WARNING in xfrm_policy_insert

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 01fd1694 Linux 4.14.141
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=119b1c66600000
kernel config: https://syzkaller.appspot.com/x/.config?x=62c9b69e1b2adda9
dashboard link: https://syzkaller.appspot.com/bug?extid=019bd01a00a906c42580
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+019bd0...@syzkaller.appspotmail.com

R13: 00000000004bfd46 R14: 00000000004d1af8 R15: 0000000000000005
------------[ cut here ]------------
WARNING: CPU: 1 PID: 18618 at net/xfrm/xfrm_policy.c:752
xfrm_policy_insert+0x679/0x11e0 net/xfrm/xfrm_policy.c:752
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 18618 Comm: syz-executor.4 Not tainted 4.14.141 #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
panic+0x1f2/0x426 kernel/panic.c:182
__warn.cold+0x2f/0x36 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:xfrm_policy_insert+0x679/0x11e0 net/xfrm/xfrm_policy.c:752
RSP: 0018:ffff88805828f560 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff88808d7f04c0 RCX: ffffc90007629000
RDX: 000000000000067c RSI: ffffffff8540ffc9 RDI: ffff88808d7f06f0
RBP: ffff88805828f5f8 R08: 0000000000003993 R09: ffffffff88c9c118
R10: ffff8880a165ee28 R11: ffff8880a165e580 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
xfrm_add_policy+0x230/0x4f0 net/xfrm/xfrm_user.c:1635
xfrm_user_rcv_msg+0x3c9/0x690 net/xfrm/xfrm_user.c:2625
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
xfrm_netlink_rcv+0x70/0x90 net/xfrm/xfrm_user.c:2633
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x45d/0x640 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
kobject: 'loop0' (ffff8880a4966160): kobject_uevent_env
kobject: 'loop0' (ffff8880a4966160): fill_kobj_path: path
= '/devices/virtual/block/loop0'
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459879
RSP: 002b:00007f8d7ab1fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459879
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8d7ab206d4
R13: 00000000004c77d9 R14: 00000000004dd030 R15: 00000000ffffffff
CPU: 0 PID: 18630 Comm: syz-executor.0 Not tainted 4.14.141 #37
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0x10f/0x159 lib/fault-inject.c:149
should_failslab+0xdb/0x130 mm/failslab.c:32
slab_pre_alloc_hook mm/slab.h:421 [inline]
slab_alloc mm/slab.c:3376 [inline]
kmem_cache_alloc+0x2d7/0x780 mm/slab.c:3550
ptlock_alloc+0x20/0x70 mm/memory.c:4741
ptlock_init include/linux/mm.h:1757 [inline]
pgtable_page_ctor include/linux/mm.h:1791 [inline]
pte_alloc_one+0x60/0x100 arch/x86/mm/pgtable.c:33
__pte_alloc+0x2a/0x2d0 mm/memory.c:656
copy_pte_range mm/memory.c:1081 [inline]
copy_pmd_range mm/memory.c:1157 [inline]
copy_pud_range mm/memory.c:1191 [inline]
copy_p4d_range mm/memory.c:1213 [inline]
copy_page_range+0x11ba/0x1bd0 mm/memory.c:1275
dup_mmap kernel/fork.c:714 [inline]
dup_mm kernel/fork.c:1208 [inline]
copy_mm kernel/fork.c:1263 [inline]
copy_process.part.0+0x4764/0x6a00 kernel/fork.c:1780
copy_process kernel/fork.c:1595 [inline]
_do_fork+0x19e/0xce0 kernel/fork.c:2085
SYSC_clone kernel/fork.c:2195 [inline]
SyS_clone+0x37/0x50 kernel/fork.c:2189
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459879
RSP: 002b:00007f5d58de2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f5d58de2c90 RCX: 0000000000459879
RDX: 9999999999999999 RSI: 0000000000000000 RDI: 0000000029000400
RBP: 000000000075bf20 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5d58de36d4
R13: 00000000004bfd46 R14: 00000000004d1af8 R15: 0000000000000005
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 414510bc Linux 4.14.142
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=137e8366600000
kernel config: https://syzkaller.appspot.com/x/.config?x=9aa0b2ccd827f416

dashboard link: https://syzkaller.appspot.com/bug?extid=019bd01a00a906c42580
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=100dcffe600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+019bd0...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6899 at net/xfrm/xfrm_policy.c:752

xfrm_policy_insert+0x679/0x11e0 net/xfrm/xfrm_policy.c:752
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 6899 Comm: syz-executor.0 Not tainted 4.14.142 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x197 lib/dump_stack.c:53
panic+0x1f2/0x426 kernel/panic.c:182
__warn.cold+0x2f/0x36 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:xfrm_policy_insert+0x679/0x11e0 net/xfrm/xfrm_policy.c:752

RSP: 0018:ffff8880a7c47560 EFLAGS: 00010297
RAX: ffff888094c50480 RBX: ffff8880a8536d80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a8536fb0
RBP: ffff8880a7c475f8 R08: 0000000000001f0f R09: ffffffff88c8ecf8
R10: ffff888094c50d28 R11: ffff888094c50480 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000350759

xfrm_add_policy+0x230/0x4f0 net/xfrm/xfrm_user.c:1635
xfrm_user_rcv_msg+0x3c9/0x690 net/xfrm/xfrm_user.c:2625
netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
xfrm_netlink_rcv+0x70/0x90 net/xfrm/xfrm_user.c:2633
netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
netlink_unicast+0x45d/0x640 net/netlink/af_netlink.c:1312
netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877

sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xce/0x110 net/socket.c:656
___sys_sendmsg+0x70a/0x840 net/socket.c:2062
__sys_sendmsg+0xb9/0x140 net/socket.c:2096

SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2103
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459879

RSP: 002b:00007fdc5426bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e

RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459879

RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000004

RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdc5426c6d4

R13: 00000000004c77d9 R14: 00000000004dd030 R15: 00000000ffffffff

[syzbot]

syzbot suspects this bug was fixed by commit:

commit 1cd914b02b5ae999b04f44871f39dde4bffde96e
Author: Xin Long <lucie...@gmail.com>
Date: Mon May 25 05:53:37 2020 +0000

xfrm: fix a warning in xfrm_policy_insert_list

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12a1c905100000
start commit: 98db2bf2 Linux 4.14.171
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=9dc3f6f9d0ff3b98
dashboard link: https://syzkaller.appspot.com/bug?extid=019bd01a00a906c42580
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11a21b11e00000

If the result looks correct, please mark the bug fixed by replying with:

#syz fix: xfrm: fix a warning in xfrm_policy_insert_list

For information about bisection process see: https://goo.gl/tpsmEJ#bisection