This exact reproducer does not trigger the crash on latest upstream for me.
However, syzbot claims this still happens:
https://syzkaller.appspot.com/bug?id=9c55af67ce995cf6c4f11ab6f5d3ee805d67fc00
The reproducer from May 24 triggered the crash on the latest upstream
(c90fca951e90ba470a3dc6087667edffcf8db21b) for me.
Maybe it's a different bug, and the old one was either fixed or
requires a different reproducer now...
[ 37.343767] ------------[ cut here ]------------
[ 37.344851] kernel BUG at net/core/skbuff.c:2643!
[ 37.345805] invalid opcode: 0000 [#1] SMP KASAN
[ 37.346677] CPU: 0 PID: 3534 Comm: a.out Not tainted 4.17.0+ #2
[ 37.347797] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.10.2-1 04/01/2014
[ 37.349346] RIP: 0010:skb_copy_and_csum_bits+0x5e4/0x6e0
[ 37.350332] Code: 49 63 c4 48 01 45 c8 01 45 b8 41 01 c5 e9 1d ff
ff ff 8b 5d d4 e8 0c 9f 26 fd 8b 45 c0 85 c0 0f 84 ab fe ff ff e8 fc
9e 26 fd <0f> 0b 45 31 ff e9 4c fb ff ff 8b 5d d4 e9 94 fe ff ff e8 e5
9e 26
[ 37.353898] RSP: 0018:ffff88002dc06220 EFLAGS: 00010206
[ 37.354874] RAX: ffff88007a46a640 RBX: 000000006485bc1a RCX: ffffffff844d49f4
[ 37.356191] RDX: 0000000000000100 RSI: ffff88002a1765cc RDI: ffff88002a1a4308
[ 37.357526] RBP: ffff88002dc062a0 R08: 0000000000000000 R09: 0000000000000000
[ 37.358841] R10: 000000000000003c R11: ffffed0005b80bef R12: ffff880029b2e068
[ 37.360157] R13: ffff88002132f980 R14: 00000000000001e8 R15: 000000000000003c
[ 37.361514] FS: 0000000001696940(0000) GS:ffff88002dc00000(0000)
knlGS:0000000000000000
[ 37.362992] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 37.364051] CR2: 00007f8c46d84db8 CR3: 000000007df16000 CR4: 00000000000006f0
[ 37.365383] Call Trace:
[ 37.365853] <IRQ>
[ 37.366254] ? save_stack+0xa3/0xd0
[ 37.366919] icmp_glue_bits+0x7f/0x1d0
[ 37.367629] __ip_append_data.isra.45+0x197c/0x2860
[ 37.368542] ? tcp_write_timer+0x153/0x170
[ 37.369314] ? run_timer_softirq+0x4c/0x70
[ 37.370088] ? do_syscall_64+0x18a/0x750
[ 37.370826] ? icmp_push_reply+0x4f0/0x4f0
[ 37.371616] ? __ip_flush_pending_frames.isra.41+0x2b0/0x2b0
[ 37.372685] ? __lock_is_held+0xb6/0x140
[ 37.373423] ? ipv4_mtu+0x411/0x580
[ 37.374078] ? __build_flow_key.constprop.52+0x630/0x630
[ 37.375064] ? rcu_read_lock_sched_held+0x108/0x120
[ 37.375970] ? kmem_cache_alloc_trace+0x491/0x750
[ 37.376867] ? icmp_route_lookup.constprop.23+0x462/0x1540
[ 37.377893] ip_append_data.part.46+0xde/0x150
[ 37.378727] ? icmp_push_reply+0x4f0/0x4f0
[ 37.379495] ? icmp_push_reply+0x4f0/0x4f0
[ 37.380265] ip_append_data+0x5a/0x80
[ 37.380963] icmp_push_reply+0x169/0x4f0
[ 37.381730] icmp_send+0x113c/0x19c0
[ 37.382409] ? icmp_route_lookup.constprop.23+0x1540/0x1540
[ 37.383444] ? nf_ct_deliver_cached_events+0x52e/0x750
[ 37.384400] ? lock_downgrade+0x980/0x980
[ 37.385169] ? nf_conntrack_update+0xb60/0xb60
[ 37.386004] ? kasan_check_read+0x11/0x20
[ 37.386762] ? rcu_gpnum_ovf+0x310/0x310
[ 37.387508] ? __build_flow_key.constprop.52+0x630/0x630
[ 37.388506] ? __lock_is_held+0xb6/0x140
[ 37.389250] ip_fragment.constprop.47+0x1ac/0x200
[ 37.390131] ip_finish_output+0x6a2/0xd70
[ 37.390886] ? ip_fragment.constprop.47+0x200/0x200
[ 37.391811] ? kasan_check_read+0x11/0x20
[ 37.392575] ? rcu_is_watching+0x85/0x130
[ 37.393328] ? rcu_gpnum_ovf+0x310/0x310
[ 37.394064] ? nf_hook_slow+0xd6/0x1b0
[ 37.394769] ip_output+0x1d2/0x860
[ 37.395411] ? ip_mc_output+0x1350/0x1350
[ 37.396165] ? ip_fragment.constprop.47+0x200/0x200
[ 37.397085] ip_local_out+0x9b/0x170
[ 37.397760] ip_queue_xmit+0x8c0/0x1920
[ 37.398480] ? kasan_check_read+0x11/0x20
[ 37.399235] ? ip_build_and_send_pkt+0xc80/0xc80
[ 37.400096] ? __lock_is_held+0xb6/0x140
[ 37.400836] ? __tcp_v4_send_check+0x1d/0x1d0
[ 37.401672] ? tcp_options_write+0x228/0x940
[ 37.402473] tcp_transmit_skb+0x1b5d/0x3b10
[ 37.403262] ? bictcp_cong_avoid+0xf20/0xf20
[ 37.404060] ? __tcp_select_window+0x920/0x920
[ 37.404902] ? sk_forced_mem_schedule+0x4d/0x160
[ 37.405762] ? sk_stream_alloc_skb+0x33e/0x9b0
[ 37.406595] ? skb_zerocopy_clone+0x5b0/0x5b0
[ 37.407407] ? tcp_init_transfer+0x3f0/0x3f0
[ 37.408206] ? __build_flow_key.constprop.52+0x630/0x630
[ 37.409218] ? tcp_established_options+0x34c/0x5c0
[ 37.410120] ? tcp_rbtree_insert+0x135/0x190
[ 37.410926] ? tcp_fragment+0xad5/0x11a0
[ 37.411679] ? tcp_default_init_rwnd+0x50/0x50
[ 37.412525] ? lock_timer_base+0xaf/0x280
[ 37.413286] ? tcp_trim_head+0x1fb/0x560
[ 37.414029] ? tcp_fragment+0x11a0/0x11a0
[ 37.414794] __tcp_retransmit_skb+0x9a0/0x2b30
[ 37.415632] ? _raw_spin_unlock_irqrestore+0xa6/0xc0
[ 37.416572] ? debug_object_activate+0x307/0x740
[ 37.417439] ? tcp_skb_collapse_tstamp+0x360/0x360
[ 37.418332] ? _raw_spin_unlock_irqrestore+0x31/0xc0
[ 37.419259] ? trace_hardirqs_on_caller+0x19e/0x5c0
[ 37.420169] ? trace_hardirqs_on+0xd/0x10
[ 37.420932] ? mod_timer+0x588/0x13c0
[ 37.421664] ? print_irqtrace_events+0x270/0x270
[ 37.422534] ? tcp_v4_destroy_sock+0x4a3/0x8b0
[ 37.423371] ? print_irqtrace_events+0x270/0x270
[ 37.424238] ? kasan_check_read+0x11/0x20
[ 37.425018] ? refcount_sub_and_test+0x19f/0x280
[ 37.425888] ? refcount_inc_not_zero+0x280/0x280
[ 37.426761] ? del_timer+0xf3/0x140
[ 37.427428] ? tcp_check_oom+0x170/0x590
[ 37.428172] ? tcp_free_fastopen_req+0x90/0x90
[ 37.429013] ? __lock_acquire+0x638/0x3c30
[ 37.429786] ? tcp_skb_mark_lost_uncond_verify+0x16b/0x240
[ 37.430939] ? jiffies_to_msecs+0xd/0x20
[ 37.431698] ? bictcp_state+0x433/0x500
[ 37.432416] ? bictcp_cong_avoid+0xf20/0xf20
[ 37.433265] ? bictcp_cwnd_event+0x120/0x120
[ 37.434058] ? tcp_enter_loss+0xb81/0x10f0
[ 37.434805] tcp_retransmit_skb+0x2e/0x230
[ 37.435571] tcp_retransmit_timer+0xf01/0x2de0
[ 37.436414] ? tcp_delack_timer+0x220/0x220
[ 37.437227] ? __lock_acquire+0x638/0x3c30
[ 37.437990] ? trace_hardirqs_off+0x10/0x10
[ 37.438778] ? debug_check_no_locks_freed+0x3c0/0x3c0
[ 37.439714] ? find_held_lock+0x35/0x1d0
[ 37.440448] ? trace_hardirqs_off+0x10/0x10
[ 37.441237] ? addrconf_rs_timer+0x13b/0x6b0
[ 37.442070] ? pvclock_read_flags+0x160/0x160
[ 37.442888] ? kvm_sched_clock_read+0x25/0x40
[ 37.443699] ? sched_clock+0x31/0x40
[ 37.444373] ? sched_clock_cpu+0x1b/0x180
[ 37.445186] ? lock_release+0xa40/0xa40
[ 37.445936] tcp_write_timer_handler+0x335/0x820
[ 37.446844] ? tcp_retransmit_timer+0x2de0/0x2de0
[ 37.447713] tcp_write_timer+0x153/0x170
[ 37.448425] call_timer_fn+0x22b/0x830
[ 37.449141] ? tcp_write_timer_handler+0x820/0x820
[ 37.450002] ? process_timeout+0x40/0x40
[ 37.450715] ? __run_timers+0x7e5/0xb70
[ 37.451515] ? lock_downgrade+0x980/0x980
[ 37.452275] ? debug_object_deactivate+0x364/0x560
[ 37.453210] ? kasan_check_read+0x11/0x20
[ 37.453963] ? do_raw_spin_trylock+0x1a0/0x1a0
[ 37.454784] ? trace_hardirqs_on_caller+0x19e/0x5c0
[ 37.455662] ? tcp_write_timer_handler+0x820/0x820
[ 37.456580] ? tcp_write_timer_handler+0x820/0x820
[ 37.457479] __run_timers+0x7f0/0xb70
[ 37.458176] ? __bpf_trace_timer_expire_entry+0x30/0x30
[ 37.459148] ? timerqueue_add+0x1e9/0x280
[ 37.459901] ? trace_hardirqs_off+0x10/0x10
[ 37.460694] ? enqueue_hrtimer+0x177/0x4b0
[ 37.461493] ? lock_release+0xa40/0xa40
[ 37.462213] ? hrtimer_update_softirq_timer+0x80/0x80
[ 37.463156] ? rcu_is_watching+0x85/0x130
[ 37.463911] ? account_process_tick+0x8d/0x210
[ 37.464769] ? find_held_lock+0x35/0x1d0
[ 37.465511] ? clockevents_program_event+0x16d/0x2f0
[ 37.466436] ? lock_downgrade+0x980/0x980
[ 37.467192] ? rcu_pm_notify+0xc0/0xc0
[ 37.467901] run_timer_softirq+0x4c/0x70
[ 37.468646] __do_softirq+0x2e0/0xb94
[ 37.469336] ? ktime_get+0x274/0x3b0
[ 37.470016] ? __irqentry_text_end+0x1f9a43/0x1f9a43
[ 37.470944] ? kasan_check_read+0x11/0x20
[ 37.471734] ? do_raw_spin_unlock+0x9e/0x310
[ 37.472553] ? native_apic_msr_write+0x5c/0x80
[ 37.473386] ? __hrtimer_next_event_base+0x1bc/0x260
[ 37.474307] ? lapic_next_event+0x5a/0x90
[ 37.475059] ? clockevents_program_event+0x112/0x2f0
[ 37.475986] ? kasan_check_read+0x11/0x20
[ 37.476744] ? rcu_is_watching+0x85/0x130
[ 37.477499] ? rcu_pm_notify+0xc0/0xc0
[ 37.478210] irq_exit+0x1cc/0x200
[ 37.478840] smp_apic_timer_interrupt+0x175/0x710
[ 37.479718] ? smp_reschedule_interrupt+0xeb/0x660
[ 37.480616] ? smp_call_function_single_interrupt+0x650/0x650
[ 37.481706] ? _raw_spin_lock+0x32/0x40
[ 37.482426] ? _raw_spin_unlock+0x22/0x30
[ 37.483178] ? handle_edge_irq+0x2b9/0x7d0
[ 37.483945] ? rcu_is_watching+0x85/0x130
[ 37.484723] ? task_prio+0x50/0x50
[ 37.485371] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 37.486251] apic_timer_interrupt+0xf/0x20
[ 37.487015] </IRQ>
[ 37.487425] RIP: 0010:_raw_spin_unlock_irq+0x56/0x70
[ 37.488345] Code: cc 86 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48
c1 ea 03 80 3c 02 00 75 1d 48 83 3d 3b 28 1a 01 00 74 11 fb 66 0f 1f
44 00 00 <65> ff 0d 83 43 4f 7a 5b 5d c3 0f 0b e8 19 30 fc fb eb dc 0f
1f 80
[ 37.491897] RSP: 0018:ffff880078b27728 EFLAGS: 00000286 ORIG_RAX:
ffffffffffffff13
[ 37.493310] RAX: dffffc0000000000 RBX: ffff88002dc2cb00 RCX: 0000000000000000
[ 37.494623] RDX: 1ffffffff0d99a4f RSI: 0000000000000001 RDI: ffffffff86ccd278
[ 37.495931] RBP: ffff880078b27730 R08: ffffed0005b85961 R09: 0000000000000000
[ 37.497242] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000f164eee
[ 37.498550] R13: ffff880027918680 R14: 0000000000000000 R15: ffff880078b27810
[ 37.499876] ? _raw_spin_unlock_irq+0x27/0x70
[ 37.500689] finish_task_switch+0x1b9/0x9a0
[ 37.501466] ? finish_task_switch+0x17a/0x9a0
[ 37.502300] ? __switch_to_asm+0x34/0x70
[ 37.503032] ? __switch_to_asm+0x34/0x70
[ 37.503767] ? __switch_to_asm+0x40/0x70
[ 37.504579] ? copy_overflow+0x20/0x20
[ 37.505288] ? __switch_to_asm+0x34/0x70
[ 37.506024] ? __switch_to_asm+0x34/0x70
[ 37.506772] ? __switch_to_asm+0x40/0x70
[ 37.507508] ? __switch_to_asm+0x34/0x70
[ 37.508241] ? __switch_to_asm+0x40/0x70
[ 37.509117] ? __switch_to_asm+0x34/0x70
[ 37.509854] ? __switch_to_asm+0x40/0x70
[ 37.510602] ? __switch_to_asm+0x34/0x70
[ 37.511339] ? __switch_to_asm+0x34/0x70
[ 37.512104] ? __switch_to_asm+0x40/0x70
[ 37.512883] ? __switch_to_asm+0x34/0x70
[ 37.513616] ? __switch_to_asm+0x40/0x70
[ 37.514349] ? __switch_to_asm+0x34/0x70
[ 37.515083] ? __switch_to_asm+0x40/0x70
[ 37.515814] ? __switch_to_asm+0x34/0x70
[ 37.516554] __schedule+0x8fd/0x1ef0
[ 37.517246] ? find_held_lock+0x35/0x1d0
[ 37.517983] ? __sched_text_start+0x8/0x8
[ 37.518732] ? hrtimer_start_range_ns+0x583/0xb90
[ 37.519604] ? lock_downgrade+0x980/0x980
[ 37.520352] ? enqueue_hrtimer+0x177/0x4b0
[ 37.521124] ? kasan_check_read+0x11/0x20
[ 37.521898] ? do_raw_spin_unlock+0x9e/0x310
[ 37.522716] ? do_raw_spin_trylock+0x1a0/0x1a0
[ 37.523549] ? trace_hardirqs_on_caller+0x421/0x5c0
[ 37.524459] ? hrtimer_start_range_ns+0x583/0xb90
[ 37.525347] schedule+0xf5/0x430
[ 37.525961] ? __schedule+0x1ef0/0x1ef0
[ 37.526682] ? debug_object_fixup+0x30/0x30
[ 37.527468] ? find_held_lock+0x35/0x1d0
[ 37.528203] do_nanosleep+0x224/0x6f0
[ 37.528898] ? schedule_timeout_idle+0x90/0x90
[ 37.529732] ? lock_release+0xa40/0xa40
[ 37.530455] ? set_rq_offline.part.85+0x140/0x140
[ 37.531336] ? __wake_up_parent+0x60/0x60
[ 37.532117] ? ktime_get_ts64+0x15f/0x4e0
[ 37.532891] ? memset+0x31/0x40
[ 37.533485] ? __hrtimer_init+0xab/0x1f0
[ 37.534239] hrtimer_nanosleep+0x281/0x4d0
[ 37.535001] ? nanosleep_copyout+0x100/0x100
[ 37.535795] ? clock_was_set_work+0x30/0x30
[ 37.536585] __x64_sys_nanosleep+0x1a8/0x230
[ 37.537383] ? __ia32_compat_sys_nanosleep+0x240/0x240
[ 37.538338] ? do_syscall_64+0x92/0x750
[ 37.539061] do_syscall_64+0x18a/0x750
[ 37.539765] ? syscall_return_slowpath+0x550/0x550
[ 37.540674] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe
[ 37.541643] ? trace_hardirqs_off_thunk+0x1a/0x1c
[ 37.542565] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 37.543502] RIP: 0033:0x44c600
[ 37.544076] Code: c0 5b 5d c3 66 0f 1f 44 00 00 8b 04 24 48 83 c4
18 5b 5d c3 66 0f 1f 44 00 00 83 3d e9 0b 28 00 00 75 14 b8 23 00 00
00 0f 05 <48> 3d 01 f0 ff ff 0f 83 84 15 fc ff c3 48 83 ec 08 e8 0a 2c
00 00
[ 37.547594] RSP: 002b:00007ffe719a7178 EFLAGS: 00000246 ORIG_RAX:
0000000000000023
[ 37.548978] RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 000000000044c600
[ 37.550298] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffe719a7180
[ 37.551609] RBP: 00007ffe719a7330 R08: 0000000001696940 R09: 0000000000000005
[ 37.552966] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000040df30
[ 37.554274] R13: 000000000040dfc0 R14: 0000000000000000 R15: 0000000000000000
[ 37.555588] Modules linked in:
[ 37.556288] ---[ end trace 3660ab58ce89576b ]---
[ 37.557277] RIP: 0010:skb_copy_and_csum_bits+0x5e4/0x6e0
[ 37.558283] Code: 49 63 c4 48 01 45 c8 01 45 b8 41 01 c5 e9 1d ff
ff ff 8b 5d d4 e8 0c 9f 26 fd 8b 45 c0 85 c0 0f 84 ab fe ff ff e8 fc
9e 26 fd <0f> 0b 45 31 ff e9 4c fb ff ff 8b 5d d4 e9 94 fe ff ff e8 e5
9e 26
[ 37.561863] RSP: 0018:ffff88002dc06220 EFLAGS: 00010206
[ 37.563126] RAX: ffff88007a46a640 RBX: 000000006485bc1a RCX: ffffffff844d49f4
[ 37.564525] RDX: 0000000000000100 RSI: ffff88002a1765cc RDI: ffff88002a1a4308
[ 37.565845] RBP: ffff88002dc062a0 R08: 0000000000000000 R09: 0000000000000000
[ 37.567182] R10: 000000000000003c R11: ffffed0005b80bef R12: ffff880029b2e068
[ 37.568496] R13: ffff88002132f980 R14: 00000000000001e8 R15: 000000000000003c
[ 37.569813] FS: 0000000001696940(0000) GS:ffff88002dc00000(0000)
knlGS:0000000000000000
[ 37.571323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 37.572474] CR2: 00007f8c46d84db8 CR3: 000000007df16000 CR4: 00000000000006f0
[ 37.573848] Kernel panic - not syncing: Fatal exception in interrupt
[ 37.575321] Kernel Offset: disabled
[ 37.575970] Rebooting in 86400 seconds..