[v6.6] WARNING in ip_rt_bug
0 views
Skip to first unread message
syzbot
Dec 25, 2025, 10:31:19 AM (4 days ago) Dec 25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 5fa4793a2d2d Linux 6.6.119
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1496b09a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=691a6769a86ac817
dashboard link: https://syzkaller.appspot.com/bug?extid=9ddd779b5859d2975072
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/63699875f1dd/disk-5fa4793a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8506652fcb6f/vmlinux-5fa4793a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1b30ceed1710/bzImage-5fa4793a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ddd77...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 kfree_skb include/linux/skbuff.h:1232 [inline]
WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 ip_rt_bug+0x29/0x100 net/ipv4/route.c:1282
Modules linked in:
CPU: 0 PID: 7737 Comm: syz.4.347 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:ip_rt_bug+0x29/0x100 net/ipv4/route.c:1283
Code: 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 d3 e8 9b c0 a3 f8 66 90 e8 94 c0 a3 f8 48 89 df be 02 00 00 00 e8 97 86 7a ff <0f> 0b 31 c0 5b 41 5c 41 5d 41 5e 41 5f c3 f3 0f 1e fa 49 bd 00 00
RSP: 0000:ffffc90000007678 EFLAGS: 00010296
RAX: 3512b860b81f0d00 RBX: ffff8880244cdb40 RCX: 3512b860b81f0d00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffff88807a041f00 R08: ffffffff90d9459f R09: 1ffffffff21b28b3
R10: dffffc0000000000 R11: fffffbfff21b28b4 R12: ffff88807a041f30
R13: ffff8880244cdb98 R14: ffff8880244cdb40 R15: ffff8881416a0d00
FS: 00007ff1428206c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffe70 CR3: 0000000075c0a000 CR4: 00000000003506f0
Call Trace:
<IRQ>
dst_output include/net/dst.h:467 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
ip_send_skb+0x12f/0x1d0 net/ipv4/ip_output.c:1491
__icmp_send+0xfc1/0x1320 net/ipv4/icmp.c:785
ipv4_send_dest_unreach net/ipv4/route.c:1263 [inline]
ipv4_link_failure+0x64f/0xa20 net/ipv4/route.c:1270
dst_link_failure include/net/dst.h:437 [inline]
arp_error_report+0x112/0x160 net/ipv4/arp.c:296
neigh_invalidate+0x22c/0x450 net/core/neighbour.c:1064
neigh_timer_handler+0x914/0xff0 net/core/neighbour.c:1151
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:cap_vm_enough_memory+0x0/0x240 security/commoncap.c:1401
Code: ff e8 24 f0 ac fd be 01 00 00 00 48 c7 c7 e0 79 34 8d 4c 89 f2 e8 c0 64 79 00 e9 cc fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 <f3> 0f 1e fa 55 41 57 41 56 41 55 41 54 53 50 49 bd 00 00 00 00 00
RSP: 0000:ffffc90003946de8 EFLAGS: 00000246
RAX: 1ffffffff18f931c RBX: 0000000000000001 RCX: ffff888029305a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88807d4c7200
RBP: 0000000000000001 R08: ffff888029305a00 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: ffffffff8c7c98e0
R13: dffffc0000000000 R14: ffff88807d4c7200 R15: ffffffff8c7c98c8
security_vm_enough_memory_mm+0x6b/0xa0 security/security.c:1035
shmem_acct_block mm/shmem.c:199 [inline]
shmem_inode_acct_block+0xd8/0x460 mm/shmem.c:215
shmem_alloc_and_acct_folio+0xb2/0x630 mm/shmem.c:1697
shmem_get_folio_gfp+0xcde/0x2ac0 mm/shmem.c:2041
shmem_get_folio mm/shmem.c:2164 [inline]
shmem_write_begin+0xf2/0x420 mm/shmem.c:2706
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4031
shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7ff14198f751
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007ff141be6090 RCX: 00007ff14198f749
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007ff141a13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007ff141be6128 R14: 00007ff141be6090 R15: 00007ffef4762628
</TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 24 f0 ac fd call 0xfdacf029
5: be 01 00 00 00 mov $0x1,%esi
a: 48 c7 c7 e0 79 34 8d mov $0xffffffff8d3479e0,%rdi
11: 4c 89 f2 mov %r14,%rdx
14: e8 c0 64 79 00 call 0x7964d9
19: e9 cc fc ff ff jmp 0xfffffcea
1e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
25: 00 00 00
28: 90 nop
* 29: f3 0f 1e fa endbr64 <-- trapping instruction
2d: 55 push %rbp
2e: 41 57 push %r15
30: 41 56 push %r14
32: 41 55 push %r13
34: 41 54 push %r12
36: 53 push %rbx
37: 50 push %rax
38: 49 rex.WB
39: bd 00 00 00 00 mov $0x0,%ebp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 5fa4793a2d2d Linux 6.6.119
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1496b09a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=691a6769a86ac817
dashboard link: https://syzkaller.appspot.com/bug?extid=9ddd779b5859d2975072
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/63699875f1dd/disk-5fa4793a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8506652fcb6f/vmlinux-5fa4793a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1b30ceed1710/bzImage-5fa4793a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ddd77...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 kfree_skb include/linux/skbuff.h:1232 [inline]
WARNING: CPU: 0 PID: 7737 at net/ipv4/route.c:1283 ip_rt_bug+0x29/0x100 net/ipv4/route.c:1282
Modules linked in:
CPU: 0 PID: 7737 Comm: syz.4.347 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:ip_rt_bug+0x29/0x100 net/ipv4/route.c:1283
Code: 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 d3 e8 9b c0 a3 f8 66 90 e8 94 c0 a3 f8 48 89 df be 02 00 00 00 e8 97 86 7a ff <0f> 0b 31 c0 5b 41 5c 41 5d 41 5e 41 5f c3 f3 0f 1e fa 49 bd 00 00
RSP: 0000:ffffc90000007678 EFLAGS: 00010296
RAX: 3512b860b81f0d00 RBX: ffff8880244cdb40 RCX: 3512b860b81f0d00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffff88807a041f00 R08: ffffffff90d9459f R09: 1ffffffff21b28b3
R10: dffffc0000000000 R11: fffffbfff21b28b4 R12: ffff88807a041f30
R13: ffff8880244cdb98 R14: ffff8880244cdb40 R15: ffff8881416a0d00
FS: 00007ff1428206c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffe70 CR3: 0000000075c0a000 CR4: 00000000003506f0
Call Trace:
<IRQ>
dst_output include/net/dst.h:467 [inline]
ip_local_out net/ipv4/ip_output.c:129 [inline]
ip_send_skb+0x12f/0x1d0 net/ipv4/ip_output.c:1491
__icmp_send+0xfc1/0x1320 net/ipv4/icmp.c:785
ipv4_send_dest_unreach net/ipv4/route.c:1263 [inline]
ipv4_link_failure+0x64f/0xa20 net/ipv4/route.c:1270
dst_link_failure include/net/dst.h:437 [inline]
arp_error_report+0x112/0x160 net/ipv4/arp.c:296
neigh_invalidate+0x22c/0x450 net/core/neighbour.c:1064
neigh_timer_handler+0x914/0xff0 net/core/neighbour.c:1151
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:cap_vm_enough_memory+0x0/0x240 security/commoncap.c:1401
Code: ff e8 24 f0 ac fd be 01 00 00 00 48 c7 c7 e0 79 34 8d 4c 89 f2 e8 c0 64 79 00 e9 cc fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 <f3> 0f 1e fa 55 41 57 41 56 41 55 41 54 53 50 49 bd 00 00 00 00 00
RSP: 0000:ffffc90003946de8 EFLAGS: 00000246
RAX: 1ffffffff18f931c RBX: 0000000000000001 RCX: ffff888029305a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88807d4c7200
RBP: 0000000000000001 R08: ffff888029305a00 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: ffffffff8c7c98e0
R13: dffffc0000000000 R14: ffff88807d4c7200 R15: ffffffff8c7c98c8
security_vm_enough_memory_mm+0x6b/0xa0 security/security.c:1035
shmem_acct_block mm/shmem.c:199 [inline]
shmem_inode_acct_block+0xd8/0x460 mm/shmem.c:215
shmem_alloc_and_acct_folio+0xb2/0x630 mm/shmem.c:1697
shmem_get_folio_gfp+0xcde/0x2ac0 mm/shmem.c:2041
shmem_get_folio mm/shmem.c:2164 [inline]
shmem_write_begin+0xf2/0x420 mm/shmem.c:2706
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4031
shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7ff14198f751
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007ff141be6090 RCX: 00007ff14198f749
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007ff141a13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007ff141be6128 R14: 00007ff141be6090 R15: 00007ffef4762628
</TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 24 f0 ac fd call 0xfdacf029
5: be 01 00 00 00 mov $0x1,%esi
a: 48 c7 c7 e0 79 34 8d mov $0xffffffff8d3479e0,%rdi
11: 4c 89 f2 mov %r14,%rdx
14: e8 c0 64 79 00 call 0x7964d9
19: e9 cc fc ff ff jmp 0xfffffcea
1e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
25: 00 00 00
28: 90 nop
* 29: f3 0f 1e fa endbr64 <-- trapping instruction
2d: 55 push %rbp
2e: 41 57 push %r15
30: 41 56 push %r14
32: 41 55 push %r13
34: 41 54 push %r12
36: 53 push %rbx
37: 50 push %rax
38: 49 rex.WB
39: bd 00 00 00 00 mov $0x0,%ebp
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages