syzbot


BUG: corrupted list in neigh_destroy

Status: closed as invalid on 2026/05/19 12:06
Subsystems: net
[Documentation on labels]
First crash: 74d, last: 74d

Sample crash report:
 slab kmalloc-32 start fff0000017b8bdc0 pointer offset 17365880163140632576 size 32
list_del corruption. prev->next should be f7f000002d88de00, but was ffffc1ffc137bd00. (prev=f0f0000017b8bdc0)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:62!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 1 UID: 0 PID: 31390 Comm: kworker/u8:4 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: linux,dummy-virt (DT)
Workqueue: events_power_efficient neigh_periodic_work
pstate: 614020c9 (nZCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62
lr : __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62
sp : ffff80008be8bbf0
x29: ffff80008be8bbf0 x28: 0000000000000000 x27: ffff800082d1d3e0
x26: f6f000000eb5ee00 x25: dead000000000122 x24: 000000000000009d
x23: 0000000000000000 x22: ffffc1ffc137bd00 x21: f0f0000017b8bdc0
x20: f4f0000040190400 x19: f7f000002d88de00 x18: 0000000000000010
x17: 0000000000000000 x16: 0000000000000000 x15: ffff800082d7db2e
x14: 00000000ffffffea x13: ffff80008be8b868 x12: ffff800082b6f288
x11: ffff800082abf2e0 x10: ffff800082b6f2e0 x9 : 0000000000000001
x8 : 0000000000000001 x7 : 000000000002ffe8 x6 : c0000000ffffdfff
x5 : fff000007d8e6508 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : f5f00000035a3240 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid_or_report+0xd0/0x120 lib/list_debug.c:62 (P)
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:223 [inline]
 list_move_tail include/linux/list.h:318 [inline]
 ref_tracker_free+0xa8/0x278 lib/ref_tracker.c:329
 netdev_tracker_free include/linux/netdevice.h:4456 [inline]
 netdev_put include/linux/netdevice.h:4473 [inline]
 netdev_put include/linux/netdevice.h:4469 [inline]
 neigh_destroy+0x110/0x2b4 net/core/neighbour.c:941
 neigh_release include/net/neighbour.h:459 [inline]
 neigh_cleanup_and_release net/core/neighbour.c:121 [inline]
 neigh_periodic_work+0x2dc/0x33c net/core/neighbour.c:1030
 process_one_work+0x180/0x2d0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x184/0x2fc kernel/workqueue.c:3440
 kthread+0x118/0x124 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: aa1503e3 f000f6c0 910d6000 97e40c49 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/08 06:42 upstream 3036cd0d3328 2c961e87 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm64-mte BUG: corrupted list in neigh_destroy
* Struck through repros no longer work on HEAD.