Hello, We are reporting the following crash (reproducer and a proposed patch attached): Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713 Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 50.238797][ T56] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.241338][ T56] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.241848][ T56] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.245626][ T56] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.245912][ T56] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.754952][ T9494] skbuff: skb_under_panic: text:ffffffff8b7fa50d len:64 put:28 head:ffff888111738000 data:ffff888111737ff4 tail:0x34 end:0x180 dev:bt0 [ 50.755855][ T9494] ------------[ cut here ]------------ [ 50.755867][ T9494] kernel BUG at net/core/skbuff.c:214! [ 50.755943][ T9494] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 50.768411][ T9494] CPU: 1 UID: 0 PID: 9494 Comm: repro Not tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full) [ 50.770445][ T9494] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014 [ 50.772451][ T9494] RIP: 0010:skb_panic+0x157/0x160 [ 50.773445][ T9494] Code: c7 c0 a8 01 8d 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 4e 84 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 50.777065][ T9494] RSP: 0018:ffffc900071b6ea0 EFLAGS: 00010286 [ 50.777983][ T9494] RAX: 0000000000000084 RBX: dffffc0000000000 RCX: 4ccd4c5bba686000 [ 50.778782][ T9494] RDX: 0000000000000000 RSI: 8000000000000201 RDI: 0000000000000000 [ 50.779550][ T9494] RBP: 0000000000000180 R08: ffffc900071b6c07 R09: 1ffff92000e36d80 [ 50.780352][ T9494] R10: dffffc0000000000 R11: fffff52000e36d81 R12: ffff88810804e290 [ 50.781105][ T9494] R13: ffff888111738000 R14: ffff888111737ff4 R15: 0000000000000034 [ 50.781865][ T9494] FS: 000000002fb9b400(0000) GS:ffff8881da588000(0000) knlGS:0000000000000000 [ 50.782727][ T9494] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.783410][ T9494] CR2: 000055f09acf9258 CR3: 0000000022ecb000 CR4: 0000000000752ef0 [ 50.784188][ T9494] PKRU: 55555554 [ 50.784546][ T9494] Call Trace: [ 50.784881][ T9494] <TASK> [ 50.785181][ T9494] ? lowpan_header_compress+0x11dd/0x1ee0 [ 50.785759][ T9494] ? lowpan_header_compress+0x11dd/0x1ee0 [ 50.786308][ T9494] skb_push+0xc3/0xe0 [ 50.786705][ T9494] lowpan_header_compress+0x11dd/0x1ee0 [ 50.787246][ T9494] ? __pfx_lowpan_header_compress+0x10/0x10 [ 50.787822][ T9494] ? lock_acquire+0x115/0x350 [ 50.788284][ T9494] ? skb_copy_bits+0x8a/0x8f0 [ 50.788745][ T9494] ? bt_xmit+0x283/0x2280 [ 50.789179][ T9494] bt_xmit+0x12c8/0x2280 [ 50.789603][ T9494] ? __pfx_bt_xmit+0x10/0x10 [ 50.790100][ T9494] ? skb_network_protocol+0x23d/0x400 [ 50.790623][ T9494] ? netif_skb_features+0xdf0/0x1480 [ 50.791135][ T9494] ? lockdep_unlock+0x5c/0xd0 [ 50.791595][ T9494] ? __lock_acquire+0x25db/0x2db0 [ 50.792082][ T9494] ? __pfx_netif_skb_features+0x10/0x10 [ 50.792620][ T9494] ? packet_sendmsg+0x3039/0x4d00 [ 50.793108][ T9494] ? sock_sendmsg_nosec+0x13a/0x180 [ 50.793635][ T9494] ? __sys_sendto+0x408/0x5a0 [ 50.794103][ T9494] ? __x64_sys_sendto+0xde/0x100 [ 50.794599][ T9494] ? do_syscall_64+0x155/0x510 [ 50.795065][ T9494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 50.795654][ T9494] dev_hard_start_xmit+0x2cd/0x830 [ 50.796153][ T9494] sch_direct_xmit+0x251/0x4c0 [ 50.796624][ T9494] ? __pfx_sch_direct_xmit+0x10/0x10 [ 50.797135][ T9494] ? qdisc_bstats_update+0x110/0x1d0 [ 50.797652][ T9494] __dev_queue_xmit+0x19ef/0x3980 [ 50.798140][ T9494] ? __dev_queue_xmit+0x2b6/0x3980 [ 50.798637][ T9494] ? _copy_from_iter+0x21b/0x1670 [ 50.799132][ T9494] ? __pfx___dev_queue_xmit+0x10/0x10 [ 50.799653][ T9494] ? sock_alloc_send_pskb+0x896/0x990 [ 50.800221][ T9494] ? __pfx__copy_from_iter+0x10/0x10 [ 50.800733][ T9494] ? packet_parse_headers+0x2e6/0x790 [ 50.801250][ T9494] ? packet_parse_headers+0x5dd/0x790 [ 50.801772][ T9494] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 50.802340][ T9494] ? __pfx_packet_parse_headers+0x10/0x10 [ 50.802906][ T9494] ? packet_xmit+0x68/0x320 [ 50.803358][ T9494] packet_sendmsg+0x3b14/0x4d00 [ 50.803852][ T9494] ? aa_inet_bind_perm+0x6b6/0xca0 [ 50.804360][ T9494] ? kasan_save_track+0x4f/0x80 [ 50.804838][ T9494] ? kasan_save_track+0x3e/0x80 [ 50.805310][ T9494] ? __kasan_slab_alloc+0x6c/0x80 [ 50.805811][ T9494] ? kmem_cache_alloc_noprof+0x2bd/0x610 [ 50.806355][ T9494] ? __lock_acquire+0x74c/0x2db0 [ 50.806847][ T9494] ? __pfx_packet_sendmsg+0x10/0x10 [ 50.807352][ T9494] ? aa_sk_perm+0x713/0x900 [ 50.807801][ T9494] ? update_triggers+0x320/0x4d0 [ 50.808282][ T9494] ? __pfx_aa_sk_perm+0x10/0x10 [ 50.808760][ T9494] ? aa_sock_msg_perm+0x144/0x210 [ 50.809251][ T9494] ? apparmor_socket_sendmsg+0x95/0x390 [ 50.809793][ T9494] ? __pfx_packet_sendmsg+0x10/0x10 [ 50.810343][ T9494] sock_sendmsg_nosec+0x13a/0x180 [ 50.810833][ T9494] __sys_sendto+0x408/0x5a0 [ 50.811275][ T9494] ? __pfx___sys_sendto+0x10/0x10 [ 50.811769][ T9494] ? fd_install+0x94/0x3d0 [ 50.812202][ T9494] ? fd_install+0x309/0x3d0 [ 50.812647][ T9494] __x64_sys_sendto+0xde/0x100 [ 50.813112][ T9494] do_syscall_64+0x155/0x510 [ 50.813567][ T9494] ? trace_irq_disable+0x3b/0x140 [ 50.814057][ T9494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 50.814644][ T9494] ? clear_bhb_loop+0x30/0x80 [ 50.815101][ T9494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 50.815675][ T9494] RIP: 0033:0x4527b2 [ 50.816062][ T9494] Code: 08 0f 85 e1 df ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 50.817904][ T9494] RSP: 002b:00007ffc7bf0a438 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 50.818725][ T9494] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00000000004527b2 [ 50.819496][ T9494] RDX: 0000000000000024 RSI: 00007ffc7bf0a4c0 RDI: 0000000000000003 [ 50.820334][ T9494] RBP: 00007ffc7bf0a460 R08: 00007ffc7bf0a4a0 R09: 0000000000000014 [ 50.821106][ T9494] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7bf0a618 [ 50.821873][ T9494] R13: 00007ffc7bf0a628 R14: 0000000000000002 R15: 00000000004cba40 [ 50.822631][ T9494] </TASK> [ 50.822957][ T9494] Modules linked in: [ 50.823408][ T9494] ---[ end trace 0000000000000000 ]--- [ 50.823952][ T9494] RIP: 0010:skb_panic+0x157/0x160 [ 50.823964][ T9494] Code: c7 c0 a8 01 8d 48 8b 74 24 08 48 8b 54 24 10 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 55 41 57 41 56 e8 4e 84 f5 ff 48 83 c4 20 90 <0f> 0b cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 50.823970][ T9494] RSP: 0018:ffffc900071b6ea0 EFLAGS: 00010286 [ 50.823976][ T9494] RAX: 0000000000000084 RBX: dffffc0000000000 RCX: 4ccd4c5bba686000 [ 50.823981][ T9494] RDX: 0000000000000000 RSI: 8000000000000201 RDI: 0000000000000000 [ 50.823986][ T9494] RBP: 0000000000000180 R08: ffffc900071b6c07 R09: 1ffff92000e36d80 [ 50.823991][ T9494] R10: dffffc0000000000 R11: fffff52000e36d81 R12: ffff88810804e290 [ 50.823996][ T9494] R13: ffff888111738000 R14: ffff888111737ff4 R15: 0000000000000034 [ 50.824001][ T9494] FS: 000000002fb9b400(0000) GS:ffff8881da588000(0000) knlGS:0000000000000000 [ 50.824006][ T9494] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.824011][ T9494] CR2: 000055f09acf9258 CR3: 0000000022ecb000 CR4: 0000000000752ef0 [ 50.824017][ T9494] PKRU: 55555554 [ 50.824024][ T9494] Kernel panic - not syncing: Fatal exception in interrupt [ 50.834454][ T9494] Kernel Offset: disabled [ 50.835002][ T9494] Rebooting in 86400 seconds.. Regards, SEFCOM Lab @ ASU
207.patch
Description: Binary data
reproducer.c
Description: Binary data
