WARNING in batadv_iv_ogm_process_per_outif

Status: upstream: reported C repro on 2026/10/18 00:05
Reported-by: syzbot+36ce495c434f5abd6f66@syzkaller.appspotmail.com
First crash: 10d, last: 10d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in batadv_iv_ogm_process_per_outif prio:high batman -1 syz, C error 52 1d16h 45d 0/29 upstream: reported C repro on 2026/09/13 02:47

Sample crash report:
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4561 at net/batman-adv/bat_iv_ogm.c:1296 batadv_iv_ogm_update_seqnos net/batman-adv/bat_iv_ogm.c:1297 [inline]
WARNING: CPU: 0 PID: 4561 at net/batman-adv/bat_iv_ogm.c:1296 batadv_iv_ogm_process_per_outif+0x1a44/0x2204 net/batman-adv/bat_iv_ogm.c:1432
Modules linked in:
CPU: 0 PID: 4561 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : batadv_iv_ogm_update_seqnos net/batman-adv/bat_iv_ogm.c:1297 [inline]
pc : batadv_iv_ogm_process_per_outif+0x1a44/0x2204 net/batman-adv/bat_iv_ogm.c:1432
lr : batadv_iv_ogm_update_seqnos net/batman-adv/bat_iv_ogm.c:1296 [inline]
lr : batadv_iv_ogm_process_per_outif+0x1a40/0x2204 net/batman-adv/bat_iv_ogm.c:1432
sp : ffff800021fd71c0
x29: ffff800021fd7300 x28: 0000000000000000 x27: ffff7000043fae54
x26: ffff0000d132e000 x25: ffff0000d4eb8500 x24: dfff800000000000
x23: dfff800000000000 x22: dfff800000000000 x21: ffff0000d4680056
x20: 00000000ffff0000 x19: ffff0000d4680000 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082dd38c x15: 0000000000000000
x14: 0000000000000001 x13: 1fffe0001a265c31 x12: 0000000000000000
x11: ff0080001183a460 x10: 0000000000000000 x9 : ffff80001183a460
x8 : ffff0000c9285400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : 00000000ffffffff x4 : 0000000000000b20 x3 : 0000000000000000
x2 : ffff800021fd7060 x1 : ffff800011d2dc80 x0 : ffff0000d132e000
Call trace:
 batadv_iv_ogm_update_seqnos net/batman-adv/bat_iv_ogm.c:1297 [inline]
 batadv_iv_ogm_process_per_outif+0x1a44/0x2204 net/batman-adv/bat_iv_ogm.c:1432
 batadv_iv_ogm_process net/batman-adv/bat_iv_ogm.c:1752 [inline]
 batadv_iv_ogm_receive+0xb18/0x157c net/batman-adv/bat_iv_ogm.c:1844
 batadv_batman_skb_recv+0x418/0x808 net/batman-adv/main.c:497
 __netif_receive_skb_one_core net/core/dev.c:5620 [inline]
 __netif_receive_skb+0xd0/0x2b0 net/core/dev.c:5734
 netif_receive_skb_internal net/core/dev.c:5820 [inline]
 netif_receive_skb+0x1e8/0x928 net/core/dev.c:5879
 tun_rx_batched+0x4ac/0x600 drivers/net/tun.c:-1
 tun_get_user+0x1f70/0x3268 drivers/net/tun.c:2009
 tun_chr_write_iter+0xfc/0x200 drivers/net/tun.c:2055
 call_write_iter include/linux/fs.h:2271 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3c8/0x7c8 fs/read_write.c:584
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 4285
hardirqs last  enabled at (4284): [<ffff8000081ad574>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (4285): [<ffff800011bc7440>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (4232): [<ffff80000c8f1740>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (4234): [<ffff80000c8f170c>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface deactivated: syzkaller0
batman_adv: batadv0: Removing interface: syzkaller0

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/18 02:14 linux-6.1.y 79807e970724 432c0077 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in batadv_iv_ogm_process_per_outif
2026/10/18 01:29 linux-6.1.y 79807e970724 432c0077 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in batadv_iv_ogm_process_per_outif
2026/10/18 00:43 linux-6.1.y 79807e970724 432c0077 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in batadv_iv_ogm_process_per_outif
2026/10/18 00:04 linux-6.1.y 79807e970724 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in batadv_iv_ogm_process_per_outif
* Struck through repros no longer work on HEAD.