From: syzbot <syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com>
To: gowtham398gs@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [sctp?] kernel BUG in __pskb_pull_tail (2)
Date: Wed, 04 Nov 2026 03:03:03 -0800 [thread overview]
Message-ID: <6aeb10e7.7bd3e221.25cd79.0000.GAE@google.com> (raw)
In-Reply-To: <20261104104914.357927-1-gowtham398gs@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __pskb_pull_tail
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2903!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 6405 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 5b f8 48 89 df e8 2b 03 fe ff 31 ff 41 89 c4 89 c6 e8 7f 58 5b f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 5c 5e 5b f8 90 <0f> 0b e8 54 5e 5b f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900006a0870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff88802bb18000 RSI: ffffffff89b30684 RDI: 0000000000000005
RBP: ffffc900006a08f0 R08: 0000000000000000 R09: 00000000fffffff2
R10: ffff88802d072f87 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff8880336af040
FS: 00007f5316b9d6c0(0000) GS:ffff8880d457c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001a000 CR3: 0000000023deb000 CR4: 0000000000352ef0
Call Trace:
<IRQ>
__skb_linearize include/linux/skbuff.h:4025 [inline]
skb_linearize include/linux/skbuff.h:4037 [inline]
sctp_rcv+0x143e/0x3cc0 net/sctp/input.c:125
ip_protocol_deliver_rcu+0x44c/0x4d0 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3fb/0x6e0 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_local_deliver+0x1a3/0x200 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:481 [inline]
ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6433
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6546
process_backlog+0x487/0x1600 net/core/dev.c:6897
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7966
napi_poll net/core/dev.c:8029 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:8186
handle_softirqs+0x216/0xa20 kernel/softirq.c:669
do_softirq kernel/softirq.c:569 [inline]
do_softirq+0xaf/0xf0 kernel/softirq.c:556
</IRQ>
<TASK>
__local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
__dev_queue_xmit+0xa43/0x48d0 net/core/dev.c:5121
dev_queue_xmit include/linux/netdevice.h:3483 [inline]
neigh_hh_output include/net/neighbour.h:538 [inline]
neigh_output include/net/neighbour.h:552 [inline]
ip_finish_output2+0xfa4/0x2740 net/ipv4/ip_output.c:236
__ip_finish_output.part.0+0x43b/0x6f0 net/ipv4/ip_output.c:314
__ip_finish_output net/ipv4/ip_output.c:302 [inline]
ip_finish_output net/ipv4/ip_output.c:324 [inline]
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x392/0xc00 net/ipv4/ip_output.c:437
dst_output include/net/dst.h:471 [inline]
ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
__ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533
sctp_v4_xmit+0x91a/0x1070 net/sctp/protocol.c:1061
sctp_packet_transmit+0x22fe/0x30b0 net/sctp/output.c:659
sctp_outq_flush_transports net/sctp/outqueue.c:1174 [inline]
sctp_outq_flush+0xb2b/0x3380 net/sctp/outqueue.c:1222
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1826 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline]
sctp_do_sm+0xce1/0x5c30 net/sctp/sm_sideeffect.c:1182
sctp_assoc_bh_rcv+0x392/0x740 net/sctp/associola.c:1048
sctp_inq_push+0x25c/0x320 net/sctp/inqueue.c:91
sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:336
sk_backlog_rcv include/net/sock.h:1194 [inline]
__release_sock+0x39d/0x440 net/core/sock.c:3341
release_sock+0x1e5/0x280 net/core/sock.c:3940
sctp_sendmsg+0x1166/0x22e0 net/sctp/socket.c:2091
inet_sendmsg+0x11c/0x140 net/ipv4/af_inet.c:864
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:818 [inline]
____sys_sendmsg+0xa23/0xc30 net/socket.c:2715
___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
__sys_sendmmsg+0x20c/0x440 net/socket.c:2858
__do_sys_sendmmsg net/socket.c:2885 [inline]
__se_sys_sendmmsg net/socket.c:2882 [inline]
__x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2882
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5315d9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5316b9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f5316025fa0 RCX: 00007f5315d9fb19
RDX: 0000000000000001 RSI: 0000200000000e40 RDI: 0000000000000004
RBP: 00007f5315e37b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5316026038 R14: 00007f5316025fa0 R15: 00007ffcc4fe8548
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 5b f8 48 89 df e8 2b 03 fe ff 31 ff 41 89 c4 89 c6 e8 7f 58 5b f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 5c 5e 5b f8 90 <0f> 0b e8 54 5e 5b f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900006a0870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff88802bb18000 RSI: ffffffff89b30684 RDI: 0000000000000005
RBP: ffffc900006a08f0 R08: 0000000000000000 R09: 00000000fffffff2
R10: ffff88802d072f87 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff8880336af040
FS: 00007f5316b9d6c0(0000) GS:ffff8880d457c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001a000 CR3: 0000000023deb000 CR4: 0000000000352ef0
Tested on:
commit: 05441d69 Merge tag 'cocci-7.4-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1439892d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1cf189394a856f11
dashboard link: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=150258be580000
next parent reply other threads:[~2026-11-04 11:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261104104914.357927-1-gowtham398gs@gmail.com>
2026-11-04 11:03 ` syzbot [this message]
[not found] <20261104143730.395599-1-gowtham398gs@gmail.com>
2026-11-04 14:47 ` [syzbot] [sctp?] kernel BUG in __pskb_pull_tail (2) syzbot
2026-10-29 23:21 syzbot
2026-11-04 5:03 ` syzbot
2026-11-05 3:13 ` Xin Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aeb10e7.7bd3e221.25cd79.0000.GAE@google.com \
--to=syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com \
--cc=gowtham398gs@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.