WARNING in batadv_iv_send_outstanding_bat_ogm_packet

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: c3038e71 Linux 4.19.80
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=103c2f60e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=44c623b7e5432cee
dashboard link: https://syzkaller.appspot.com/bug?extid=8cbf4afda1e6f8461f9b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8cbf4a...@syzkaller.appspotmail.com

netlink: 20 bytes leftover after parsing attributes in process
`syz-executor.1'.
netlink: 20 bytes leftover after parsing attributes in process
`syz-executor.3'.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7 at net/batman-adv/bat_iv_ogm.c:568
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:568 [inline]
WARNING: CPU: 1 PID: 7 at net/batman-adv/bat_iv_ogm.c:568
batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1811
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted 4.19.80 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
kobject: 'veth184' (000000003679febb): kobject_add_internal: parent: 'net',
set: 'devices'
panic+0x26a/0x50e kernel/panic.c:186
kobject: 'veth184' (000000003679febb): kobject_uevent_env
kobject: 'veth184' (000000003679febb): fill_kobj_path: path
= '/devices/virtual/net/veth184'
__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186
kobject: 'queues' (00000000336fc6af): kobject_add_internal:
parent: 'veth184', set: '<NULL>'
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
kobject: 'queues' (00000000336fc6af): kobject_uevent_env
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037
RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:568 [inline]
RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1811
Code: a5 ff ff e8 9b c2 97 fa 48 c7 c7 20 48 fb 87 e8 e3 27 82 fa e9 95 a5
ff ff e8 85 c2 97 fa 48 c7 c7 20 45 fb 87 e8 cd 27 82 fa <0f> 0b e9 7d a5
ff ff e8 6d c2 97 fa 48 c7 c7 20 45 fb 87 e8 b5 27
RSP: 0018:ffff8880aa21fcc8 EFLAGS: 00010282
kobject: 'queues' (00000000336fc6af): kobject_uevent_env: filter function
caused the event to drop!
RAX: 0000000000000024 RBX: ffff8880a491e048 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81553f06 RDI: ffffed1015443f8b
RBP: ffff8880aa21fd30 R08: 0000000000000024 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: ffff8880603149c0
R13: ffff8880770ec5c0 R14: ffff8880a491e000 R15: ffff8880603149c0
kobject: 'rx-0' (000000005aa260f3): kobject_add_internal: parent: 'queues',
set: 'queues'
process_one_work+0x989/0x1750 kernel/workqueue.c:2153
kobject: 'rx-0' (000000005aa260f3): kobject_uevent_env
kobject: 'rx-0' (000000005aa260f3): fill_kobj_path: path
= '/devices/virtual/net/veth184/queues/rx-0'
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
kobject: 'tx-0' (00000000eb31d50b): kobject_add_internal: parent: 'queues',
set: 'queues'
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: c555efaf Linux 4.19.84
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1563925ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9140f2df4ddc6016

dashboard link: https://syzkaller.appspot.com/bug?extid=8cbf4afda1e6f8461f9b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10b48002e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8cbf4a...@syzkaller.appspotmail.com

batman_adv: batadv0: The MTU of interface veth501 is too small (1500) to
handle the transport of batman-adv packets. Packets going over this
interface will be fragmented on layer2 which could impact the performance.
Setting the MTU to 1560 would solve the problem.
batman_adv: batadv0: Not using interface veth501 (retrying later):
interface not active
batman_adv: batadv0: Removing interface: veth501
------------[ cut here ]------------
WARNING: CPU: 1 PID: 23 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
WARNING: CPU: 1 PID: 23 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853
batman_adv: batadv0: Adding interface: veth503

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 23 Comm: kworker/u4:1 Not tainted 4.19.84 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x197/0x210 lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186

__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186

fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296

do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037

RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853
Code: a4 ff ff e8 b3 41 97 fa 48 c7 c7 a0 67 fb 87 e8 fb a6 81 fa e9 7d a4
ff ff e8 9d 41 97 fa 48 c7 c7 60 64 fb 87 e8 e5 a6 81 fa <0f> 0b e9 65 a4
ff ff e8 85 41 97 fa 48 c7 c7 60 64 fb 87 e8 cd a6
RSP: 0018:ffff8880aa39fcc8 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff8880a8065ec8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81559456 RDI: ffffed1015473f8b
RBP: ffff8880aa39fd30 R08: 0000000000000024 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: ffff88807f655dc0
R13: ffff88809a504480 R14: ffff8880a8065e80 R15: ffff88807f655dc0
process_one_work+0x989/0x1750 kernel/workqueue.c:2153

worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: cb1f9a16 Linux 4.19.94
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15e70269e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f87b837c6c739b95

dashboard link: https://syzkaller.appspot.com/bug?extid=8cbf4afda1e6f8461f9b
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1762cd71e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1735d5c6e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+8cbf4a...@syzkaller.appspotmail.com

RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000000bb1414ac
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000
------------[ cut here ]------------

WARNING: CPU: 1 PID: 23 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
WARNING: CPU: 1 PID: 23 at net/batman-adv/bat_iv_ogm.c:597
batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853

Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 23 Comm: kworker/u4:1 Not tainted 4.19.94-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]

dump_stack+0x197/0x210 lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186

__warn.cold+0x20/0x53 kernel/panic.c:541
report_bug+0x263/0x2b0 lib/bug.c:186

fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296

do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037

RIP: 0010:batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:597 [inline]
RIP: 0010:batadv_iv_send_outstanding_bat_ogm_packet.cold+0x3f/0x46
net/batman-adv/bat_iv_ogm.c:1853
Code: 9c ff ff e8 73 c0 35 fa 48 c7 c7 c0 6c 67 88 e8 fb 23 20 fa e9 4d 9c
ff ff e8 5d c0 35 fa 48 c7 c7 80 69 67 88 e8 e5 23 20 fa <0f> 0b e9 35 9c
ff ff e8 45 c0 35 fa 48 c7 c7 80 69 67 88 e8 cd 23
RSP: 0018:ffff8880a996fcc8 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff888090bf9c08 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8155baf6 RDI: ffffed101532df8b
RBP: ffff8880a996fd30 R08: 0000000000000024 R09: ffffed1015d25079
R10: ffffed1015d25078 R11: ffff8880ae9283c7 R12: ffff88808ea34080
R13: ffff88808d937200 R14: ffff888090bf9bc0 R15: ffff88808ea34080
process_one_work+0x989/0x1750 kernel/workqueue.c:2153

worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x354/0x420 kernel/kthread.c:246
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

[syzbot]

syzbot suspects this issue was fixed by commit:

commit e8e9d2968a9d08bf5c683afca182f1537edebf8d
Author: Sven Eckelmann <sv...@narfation.org>
Date: Tue May 18 19:00:27 2021 +0000

batman-adv: Avoid WARN_ON timing related checks

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15a7e68e300000
start commit: cb1f9a169a0e Linux 4.19.94
git tree: linux-4.19.y

kernel config: https://syzkaller.appspot.com/x/.config?x=f87b837c6c739b95
dashboard link: https://syzkaller.appspot.com/bug?extid=8cbf4afda1e6f8461f9b

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1762cd71e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1735d5c6e00000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: batman-adv: Avoid WARN_ON timing related checks

For information about bisection process see: https://goo.gl/tpsmEJ#bisection