Hello,
syzbot found the following issue on:
HEAD commit: cbfa1702 Linux 4.14.198
git tree: linux-4.14.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=1277a1fb900000
kernel config:
https://syzkaller.appspot.com/x/.config?x=3990958d85b55e59
dashboard link:
https://syzkaller.appspot.com/bug?extid=18e5be9506dd34e8cc46
compiler: gcc (GCC) 10.1.0-syz 20200507
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+18e5be...@syzkaller.appspotmail.com
IPVS: sync thread started: state = MASTER, mcast_ifn = bond_slave_0, syncid = 4, id = 0
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
no supported rates (0xffffffff) in rate_mask 0x0 with flags 0x0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 145 at net/mac80211/rate.c:359 __rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 145 Comm: kworker/u4:3 Not tainted 4.14.198-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_tcp_accept_worker
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x4b kernel/panic.c:547
report_bug+0x208/0x249 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:__rate_control_send_low.cold+0x6e/0x81 net/mac80211/rate.c:359
RSP: 0018:ffff8880aeb07088 EFLAGS: 00010282
RAX: 000000000000003f RBX: ffff8880a9af95a8 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff86ac12c0 RDI: ffffed1015d60e07
RBP: 00000000ffffffff R08: 000000000000003f R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88805039b320
R13: 0000000000000000 R14: 0000000000000090 R15: 000000000000000c
rate_control_send_low+0x248/0x560 net/mac80211/rate.c:383
minstrel_ht_get_rate+0x56/0x13f0 net/mac80211/rc80211_minstrel_ht.c:1045
rate_control_get_rate+0x40d/0x4f0 net/mac80211/rate.c:910
ieee80211_tx_h_rate_ctrl+0x769/0x12d0 net/mac80211/tx.c:741
invoke_tx_handlers_early+0x724/0x1990 net/mac80211/tx.c:1697
ieee80211_tx+0x209/0x320 net/mac80211/tx.c:1839
ieee80211_xmit+0x2cc/0x3b0 net/mac80211/tx.c:1928
__ieee80211_subif_start_xmit+0x38c/0x730 net/mac80211/tx.c:3625
ieee80211_subif_start_xmit+0xc9/0xdf0 net/mac80211/tx.c:3761
__netdev_start_xmit include/linux/netdevice.h:4039 [inline]
netdev_start_xmit include/linux/netdevice.h:4048 [inline]
xmit_one net/core/dev.c:3005 [inline]
dev_hard_start_xmit+0x188/0x890 net/core/dev.c:3021
sch_direct_xmit+0x251/0x500 net/sched/sch_generic.c:186
__dev_xmit_skb net/core/dev.c:3214 [inline]
__dev_queue_xmit+0x1ab0/0x2480 net/core/dev.c:3489
neigh_resolve_output+0x4e5/0x870 net/core/neighbour.c:1369
neigh_output include/net/neighbour.h:500 [inline]
ip6_finish_output2+0xf48/0x1f10 net/ipv6/ip6_output.c:120
ip6_finish_output+0x60c/0xaf0 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip6_output+0x1c5/0x660 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:470 [inline]
NF_HOOK include/linux/netfilter.h:250 [inline]
mld_sendpack+0x5fe/0xea0 net/ipv6/mcast.c:1660
mld_send_cr net/ipv6/mcast.c:1956 [inline]
mld_ifc_timer_expire+0x57c/0xcd0 net/ipv6/mcast.c:2455
call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280
expire_timers+0x232/0x4d0 kernel/time/timer.c:1319
__run_timers kernel/time/timer.c:1644 [inline]
run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1657
__do_softirq+0x254/0xa1d kernel/softirq.c:288
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1016
</IRQ>
do_softirq.part.0+0x154/0x1b0 kernel/softirq.c:332
do_softirq kernel/softirq.c:324 [inline]
__local_bh_enable_ip+0x12b/0x170 kernel/softirq.c:185
lock_sock include/net/sock.h:1471 [inline]
tcp_close+0x25/0xed0 net/ipv4/tcp.c:2144
inet_release+0xdf/0x1b0 net/ipv4/af_inet.c:425
__sock_release net/socket.c:602 [inline]
sock_release+0x87/0x1e0 net/socket.c:623
rds_tcp_accept_one+0x481/0x8b0 net/rds/tcp_listen.c:220
rds_tcp_accept_worker+0x4d/0x70 net/rds/tcp.c:407
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.