Hello,
syzbot tried to test the proposed patch but the build/boot failed:
ithin address ffffc9000019f1c0 with insufficient space
for an object of type 'struct sk_buff'
CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
dump_stack+0x15/0x1d lib/dump_stack.c:135
ubsan_epilogue lib/ubsan.c:148 [inline]
handle_object_size_mismatch lib/ubsan.c:297 [inline]
ubsan_type_mismatch_common+0x1ed/0x3a0 lib/ubsan.c:310
__ubsan_handle_type_mismatch_v1+0x5b/0x70 lib/ubsan.c:339
__skb_insert include/linux/skbuff.h:1932 [inline]
__skb_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================
Warning: Permanently added '10.128.10.44' (ECDSA) to the list of known hosts.
2022/03/28 23:24:58 fuzzer started
2022/03/28 23:24:59 connecting to host at
10.128.0.163:35421
2022/03/28 23:24:59 checking machine...
2022/03/28 23:24:59 checking revisions...
2022/03/28 23:24:59 testing simple program...
[ 23.281867][ T23] audit: type=1400 audit(1648509899.229:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 23.300084][ T371] cgroup: Unknown subsys name 'net'
[ 23.305401][ T23] audit: type=1400 audit(1648509899.239:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 23.331657][ T23] audit: type=1400 audit(1648509899.239:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 23.331824][ T371] cgroup: Unknown subsys name 'devices'
[ 23.355195][ T23] audit: type=1400 audit(1648509899.239:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.383884][ T23] audit: type=1400 audit(1648509899.239:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.407542][ T23] audit: type=1400 audit(1648509899.249:78): avc: denied { mounton } for pid=371 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 23.430438][ T23] audit: type=1400 audit(1648509899.249:79): avc: denied { mount } for pid=371 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.452806][ T23] audit: type=1400 audit(1648509899.269:80): avc: denied { unmount } for pid=371 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.563603][ T371] cgroup: Unknown subsys name 'hugetlb'
[ 23.569777][ T371] cgroup: Unknown subsys name 'rlimit'
[ 23.633090][ T23] audit: type=1400 audit(1648509899.589:81): avc: denied { setattr } for pid=371 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.667273][ T23] audit: type=1400 audit(1648509899.619:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 23.721242][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.728409][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.736308][ T373] device bridge_slave_0 entered promiscuous mode
[ 23.743563][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.751036][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.758511][ T373] device bridge_slave_1 entered promiscuous mode
[ 23.788822][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.795977][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.803351][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.810544][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.829291][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.836599][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.844187][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 23.851659][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 23.861494][ T61] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 23.870114][ T61] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.877172][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.886594][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 23.894875][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.901897][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.922721][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 23.931067][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 23.939670][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 23.947711][ T19] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 23.957895][ T61] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 23.969161][ T61] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 23.981005][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 23.990020][ T24] ================================================================================
[ 23.999689][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 24.007570][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 24.016367][ T24] for an object of type 'struct sk_buff'
[ 24.022099][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 24.031879][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 24.042641][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 24.048604][ T24] Call Trace:
[ 24.052053][ T24] dump_stack_lvl+0x1e2/0x24b
[ 24.056708][ T24] ? show_regs_print_info+0x18/0x18
[ 24.061979][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 24.067687][ T24] dump_stack+0x15/0x1d
[ 24.071831][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 24.077535][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 24.083494][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 24.089451][ T24] wg_xmit+0x4a2/0xae0
[ 24.093522][ T24] ? wg_stop+0x5d0/0x5d0
[ 24.097938][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 24.104424][ T24] netdev_start_xmit+0x8a/0x160
[ 24.109346][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 24.114520][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 24.119633][ T24] ? dev_queue_xmit+0x20/0x20
[ 24.124303][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.130541][ T24] ? ndisc_constructor+0x690/0x8a0
[ 24.135812][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 24.141010][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 24.146276][ T24] ? dev_hard_header+0xdb/0xf0
[ 24.151041][ T24] dev_queue_xmit+0x17/0x20
[ 24.155535][ T24] neigh_connected_output+0x288/0x2b0
[ 24.160900][ T24] ip6_finish_output2+0xde2/0x1440
[ 24.166003][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.170779][ T24] ? __ip6_finish_output+0x520/0x520
[ 24.176053][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 24.181577][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.187992][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 24.192863][ T24] __ip6_finish_output+0x3e4/0x520
[ 24.197964][ T24] ip6_finish_output+0x3f/0x220
[ 24.202924][ T24] ? ip6_output+0x1d3/0x4b0
[ 24.207422][ T24] ip6_output+0x1f8/0x4b0
[ 24.211742][ T24] ? asan.module_dtor+0x20/0x20
[ 24.216748][ T24] ? skb_dst+0x40/0x40
[ 24.220890][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.225811][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 24.230990][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 24.236829][ T24] ? nf_hook_slow+0x150/0x1b0
[ 24.241480][ T24] NF_HOOK+0xdd/0x280
[ 24.245440][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 24.251049][ T24] ? NF_HOOK+0x280/0x280
[ 24.255272][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.260017][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.266603][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 24.271435][ T24] ? memcpy+0x56/0x70
[ 24.275488][ T24] ndisc_send_skb+0x646/0x9f0
[ 24.280145][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 24.285412][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 24.291109][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 24.296032][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 24.301734][ T24] ? skb_put+0x11d/0x210
[ 24.305983][ T24] ndisc_send_rs+0x26c/0x360
[ 24.310646][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 24.315996][ T24] ? addrconf_dad_stop+0x430/0x430
[ 24.321893][ T24] ? mutex_unlock+0x34/0x40
[ 24.326387][ T24] addrconf_dad_work+0x9c1/0x1520
[ 24.331482][ T24] ? move_linked_works+0x118/0x130
[ 24.336593][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 24.342460][ T24] ? __kasan_check_write+0x14/0x20
[ 24.347548][ T24] process_one_work+0x3ca/0x660
[ 24.352382][ T24] worker_thread+0x709/0xa20
[ 24.357048][ T24] ? __kthread_parkme+0x11b/0x150
[ 24.362091][ T24] kthread+0x389/0x3c0
[ 24.366137][ T24] ? pr_cont_work+0x110/0x110
[ 24.370790][ T24] ? __list_add+0xc0/0xc0
[ 24.375185][ T24] ret_from_fork+0x1f/0x30
[ 24.379716][ T24] ================================================================================
[ 24.389198][ T24] ================================================================================
[ 24.398975][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 24.406711][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 24.415152][ T24] for an object of type 'struct sk_buff'
[ 24.420792][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 24.430570][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 24.440615][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 24.446580][ T24] Call Trace:
[ 24.449846][ T24] dump_stack_lvl+0x1e2/0x24b
[ 24.454510][ T24] ? show_regs_print_info+0x18/0x18
[ 24.459686][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 24.465384][ T24] dump_stack+0x15/0x1d
[ 24.469613][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 24.475399][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 24.481645][ T24] wg_xmit+0x513/0xae0
[ 24.485698][ T24] ? wg_stop+0x5d0/0x5d0
[ 24.489916][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 24.496134][ T24] netdev_start_xmit+0x8a/0x160
[ 24.501087][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 24.506327][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 24.511380][ T24] ? dev_queue_xmit+0x20/0x20
[ 24.516060][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.522729][ T24] ? ndisc_constructor+0x690/0x8a0
[ 24.527839][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 24.533022][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 24.538310][ T24] ? dev_hard_header+0xdb/0xf0
[ 24.543067][ T24] dev_queue_xmit+0x17/0x20
[ 24.547678][ T24] neigh_connected_output+0x288/0x2b0
[ 24.553116][ T24] ip6_finish_output2+0xde2/0x1440
[ 24.558300][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.563060][ T24] ? __ip6_finish_output+0x520/0x520
[ 24.568406][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 24.573936][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.580760][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 24.585614][ T24] __ip6_finish_output+0x3e4/0x520
[ 24.590740][ T24] ip6_finish_output+0x3f/0x220
[ 24.595576][ T24] ? ip6_output+0x1d3/0x4b0
[ 24.600070][ T24] ip6_output+0x1f8/0x4b0
[ 24.604486][ T24] ? asan.module_dtor+0x20/0x20
[ 24.609495][ T24] ? skb_dst+0x40/0x40
[ 24.613539][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.618366][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 24.623561][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 24.629440][ T24] ? nf_hook_slow+0x150/0x1b0
[ 24.634169][ T24] NF_HOOK+0xdd/0x280
[ 24.638154][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 24.643985][ T24] ? NF_HOOK+0x280/0x280
[ 24.648215][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.653089][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.659421][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 24.664457][ T24] ? memcpy+0x56/0x70
[ 24.668422][ T24] ndisc_send_skb+0x646/0x9f0
[ 24.674956][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 24.680259][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 24.685824][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 24.690773][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 24.697006][ T24] ? skb_put+0x11d/0x210
[ 24.701429][ T24] ndisc_send_rs+0x26c/0x360
[ 24.706117][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 24.711481][ T24] ? addrconf_dad_stop+0x430/0x430
[ 24.717027][ T24] ? mutex_unlock+0x34/0x40
[ 24.721862][ T24] addrconf_dad_work+0x9c1/0x1520
[ 24.726915][ T24] ? move_linked_works+0x118/0x130
[ 24.732108][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 24.738056][ T24] ? __kasan_check_write+0x14/0x20
[ 24.743243][ T24] process_one_work+0x3ca/0x660
[ 24.748087][ T24] worker_thread+0x709/0xa20
[ 24.752664][ T24] ? __kthread_parkme+0x11b/0x150
[ 24.757679][ T24] kthread+0x389/0x3c0
[ 24.762222][ T24] ? pr_cont_work+0x110/0x110
[ 24.766929][ T24] ? __list_add+0xc0/0xc0
[ 24.771245][ T24] ret_from_fork+0x1f/0x30
[ 24.775719][ T24] ================================================================================
2022/03/28 23:25:00 building call list...
[ 24.794059][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 25.296216][ T9] device bridge_slave_1 left promiscuous mode
[ 25.302420][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 25.310033][ T9] device bridge_slave_0 left promiscuous mode
[ 25.316671][ T9] bridge0: port 1(bridge_slave_0) entered disabled state
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12b3aac3700000
Tested on:
commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree:
https://android.googlesource.com/kernel/common android13-5.10
kernel config:
https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
Note: no patches were applied.