ff8a18c85fa8e823417cf34eb13c1e489857f
run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe
run #1: crashed: WARNING in bpf_warn_invalid_xdp_action
run #2: crashed: WARNING in bpf_warn_invalid_xdp_action
run #3: crashed: WARNING in bpf_warn_invalid_xdp_action
run #4: crashed: WARNING in bpf_warn_invalid_xdp_action
run #5: crashed: BUG: corrupted list in netif_napi_add
run #6: crashed: WARNING in bpf_warn_invalid_xdp_action
run #7: crashed: WARNING in bpf_warn_invalid_xdp_action
run #8: crashed: WARNING in bpf_warn_invalid_xdp_action
run #9: crashed: WARNING in bpf_warn_invalid_xdp_action
run #10: crashed: WARNING in bpf_warn_invalid_xdp_action
run #11: crashed: WARNING in bpf_warn_invalid_xdp_action
run #12: crashed: WARNING in bpf_warn_invalid_xdp_action
run #13: crashed: WARNING in bpf_warn_invalid_xdp_action
run #14: crashed: WARNING in bpf_warn_invalid_xdp_action
run #15: crashed: WARNING in bpf_warn_invalid_xdp_action
run #16: crashed: WARNING in bpf_warn_invalid_xdp_action
run #17: crashed: WARNING in bpf_warn_invalid_xdp_action
run #18: crashed: WARNING in bpf_warn_invalid_xdp_action
run #19: OK
testing current HEAD 4b443bc1785f28df56fdbd6a107dc68ef7d5aa8e
testing commit 4b443bc1785f28df56fdbd6a107dc68ef7d5aa8e
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 1a3b1e2cf27d8f666a478136a7989777a4297f7b688c04cf787f7de8b4ba1d32
all runs: crashed: WARNING in bpf_warn_invalid_xdp_action
revisions tested: 2, total time: 29m4.975399111s (build: 13m12.263082702s, test: 15m14.517801974s)
the crash still happens on HEAD
commit msg: libbpf: Don't validate TYPE_ID relo's original imm value
crash: WARNING in bpf_warn_invalid_xdp_action
------------[ cut here ]------------
Illegal XDP return value 16128, expect packet loss!
WARNING: CPU: 1 PID: 20 at net/core/filter.c:8187 bpf_warn_invalid_xdp_action net/core/filter.c:8187 [inline]
WARNING: CPU: 1 PID: 20 at net/core/filter.c:8187 bpf_warn_invalid_xdp_action+0x34/0x40 net/core/filter.c:8183
Modules linked in:
CPU: 1 PID: 20 Comm: kworker/1:0 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: 0x0 (events)
RIP: 0010:bpf_warn_invalid_xdp_action net/core/filter.c:8187 [inline]
RIP: 0010:bpf_warn_invalid_xdp_action+0x34/0x40 net/core/filter.c:8183
Code: 83 ff 04 48 c7 c0 e0 a0 c0 89 48 c7 c6 a0 a0 c0 89 c6 05 07 20 d4 05 01 48 0f 46 f0 89 fa 48 c7 c7 20 a1 c0 89 e8 f9 88 9f 01 <0f> 0b c3 66 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000dc09a0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff888076a60146 RCX: 0000000000000000
RDX: 0000000000000102 RSI: 0000000000000008 RDI: fffff520001b8126
RBP: ffff888076a60100 R08: 0000000000000000 R09: ffffc90000dc0617
R10: fffff520001b80c2 R11: 206c6167656c6c49 R12: ffffc90000dc0a20
R13: ffffc90001bee000 R14: ffff88806351bb40 R15: ffff88801d36d000
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9fa130b718 CR3: 000000000a88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
veth_xdp_rcv_skb+0x5d1/0x1770 drivers/net/veth.c:797
veth_xdp_rcv+0x2d0/0x750 drivers/net/veth.c:874
veth_poll+0x12d/0x6e0 drivers/net/veth.c:906
__napi_poll+0x96/0x360 net/core/dev.c:6360
napi_poll net/core/dev.c:6427 [inline]
net_rx_action+0x6fc/0xa50 net/core/dev.c:6514
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:kmap_local_sched_in kernel/sched/core.c:4758 [inline]
RIP: 0010:finish_task_switch.isra.0+0x323/0xb40 kernel/sched/core.c:4860
Code: 03 aa 31 07 85 c0 75 02 0f 0b 48 85 db 0f 85 ea 00 00 00 4c 89 f7 e8 fc f7 ff ff e8 27 f7 28 00 fb 65 48 8b 1c 25 40 70 02 00 <48> 8d bb b8 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc90000da7cb8 EFLAGS: 00000202
RAX: 000000000003fbd5 RBX: ffff8880109a8000 RCX: 1ffffffff19032a1
RDX: 0000000000000000 RSI: ffffffff88cb5700 RDI: ffffffff89216860
RBP: ffffc90000da7d00 R08: 0000000000000001 R09: 0000000000000001
R10: ffffed10173e7348 R11: 0000000000000001 R12: ffff8880b9f3a798
R13: ffff888078b93a00 R14: ffff8880b9f39a40 R15: ffff8880b9f3a478
context_switch kernel/sched/core.c:4975 [inline]
__schedule+0xa62/0x48f0 kernel/sched/core.c:6253
schedule+0xd2/0x260 kernel/sched/core.c:6326
worker_thread+0x14d/0x1040 kernel/workqueue.c:2466
kthread+0x3ab/0x480 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 03 aa 31 07 85 c0 add -0x3f7af8cf(%rdx),%ebp
6: 75 02 jne 0xa
8: 0f 0b ud2
a: 48 85 db test %rbx,%rbx
d: 0f 85 ea 00 00 00 jne 0xfd
13: 4c 89 f7 mov %r14,%rdi
16: e8 fc f7 ff ff callq 0xfffff817
1b: e8 27 f7 28 00 callq 0x28f747
20: fb sti
21: 65 48 8b 1c 25 40 70 mov %gs:0x27040,%rbx
28: 02 00
* 2a: 48 8d bb b8 15 00 00 lea 0x15b8(%rbx),%rdi <-- trapping instruction
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 48 89 fa mov %rdi,%rdx
3e: 48 rex.W
3f: c1 .byte 0xc1