general protection fault in ip6_dst_destroy

Status: upstream: reported C repro on 2019/10/25 22:35
Reported-by: syzbot+5766161b0f1a98a4e4c1@syzkaller.appspotmail.com
First crash: 2485d, last: 1679d
Fix bisection the fix commit could be any of (bisect log):
  b98aebd29824 Linux 4.14.150
  56dfe6252c68 Linux 4.14.188
   
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: corrupted list in ip6_dst_destroy net 8 syz, C done 1 1288d 1288d 0/29 auto-obsoleted due to no activity on 2023/06/24 14:48
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2023/02/08 22:32 9m retest repro linux-4.14.y report log
2023/02/08 21:32 9m retest repro linux-4.14.y report log
2022/09/18 16:29 10m retest repro linux-4.14.y report log
2022/09/18 15:29 11m retest repro linux-4.14.y report log
▶ ▼ Fix bisection attempts (8)
Created Duration User Patch Repo Result
2020/07/11 01:41 30m bisect fix linux-4.14.y OK (2) job log
2020/06/11 01:17 23m bisect fix linux-4.14.y OK (0) job log log
2020/05/12 00:37 27m bisect fix linux-4.14.y OK (0) job log log
2020/04/12 00:13 24m bisect fix linux-4.14.y OK (0) job log log
2020/03/12 23:46 26m bisect fix linux-4.14.y OK (0) job log log
2020/02/11 23:12 24m bisect fix linux-4.14.y OK (0) job log log
2020/01/12 16:34 24m bisect fix linux-4.14.y OK (0) job log log
2019/12/13 15:36 23m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.14.240-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880b5464340 task.stack: ffff8880b5470000
RIP: 0010:__lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369
RSP: 0018:ffff8880ba507b98 EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000018
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8880b5464340 R12: 0000000000000018
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8bebdd40
FS:  0000000000000000(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004bb218 CR3: 0000000008e6a000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
 _raw_spin_lock_bh+0x2f/0x40 kernel/locking/spinlock.c:176
 spin_lock_bh include/linux/spinlock.h:322 [inline]
 rt6_uncached_list_del net/ipv6/route.c:144 [inline]
 ip6_dst_destroy+0x108/0x390 net/ipv6/route.c:402
 dst_destroy+0xc0/0x390 net/core/dst.c:129
 __rcu_reclaim kernel/rcu/rcu.h:195 [inline]
 rcu_do_batch kernel/rcu/tree.c:2699 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
 rcu_process_callbacks+0x780/0x1180 kernel/rcu/tree.c:2946
 __do_softirq+0x24d/0x9ff kernel/softirq.c:288
 invoke_softirq kernel/softirq.c:368 [inline]
 irq_exit+0x193/0x240 kernel/softirq.c:409
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106
 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793
 </IRQ>
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
RSP: 0018:ffff8880b5477e68 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: 1ffffffff11e125c RBX: dffffc0000000000 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880b5464bc4
RBP: ffffffff88f092d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffed1016a8c868
R13: ffff8880b5464340 R14: 0000000000000000 R15: 0000000000000000
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 default_idle+0x47/0x370 arch/x86/kernel/process.c:558
 cpuidle_idle_call kernel/sched/idle.c:156 [inline]
 do_idle+0x250/0x3c0 kernel/sched/idle.c:246
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:351
 start_secondary+0x4db/0x670 arch/x86/kernel/smpboot.c:272
 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240
Code: 18 00 00 00 00 48 81 c4 80 01 00 00 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 67 2a 00 00 49 81 3c 24 a0 97 2e 8b 0f 84 5f 
RIP: __lock_acquire+0x1cc/0x3f20 kernel/locking/lockdep.c:3369 RSP: ffff8880ba507b98
---[ end trace d78507bdbdd801a2 ]---

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/25 23:13 linux-4.14.y 964f3712e6a7 4d1b57d4 .config console log report syz C ci2-linux-4-14 general protection fault in ip6_dst_destroy
2019/10/25 21:35 linux-4.14.y b98aebd29824 04ca72cd .config console log report syz C ci2-linux-4-14
2022/01/09 01:28 linux-4.14.y bfdef05c8da4 2ca0d385 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/05/08 01:38 linux-4.14.y 7d7d1c0ab3eb bc5434be .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/05/07 15:34 linux-4.14.y 7d7d1c0ab3eb f6da8120 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/05/04 06:32 linux-4.14.y 7d7d1c0ab3eb 09efdd63 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/04/25 23:07 linux-4.14.y cf256fbcbe34 2a82f1b3 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/04/19 10:54 linux-4.14.y cf256fbcbe34 50f523d7 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/04/15 23:01 linux-4.14.y 958e517f4e16 c59079a6 .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2021/03/30 16:18 linux-4.14.y bd634aa64163 6a81331a .config console log report info ci2-linux-4-14 general protection fault in ip6_dst_destroy
2020/11/30 04:28 linux-4.14.y 87335852c5d9 a0092f9d .config console log report info ci2-linux-4-14
* Struck through repros no longer work on HEAD.