* [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
@ 2025-05-01 16:45 syzbot
2025-05-02 9:54 ` Zhu Yanjun
2025-06-26 20:55 ` syzbot
0 siblings, 2 replies; 27+ messages in thread
From: syzbot @ 2025-05-01 16:45 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, zyjzyj2000
Hello,
syzbot found the following issue on:
HEAD commit: 8bac8898fe39 Merge tag 'mmc-v6.15-rc1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16b6d774580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a9a25b7a36123454
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-8bac8898.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a76d594c0f5/vmlinux-8bac8898.xz
kernel image: https://storage.googleapis.com/syzbot-assets/dae09c25780d/bzImage-8bac8898.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1046 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Modules linked in:
CPU: 0 UID: 0 PID: 1046 Comm: kworker/u4:9 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Code: 80 3c 20 00 74 08 4c 89 ff e8 41 ee 8c f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 11 fe 2a f9 41 f6 c6 01 75 0e e8 26 f9 2a f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 35 c4 fa 01 48 89 c7 be 0e 00
RSP: 0018:ffffc90000007a08 EFLAGS: 00010246
RAX: ffffffff8894c5aa RBX: ffff88803ec8d280 RCX: ffff888035088000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff886e3f04 R12: dffffc0000000000
R13: 1ffff11007d91a5b R14: 0000000000025820 R15: ffff888034060000
FS: 0000000000000000(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7c6d874fc8 CR3: 00000000428c8000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1149
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0x6ea/0xdf0 net/core/dev.c:7510
handle_softirqs+0x283/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4656
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task+0x1ad/0x6b0 drivers/infiniband/sw/rxe/rxe_task.c:127
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-05-01 16:45 syzbot
@ 2025-05-02 9:54 ` Zhu Yanjun
2025-05-13 14:57 ` Zhu Yanjun
2025-06-26 20:55 ` syzbot
1 sibling, 1 reply; 27+ messages in thread
From: Zhu Yanjun @ 2025-05-02 9:54 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
On 01.05.25 18:45, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8bac8898fe39 Merge tag 'mmc-v6.15-rc1' of git://git.kernel..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16b6d774580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a9a25b7a36123454
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-8bac8898.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/2a76d594c0f5/vmlinux-8bac8898.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/dae09c25780d/bzImage-8bac8898.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 1046 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
This is a known problem. It seems to be related with the following commit.
commit 1a633bdc8fd9e9e4a9f9a668ae122edfc5aacc86
Author: Bob Pearson <rpearsonhpe@gmail.com>
Date: Fri Mar 29 09:55:15 2024 -0500
RDMA/rxe: Let destroy qp succeed with stuck packet
In some situations a sent packet may get queued in the NIC longer than
than timeout of a ULP. Currently if this happens the ULP may try to
reset
the link by destroying the qp and setting up an alternate
connection but
will fail because the rxe driver is waiting for the packet to finish
getting sent and be returned to the skb destructor function where
the qp
reference holding things up will be dropped. This patch modifies
the way
that the qp is passed to the destructor to pass the qp index and
not a qp
pointer. Then the destructor will attempt to lookup the qp from
its index
and if it fails exit early. This requires taking a reference on the
struct
sock rather than the qp allowing the qp to be destroyed while the sk is
still around waiting for the packet to finish.
Link:
https://lore.kernel.org/r/20240329145513.35381-15-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Zhu Yanjun
> Modules linked in:
> CPU: 0 UID: 0 PID: 1046 Comm: kworker/u4:9 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
> Code: 80 3c 20 00 74 08 4c 89 ff e8 41 ee 8c f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 11 fe 2a f9 41 f6 c6 01 75 0e e8 26 f9 2a f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 35 c4 fa 01 48 89 c7 be 0e 00
> RSP: 0018:ffffc90000007a08 EFLAGS: 00010246
> RAX: ffffffff8894c5aa RBX: ffff88803ec8d280 RCX: ffff888035088000
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: ffffffff886e3f04 R12: dffffc0000000000
> R13: 1ffff11007d91a5b R14: 0000000000025820 R15: ffff888034060000
> FS: 0000000000000000(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f7c6d874fc8 CR3: 00000000428c8000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1149
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc4/0x480 net/core/dev.c:7324
> napi_poll net/core/dev.c:7388 [inline]
> net_rx_action+0x6ea/0xdf0 net/core/dev.c:7510
> handle_softirqs+0x283/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
> __dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4656
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task+0x1ad/0x6b0 drivers/infiniband/sw/rxe/rxe_task.c:127
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-05-02 9:54 ` Zhu Yanjun
@ 2025-05-13 14:57 ` Zhu Yanjun
0 siblings, 0 replies; 27+ messages in thread
From: Zhu Yanjun @ 2025-05-13 14:57 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
On 02.05.25 11:54, Zhu Yanjun wrote:
> On 01.05.25 18:45, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 8bac8898fe39 Merge tag 'mmc-v6.15-rc1' of
>> git://git.kernel..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=16b6d774580000
>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=a9a25b7a36123454
>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
>> compiler: Debian clang version 20.1.2
>> (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD
>> 20.1.2
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image (non-bootable):
>> https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-8bac8898.raw.xz
>> vmlinux:
>> https://storage.googleapis.com/syzbot-assets/2a76d594c0f5/vmlinux-8bac8898.xz
>> kernel image:
>> https://storage.googleapis.com/syzbot-assets/dae09c25780d/bzImage-8bac8898.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the
>> commit:
>> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>>
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 1046 at drivers/infiniband/sw/rxe/rxe_net.c:357
>> rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
>
> This is a known problem. It seems to be related with the following commit.
>
> commit 1a633bdc8fd9e9e4a9f9a668ae122edfc5aacc86
> Author: Bob Pearson <rpearsonhpe@gmail.com>
> Date: Fri Mar 29 09:55:15 2024 -0500
>
> RDMA/rxe: Let destroy qp succeed with stuck packet
>
> In some situations a sent packet may get queued in the NIC longer than
> than timeout of a ULP. Currently if this happens the ULP may try to
> reset
> the link by destroying the qp and setting up an alternate
> connection but
> will fail because the rxe driver is waiting for the packet to finish
> getting sent and be returned to the skb destructor function where
> the qp
> reference holding things up will be dropped. This patch modifies
> the way
> that the qp is passed to the destructor to pass the qp index and
> not a qp
> pointer. Then the destructor will attempt to lookup the qp from
> its index
> and if it fails exit early. This requires taking a reference on the
> struct
> sock rather than the qp allowing the qp to be destroyed while the
> sk is
> still around waiting for the packet to finish.
>
> Link:
> https://lore.kernel.org/r/20240329145513.35381-15-rpearsonhpe@gmail.com
> Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
I can not reproduce this problem in my local host. It seems that this
problem will occur when rdma SKBs are still in flight after the related
qp was destroyed.
In this case, a solution is to make qp wait for 200 milliseconds if some
rdma SKBs are still in flight before a qp is destroyed.
Please verify this problem still occur or not with the following diff.
diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c
b/drivers/infiniband/sw/rxe/rxe_qp.c
index 7975fb0e2782..8646ebe1c85d 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -862,10 +862,20 @@ static void rxe_qp_do_cleanup(struct work_struct
*work)
}
}
+#define RXE_CLEANUP_SKB_IN_FLIGHT_TIMEOUT 200
+
/* called when the last reference to the qp is dropped */
void rxe_qp_cleanup(struct rxe_pool_elem *elem)
{
struct rxe_qp *qp = container_of(elem, typeof(*qp), elem);
+ int cnt = RXE_CLEANUP_SKB_IN_FLIGHT_TIMEOUT;
+
+ /* Before qp is cleanup, check skb in flight */
+ while (cnt && atomic_read(&qp->skb_out) > 0) {
+ msleep(1);
+ cnt--;
+ cond_resched();
+ }
execute_in_process_context(rxe_qp_do_cleanup, &qp->cleanup_work);
}
Best Regards,
Zhu Yanjun
>
> Zhu Yanjun
>
>> Modules linked in:
>> CPU: 0 UID: 0 PID: 1046 Comm: kworker/u4:9 Not tainted
>> 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 #0 PREEMPT(full)
>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
>> 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
>> Workqueue: rxe_wq do_work
>> RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0
>> drivers/infiniband/sw/rxe/rxe_net.c:357
>> Code: 80 3c 20 00 74 08 4c 89 ff e8 41 ee 8c f9 4d 8b 37 44 89 f6 83
>> e6 01 31 ff e8 11 fe 2a f9 41 f6 c6 01 75 0e e8 26 f9 2a f9 90 <0f> 0b
>> 90 e9 b4 01 00 00 4c 89 ff e8 35 c4 fa 01 48 89 c7 be 0e 00
>> RSP: 0018:ffffc90000007a08 EFLAGS: 00010246
>> RAX: ffffffff8894c5aa RBX: ffff88803ec8d280 RCX: ffff888035088000
>> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
>> RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
>> R10: 0000000000000000 R11: ffffffff886e3f04 R12: dffffc0000000000
>> R13: 1ffff11007d91a5b R14: 0000000000025820 R15: ffff888034060000
>> FS: 0000000000000000(0000) GS:ffff88808d6cc000(0000)
>> knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 00007f7c6d874fc8 CR3: 00000000428c8000 CR4: 0000000000352ef0
>> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> Call Trace:
>> <IRQ>
>> skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1149
>> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
>> e1000_unmap_and_free_tx_resource
>> drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
>> e1000_clean_tx_irq
>> drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
>> e1000_clean+0x49d/0x2b00
>> drivers/net/ethernet/intel/e1000/e1000_main.c:3805
>> __napi_poll+0xc4/0x480 net/core/dev.c:7324
>> napi_poll net/core/dev.c:7388 [inline]
>> net_rx_action+0x6ea/0xdf0 net/core/dev.c:7510
>> handle_softirqs+0x283/0x870 kernel/softirq.c:579
>> do_softirq+0xec/0x180 kernel/softirq.c:480
>> </IRQ>
>> <TASK>
>> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
>> local_bh_enable include/linux/bottom_half.h:33 [inline]
>> rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
>> __dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4656
>> neigh_output include/net/neighbour.h:539 [inline]
>> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
>> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
>> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
>> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
>> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
>> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
>> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
>> do_task+0x1ad/0x6b0 drivers/infiniband/sw/rxe/rxe_task.c:127
>> process_one_work kernel/workqueue.c:3238 [inline]
>> process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
>> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
>> kthread+0x70e/0x8a0 kernel/kthread.c:464
>> ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>> </TASK>
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>
>> If the report is already addressed, let syzbot know by replying with:
>> #syz fix: exact-commit-title
>>
>> If you want to overwrite report's subsystems, reply with:
>> #syz set subsystems: new-subsystem
>> (See the list of subsystem names on the web dashboard)
>>
>> If the report is a duplicate of another one, reply with:
>> #syz dup: exact-subject-of-another-report
>>
>> If you want to undo deduplication, reply with:
>> #syz undup
>
--
Best Regards,
Yanjun.Zhu
^ permalink raw reply related [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-05-01 16:45 syzbot
2025-05-02 9:54 ` Zhu Yanjun
@ 2025-06-26 20:55 ` syzbot
2025-06-26 22:22 ` Yanjun.Zhu
2025-06-26 22:52 ` Hillf Danton
1 sibling, 2 replies; 27+ messages in thread
From: syzbot @ 2025-06-26 20:55 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
syzbot has found a reproducer for the following issue on:
HEAD commit: ee88bddf7f2f Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14367182580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e9008c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c12f0c580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-ee88bddf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/258fe65055ba/vmlinux-ee88bddf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/06b784a6d799/bzImage-ee88bddf.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/59084afab8b5/mount_2.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1088 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Modules linked in:
CPU: 0 UID: 0 PID: 1088 Comm: kworker/u4:9 Not tainted 6.16.0-rc3-syzkaller-00072-gee88bddf7f2f #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Code: 80 3c 20 00 74 08 4c 89 ff e8 61 65 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 71 e6 1d f9 41 f6 c6 01 75 0e e8 86 e1 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 75 89 fd 01 48 89 c7 be 0e 00
RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
RAX: ffffffff88a26cea RBX: ffff888048886000 RCX: ffff8880330b4880
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
R13: 1ffff11009110c0b R14: 0000000000025820 R15: ffff888033430000
FS: 0000000000000000(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd7005cfa8 CR3: 0000000047588000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 20:55 ` syzbot
@ 2025-06-26 22:22 ` Yanjun.Zhu
2025-06-26 22:25 ` syzbot
2025-06-26 22:52 ` Hillf Danton
1 sibling, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-26 22:22 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
#syz test: git@github.com:zhuyj/linux.git linux-6.15-rc4-fix-rxe_skb_tx_dtor
On 6/26/25 1:55 PM, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ee88bddf7f2f Merge tag 'bpf-fixes' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14367182580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e9008c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c12f0c580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-ee88bddf.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/258fe65055ba/vmlinux-ee88bddf.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/06b784a6d799/bzImage-ee88bddf.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/59084afab8b5/mount_2.gz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 1088 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
> Modules linked in:
> CPU: 0 UID: 0 PID: 1088 Comm: kworker/u4:9 Not tainted 6.16.0-rc3-syzkaller-00072-gee88bddf7f2f #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
> Code: 80 3c 20 00 74 08 4c 89 ff e8 61 65 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 71 e6 1d f9 41 f6 c6 01 75 0e e8 86 e1 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 75 89 fd 01 48 89 c7 be 0e 00
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
> RAX: ffffffff88a26cea RBX: ffff888048886000 RCX: ffff8880330b4880
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
> R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
> R13: 1ffff11009110c0b R14: 0000000000025820 R15: ffff888033430000
> FS: 0000000000000000(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffd7005cfa8 CR3: 0000000047588000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc4/0x480 net/core/dev.c:7414
> napi_poll net/core/dev.c:7478 [inline]
> net_rx_action+0x707/0xe30 net/core/dev.c:7605
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
> __dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
> do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 22:22 ` Yanjun.Zhu
@ 2025-06-26 22:25 ` syzbot
2025-06-26 22:38 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-26 22:25 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to checkout kernel repo git@github.com:zhuyj/linux.git/linux-6.15-rc4-fix-rxe_skb_tx_dtor: failed to run ["git" "fetch" "--force" "9a778a5fe5e4b8c26d97f27ad3305a963b60aef0" "linux-6.15-rc4-fix-rxe_skb_tx_dtor"]: exit status 128
Host key verification failed.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Tested on:
commit: [unknown
git tree: git@github.com:zhuyj/linux.git linux-6.15-rc4-fix-rxe_skb_tx_dtor
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler:
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 22:25 ` syzbot
@ 2025-06-26 22:38 ` Yanjun.Zhu
2025-06-26 22:54 ` syzbot
2025-06-27 2:49 ` Zhu Yanjun
0 siblings, 2 replies; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-26 22:38 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
#syz test: https://github.com/zhuyj/linux.git
linux-6.15-rc4-fix-rxe_skb_tx_dtor
On 6/26/25 3:25 PM, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
>
> failed to checkout kernel repo git@github.com:zhuyj/linux.git/linux-6.15-rc4-fix-rxe_skb_tx_dtor: failed to run ["git" "fetch" "--force" "9a778a5fe5e4b8c26d97f27ad3305a963b60aef0" "linux-6.15-rc4-fix-rxe_skb_tx_dtor"]: exit status 128
> Host key verification failed.
> fatal: Could not read from remote repository.
>
> Please make sure you have the correct access rights
> and the repository exists.
>
>
>
> Tested on:
>
> commit: [unknown
> git tree: git@github.com:zhuyj/linux.git linux-6.15-rc4-fix-rxe_skb_tx_dtor
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler:
>
> Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 20:55 ` syzbot
2025-06-26 22:22 ` Yanjun.Zhu
@ 2025-06-26 22:52 ` Hillf Danton
2025-06-26 23:09 ` syzbot
1 sibling, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2025-06-26 22:52 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Thu, 26 Jun 2025 13:55:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: ee88bddf7f2f Merge tag 'bpf-fixes' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14367182580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10e9008c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c12f0c580000
#syz test
--- x/drivers/infiniband/sw/rxe/rxe_net.c
+++ y/drivers/infiniband/sw/rxe/rxe_net.c
@@ -471,6 +471,7 @@ struct sk_buff *rxe_init_packet(struct r
struct net_device *ndev;
const struct ib_gid_attr *attr;
const int port_num = 1;
+ struct rxe_dev *rdev;
attr = rdma_get_gid_attr(&rxe->ib_dev, port_num, av->grh.sgid_index);
if (IS_ERR(attr))
@@ -503,6 +504,17 @@ struct sk_buff *rxe_init_packet(struct r
skb->dev = ndev;
rcu_read_unlock();
+ rdev = rxe_get_dev_from_net(ndev);
+ if (!rdev && is_vlan_dev(ndev))
+ rdev = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
+ if (rdev)
+ ib_device_put(&rdev->ib_dev);
+ if (rdev != rxe) {
+ kfree_skb(skb);
+ skb = NULL;
+ goto out;
+ }
+
if (av->network_type == RXE_NETWORK_TYPE_IPV4)
skb->protocol = htons(ETH_P_IP);
else
--
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 22:38 ` Yanjun.Zhu
@ 2025-06-26 22:54 ` syzbot
2025-06-27 2:49 ` Zhu Yanjun
1 sibling, 0 replies; 27+ messages in thread
From: syzbot @ 2025-06-26 22:54 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in rxe_skb_tx_dtor
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1093 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Modules linked in:
CPU: 0 UID: 0 PID: 1093 Comm: kworker/u4:9 Not tainted 6.15.0-rc4-syzkaller-00150-ge382eacdcc20 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Code: 80 3c 20 00 74 08 4c 89 ff e8 91 fd 89 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 61 41 27 f9 41 f6 c6 01 75 0e e8 76 3c 27 f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 85 0d fb 01 48 89 c7 be 0e 00
RSP: 0018:ffffc90000007a08 EFLAGS: 00010246
RAX: ffffffff8898ce3a RBX: ffff888043ae33c0 RCX: ffff88803513a440
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff88723ee4 R12: dffffc0000000000
R13: 1ffff1100875c683 R14: 0000000000025820 R15: ffff888035198000
FS: 0000000000000000(0000) GS:ffff88808d6b1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f31350a7fc8 CR3: 0000000059b8c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1149
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0x6ea/0xdf0 net/core/dev.c:7510
handle_softirqs+0x283/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4656
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task+0x1ad/0x6b0 drivers/infiniband/sw/rxe/rxe_task.c:127
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: e382eacd RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git linux-6.15-rc4-fix-rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=14a83b70580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bf156ad608427e4b
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 22:52 ` Hillf Danton
@ 2025-06-26 23:09 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2025-06-26 23:09 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in rxe_skb_tx_dtor
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1038 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Modules linked in:
CPU: 0 UID: 0 PID: 1038 Comm: kworker/u4:6 Not tainted 6.16.0-rc3-syzkaller-gf02769e7f272-dirty #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Code: 80 3c 20 00 74 08 4c 89 ff e8 d1 64 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 e1 e5 1d f9 41 f6 c6 01 75 0e e8 f6 e0 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 35 94 fd 01 48 89 c7 be 0e 00
RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
RAX: ffffffff88a26d7a RBX: ffff888055e923c0 RCX: ffff8880330c2440
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
R10: dffffc0000000000 R11: ffffffff88a26cf0 R12: dffffc0000000000
R13: 1ffff1100abd2483 R14: 0000000000025820 R15: ffff888033808000
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f08899dcfc8 CR3: 0000000032fcf000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
__neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
neigh_event_send_probe include/net/neighbour.h:463 [inline]
neigh_event_send include/net/neighbour.h:469 [inline]
neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fe/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: f02769e7 Merge tag 'devicetree-fixes-for-6.16-1' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1693008c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
patch: https://syzkaller.appspot.com/x/patch.diff?x=13283b70580000
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-26 22:38 ` Yanjun.Zhu
2025-06-26 22:54 ` syzbot
@ 2025-06-27 2:49 ` Zhu Yanjun
2025-06-27 3:11 ` syzbot
1 sibling, 1 reply; 27+ messages in thread
From: Zhu Yanjun @ 2025-06-27 2:49 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
在 2025/6/26 15:38, Yanjun.Zhu 写道:
> #syz test: https://github.com/zhuyj/linux.git
> linux-6.15-rc4-fix-rxe_skb_tx_dtor
>
> On 6/26/25 3:25 PM, syzbot wrote:
>> Hello,
>>
>> syzbot tried to test the proposed patch but the build/boot failed:
>>
>> failed to checkout kernel repo
>> git@github.com:zhuyj/linux.git/linux-6.15-rc4-fix-rxe_skb_tx_dtor:
>> failed to run ["git" "fetch" "--force"
>> "9a778a5fe5e4b8c26d97f27ad3305a963b60aef0"
>> "linux-6.15-rc4-fix-rxe_skb_tx_dtor"]: exit status 128
>> Host key verification failed.
>> fatal: Could not read from remote repository.
>>
>> Please make sure you have the correct access rights
>> and the repository exists.
>>
>>
>>
>> Tested on:
>>
>> commit: [unknown
>> git tree: git@github.com:zhuyj/linux.git
>> linux-6.15-rc4-fix-rxe_skb_tx_dtor
>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
>> compiler:
>>
>> Note: no patches were applied.
--
Best Regards,
Yanjun.Zhu
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 2:49 ` Zhu Yanjun
@ 2025-06-27 3:11 ` syzbot
2025-06-27 3:41 ` Zhu Yanjun
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 3:11 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested on:
commit: f648fc0a Revert "RDMA/rxe: Let destroy qp succeed with..
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=14372f0c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 3:11 ` syzbot
@ 2025-06-27 3:41 ` Zhu Yanjun
2025-06-27 3:57 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Zhu Yanjun @ 2025-06-27 3:41 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
在 2025/6/26 20:11, syzbot 写道:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
> Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: f648fc0a Revert "RDMA/rxe: Let destroy qp succeed with..
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=14372f0c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
> Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 3:41 ` Zhu Yanjun
@ 2025-06-27 3:57 ` syzbot
2025-06-27 4:53 ` Zhu Yanjun
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 3:57 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in rxe_skb_tx_dtor
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3034 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Modules linked in:
CPU: 0 UID: 0 PID: 3034 Comm: kworker/u4:10 Not tainted 6.16.0-rc3-syzkaller-ge9ef70b277ad #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
Code: 80 3c 20 00 74 08 4c 89 ff e8 c1 64 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 d1 e5 1d f9 41 f6 c6 01 75 0e e8 e6 e0 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 45 97 fd 01 48 89 c7 be 0e 00
RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
RAX: ffffffff88a26d8a RBX: ffff8880560d4500 RCX: ffff88801f722440
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
R10: dffffc0000000000 R11: ffffffff88a26d00 R12: dffffc0000000000
R13: 1ffff1100ac1a8ab R14: 0000000000025820 R15: ffff888033440000
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e595acfc8 CR3: 0000000056029000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc7/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
__neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
neigh_event_send_probe include/net/neighbour.h:463 [inline]
neigh_event_send include/net/neighbour.h:469 [inline]
neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b4/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: e9ef70b2 RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=122183d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 3:57 ` syzbot
@ 2025-06-27 4:53 ` Zhu Yanjun
2025-06-27 5:09 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Zhu Yanjun @ 2025-06-27 4:53 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs,
zyjzyj2000
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
在 2025/6/26 20:57, syzbot 写道:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in rxe_skb_tx_dtor
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 3034 at drivers/infiniband/sw/rxe/rxe_net.c:357 rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
> Modules linked in:
> CPU: 0 UID: 0 PID: 3034 Comm: kworker/u4:10 Not tainted 6.16.0-rc3-syzkaller-ge9ef70b277ad #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> RIP: 0010:rxe_skb_tx_dtor+0x8b/0x2a0 drivers/infiniband/sw/rxe/rxe_net.c:357
> Code: 80 3c 20 00 74 08 4c 89 ff e8 c1 64 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 d1 e5 1d f9 41 f6 c6 01 75 0e e8 e6 e0 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 45 97 fd 01 48 89 c7 be 0e 00
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
> RAX: ffffffff88a26d8a RBX: ffff8880560d4500 RCX: ffff88801f722440
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
> RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
> R10: dffffc0000000000 R11: ffffffff88a26d00 R12: dffffc0000000000
> R13: 1ffff1100ac1a8ab R14: 0000000000025820 R15: ffff888033440000
> FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f5e595acfc8 CR3: 0000000056029000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc7/0x480 net/core/dev.c:7414
> napi_poll net/core/dev.c:7478 [inline]
> net_rx_action+0x707/0xe30 net/core/dev.c:7605
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> __neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
> neigh_event_send_probe include/net/neighbour.h:463 [inline]
> neigh_event_send include/net/neighbour.h:469 [inline]
> neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:391 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:450
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
> do_work+0x1b4/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
>
> Tested on:
>
> commit: e9ef70b2 RDNA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=122183d4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
--
Best Regards,
Yanjun.Zhu
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 4:53 ` Zhu Yanjun
@ 2025-06-27 5:09 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2025-06-27 5:09 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu,
zyjzyj2000
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in rxe_skb_tx_dtor
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1039 at drivers/infiniband/sw/rxe/rxe_net.c:360 rxe_skb_tx_dtor+0x94/0x2b0 drivers/infiniband/sw/rxe/rxe_net.c:360
Modules linked in:
CPU: 0 UID: 0 PID: 1039 Comm: kworker/u4:7 Not tainted 6.16.0-rc3-syzkaller-gc2b99574e921 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x94/0x2b0 drivers/infiniband/sw/rxe/rxe_net.c:360
Code: 80 3c 20 00 74 08 4c 89 ff e8 b8 64 81 f9 4d 8b 37 44 89 f6 83 e6 01 31 ff e8 c8 e5 1d f9 41 f6 c6 01 75 0e e8 dd e0 1d f9 90 <0f> 0b 90 e9 b4 01 00 00 4c 89 ff e8 4c 97 fd 01 48 89 c7 be 0e 00
RSP: 0018:ffffc900000079e8 EFLAGS: 00010246
RAX: ffffffff88a26d93 RBX: ffff88804844d000 RCX: ffff88800037a440
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff887bc1c4
R10: dffffc0000000000 R11: ffffffff88a26d00 R12: dffffc0000000000
R13: 1ffff11009089a0b R14: 0000000000025820 R15: ffff8880333d0000
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f12ddf0ffc8 CR3: 00000000550c0000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
__neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
neigh_event_send_probe include/net/neighbour.h:463 [inline]
neigh_event_send include/net/neighbour.h:469 [inline]
neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:394 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:453
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b4/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Tested on:
commit: c2b99574 RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=12e983d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
[not found] <f63acb1b-083f-4a48-8352-d07d48827330@linux.dev>
@ 2025-06-27 18:43 ` syzbot
2025-06-27 19:35 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 18:43 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, yanjun.zhu
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: wild-memory-access Read in __rxe_get
==================================================================
BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: wild-memory-access in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: wild-memory-access in refcount_read include/linux/refcount.h:170 [inline]
BUG: KASAN: wild-memory-access in __refcount_add_not_zero include/linux/refcount.h:176 [inline]
BUG: KASAN: wild-memory-access in __refcount_inc_not_zero include/linux/refcount.h:317 [inline]
BUG: KASAN: wild-memory-access in refcount_inc_not_zero include/linux/refcount.h:335 [inline]
BUG: KASAN: wild-memory-access in kref_get_unless_zero include/linux/kref.h:131 [inline]
BUG: KASAN: wild-memory-access in __rxe_get+0x79/0x1c0 drivers/infiniband/sw/rxe/rxe_pool.c:241
Read of size 4 at addr 0006000000000210 by task kworker/u4:6/1038
CPU: 0 UID: 0 PID: 1038 Comm: kworker/u4:6 Not tainted 6.16.0-rc3-syzkaller-gfa5598b27d21 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
Call Trace:
<IRQ>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
kasan_report+0x118/0x150 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
refcount_read include/linux/refcount.h:170 [inline]
__refcount_add_not_zero include/linux/refcount.h:176 [inline]
__refcount_inc_not_zero include/linux/refcount.h:317 [inline]
refcount_inc_not_zero include/linux/refcount.h:335 [inline]
kref_get_unless_zero include/linux/kref.h:131 [inline]
__rxe_get+0x79/0x1c0 drivers/infiniband/sw/rxe/rxe_pool.c:241
rxe_skb_tx_dtor+0x79/0x1e0 drivers/infiniband/sw/rxe/rxe_net.c:363
skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc4/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fe/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:385 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:444
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
==================================================================
Tested on:
commit: fa5598b2 RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=16b943d4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 18:43 ` [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor syzbot
@ 2025-06-27 19:35 ` Yanjun.Zhu
2025-06-27 19:50 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-27 19:35 UTC (permalink / raw)
To: syzbot, linux-kernel, syzkaller-bugs
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
On 6/27/25 11:43 AM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: wild-memory-access Read in __rxe_get
>
> ==================================================================
> BUG: KASAN: wild-memory-access in instrument_atomic_read include/linux/instrumented.h:68 [inline]
> BUG: KASAN: wild-memory-access in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
> BUG: KASAN: wild-memory-access in refcount_read include/linux/refcount.h:170 [inline]
> BUG: KASAN: wild-memory-access in __refcount_add_not_zero include/linux/refcount.h:176 [inline]
> BUG: KASAN: wild-memory-access in __refcount_inc_not_zero include/linux/refcount.h:317 [inline]
> BUG: KASAN: wild-memory-access in refcount_inc_not_zero include/linux/refcount.h:335 [inline]
> BUG: KASAN: wild-memory-access in kref_get_unless_zero include/linux/kref.h:131 [inline]
> BUG: KASAN: wild-memory-access in __rxe_get+0x79/0x1c0 drivers/infiniband/sw/rxe/rxe_pool.c:241
> Read of size 4 at addr 0006000000000210 by task kworker/u4:6/1038
>
> CPU: 0 UID: 0 PID: 1038 Comm: kworker/u4:6 Not tainted 6.16.0-rc3-syzkaller-gfa5598b27d21 #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> Call Trace:
> <IRQ>
> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
> kasan_report+0x118/0x150 mm/kasan/report.c:634
> check_region_inline mm/kasan/generic.c:-1 [inline]
> kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189
> instrument_atomic_read include/linux/instrumented.h:68 [inline]
> atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
> refcount_read include/linux/refcount.h:170 [inline]
> __refcount_add_not_zero include/linux/refcount.h:176 [inline]
> __refcount_inc_not_zero include/linux/refcount.h:317 [inline]
> refcount_inc_not_zero include/linux/refcount.h:335 [inline]
> kref_get_unless_zero include/linux/kref.h:131 [inline]
> __rxe_get+0x79/0x1c0 drivers/infiniband/sw/rxe/rxe_pool.c:241
> rxe_skb_tx_dtor+0x79/0x1e0 drivers/infiniband/sw/rxe/rxe_net.c:363
> skb_release_head_state+0xfe/0x250 net/core/skbuff.c:1139
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc4/0x480 net/core/dev.c:7414
> napi_poll net/core/dev.c:7478 [inline]
> net_rx_action+0x707/0xe30 net/core/dev.c:7605
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
> __dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fe/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:385 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:444
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
> do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
> ==================================================================
>
>
> Tested on:
>
> commit: fa5598b2 RDNA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=16b943d4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 19:35 ` Yanjun.Zhu
@ 2025-06-27 19:50 ` syzbot
2025-06-27 20:26 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 19:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, yanjun.zhu
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in rxe_skb_tx_dtor
Oops: general protection fault, probably for non-canonical address 0xe000bc000000006c: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x0006000000000360-0x0006000000000367]
CPU: 0 UID: 0 PID: 1088 Comm: kworker/u4:10 Not tainted 6.16.0-rc3-syzkaller-g907cb0dfd322 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
RAX: 0000c0000000006c RBX: ffff88804e71d140 RCX: ffff8880357ac880
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88804e71d140
RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9de1ffdfc8 CR3: 00000000441ff000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc7/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
__dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:390 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:449
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
RAX: 0000c0000000006c RBX: ffff88804e71d140 RCX: ffff8880357ac880
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88804e71d140
RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9de1ffdfc8 CR3: 00000000441ff000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 42 80 add -0x80(%rdx),%eax
3: 3c 28 cmp $0x28,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 72 65 81 f9 call 0xf9816582
10: 4d 8b 36 mov (%r14),%r14
13: 4d 85 f6 test %r14,%r14
16: 0f 84 c3 00 00 00 je 0xdf
1c: 4d 8d be 60 03 00 00 lea 0x360(%r14),%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 77 01 00 00 jne 0x1ae
37: 41 8b 2f mov (%r15),%ebp
3a: 31 ff xor %edi,%edi
3c: 89 ee mov %ebp,%esi
3e: e8 .byte 0xe8
3f: bf .byte 0xbf
Tested on:
commit: 907cb0df RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=109be08c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 19:50 ` syzbot
@ 2025-06-27 20:26 ` Yanjun.Zhu
2025-06-27 20:46 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-27 20:26 UTC (permalink / raw)
To: syzbot, linux-kernel, syzkaller-bugs
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
On 6/27/25 12:50 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in rxe_skb_tx_dtor
>
> Oops: general protection fault, probably for non-canonical address 0xe000bc000000006c: 0000 [#1] SMP KASAN NOPTI
> KASAN: maybe wild-memory-access in range [0x0006000000000360-0x0006000000000367]
> CPU: 0 UID: 0 PID: 1088 Comm: kworker/u4:10 Not tainted 6.16.0-rc3-syzkaller-g907cb0dfd322 #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
> Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
> RAX: 0000c0000000006c RBX: ffff88804e71d140 RCX: ffff8880357ac880
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88804e71d140
> RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
> R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
> R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
> FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f9de1ffdfc8 CR3: 00000000441ff000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc7/0x480 net/core/dev.c:7414
> napi_poll net/core/dev.c:7478 [inline]
> net_rx_action+0x707/0xe30 net/core/dev.c:7605
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> rcu_read_unlock_bh include/linux/rcupdate.h:910 [inline]
> __dev_queue_xmit+0x1cd7/0x3a70 net/core/dev.c:4740
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:390 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:449
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
> do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
> Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
> RAX: 0000c0000000006c RBX: ffff88804e71d140 RCX: ffff8880357ac880
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88804e71d140
> RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
> R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
> R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
> FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f9de1ffdfc8 CR3: 00000000441ff000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> ----------------
> Code disassembly (best guess):
> 0: 03 42 80 add -0x80(%rdx),%eax
> 3: 3c 28 cmp $0x28,%al
> 5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
> 9: 89 f7 mov %esi,%edi
> b: e8 72 65 81 f9 call 0xf9816582
> 10: 4d 8b 36 mov (%r14),%r14
> 13: 4d 85 f6 test %r14,%r14
> 16: 0f 84 c3 00 00 00 je 0xdf
> 1c: 4d 8d be 60 03 00 00 lea 0x360(%r14),%r15
> 23: 4c 89 f8 mov %r15,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
> 2f: 84 c0 test %al,%al
> 31: 0f 85 77 01 00 00 jne 0x1ae
> 37: 41 8b 2f mov (%r15),%ebp
> 3a: 31 ff xor %edi,%edi
> 3c: 89 ee mov %ebp,%esi
> 3e: e8 .byte 0xe8
> 3f: bf .byte 0xbf
>
>
> Tested on:
>
> commit: 907cb0df RDNA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=109be08c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 20:26 ` Yanjun.Zhu
@ 2025-06-27 20:46 ` syzbot
2025-06-27 23:10 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 20:46 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, yanjun.zhu
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in rxe_skb_tx_dtor
Oops: general protection fault, probably for non-canonical address 0xe000bc000000006c: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x0006000000000360-0x0006000000000367]
CPU: 0 UID: 0 PID: 1039 Comm: kworker/u4:7 Not tainted 6.16.0-rc3-syzkaller-gc0e71fcff378 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
RAX: 0000c0000000006c RBX: ffff8880122848c0 RCX: ffff8880330a8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8880122848c0
RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb0aec28fc8 CR3: 000000004f814000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
__napi_poll+0xc7/0x480 net/core/dev.c:7414
napi_poll net/core/dev.c:7478 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7605
handle_softirqs+0x286/0x870 kernel/softirq.c:579
do_softirq+0xec/0x180 kernel/softirq.c:480
</IRQ>
<TASK>
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
local_bh_enable include/linux/bottom_half.h:33 [inline]
__neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
neigh_event_send_probe include/net/neighbour.h:463 [inline]
neigh_event_send include/net/neighbour.h:469 [inline]
neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
neigh_output include/net/neighbour.h:539 [inline]
ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
rxe_send drivers/infiniband/sw/rxe/rxe_net.c:390 [inline]
rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:449
rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
RAX: 0000c0000000006c RBX: ffff8880122848c0 RCX: ffff8880330a8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8880122848c0
RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb0aec28fc8 CR3: 000000004f814000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 03 42 80 add -0x80(%rdx),%eax
3: 3c 28 cmp $0x28,%al
5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
9: 89 f7 mov %esi,%edi
b: e8 72 65 81 f9 call 0xf9816582
10: 4d 8b 36 mov (%r14),%r14
13: 4d 85 f6 test %r14,%r14
16: 0f 84 c3 00 00 00 je 0xdf
1c: 4d 8d be 60 03 00 00 lea 0x360(%r14),%r15
23: 4c 89 f8 mov %r15,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2f: 84 c0 test %al,%al
31: 0f 85 77 01 00 00 jne 0x1ae
37: 41 8b 2f mov (%r15),%ebp
3a: 31 ff xor %edi,%edi
3c: 89 ee mov %ebp,%esi
3e: e8 .byte 0xe8
3f: bf .byte 0xbf
Tested on:
commit: c0e71fcf RDNA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=13d9708c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 20:46 ` syzbot
@ 2025-06-27 23:10 ` Yanjun.Zhu
2025-06-27 23:32 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-27 23:10 UTC (permalink / raw)
To: syzbot, linux-kernel, syzkaller-bugs
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
On 6/27/25 1:46 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> general protection fault in rxe_skb_tx_dtor
>
> Oops: general protection fault, probably for non-canonical address 0xe000bc000000006c: 0000 [#1] SMP KASAN NOPTI
> KASAN: maybe wild-memory-access in range [0x0006000000000360-0x0006000000000367]
> CPU: 0 UID: 0 PID: 1039 Comm: kworker/u4:7 Not tainted 6.16.0-rc3-syzkaller-gc0e71fcff378 #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
> Workqueue: rxe_wq do_work
> RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
> Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
> RAX: 0000c0000000006c RBX: ffff8880122848c0 RCX: ffff8880330a8000
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8880122848c0
> RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
> R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
> R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
> FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fb0aec28fc8 CR3: 000000004f814000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <IRQ>
> skb_release_head_state+0x101/0x250 net/core/skbuff.c:1139
> napi_consume_skb+0xd2/0x1e0 net/core/skbuff.c:-1
> e1000_unmap_and_free_tx_resource drivers/net/ethernet/intel/e1000/e1000_main.c:1972 [inline]
> e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3864 [inline]
> e1000_clean+0x49d/0x2b00 drivers/net/ethernet/intel/e1000/e1000_main.c:3805
> __napi_poll+0xc7/0x480 net/core/dev.c:7414
> napi_poll net/core/dev.c:7478 [inline]
> net_rx_action+0x707/0xe30 net/core/dev.c:7605
> handle_softirqs+0x286/0x870 kernel/softirq.c:579
> do_softirq+0xec/0x180 kernel/softirq.c:480
> </IRQ>
> <TASK>
> __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
> local_bh_enable include/linux/bottom_half.h:33 [inline]
> __neigh_event_send+0x9b/0x1560 net/core/neighbour.c:1194
> neigh_event_send_probe include/net/neighbour.h:463 [inline]
> neigh_event_send include/net/neighbour.h:469 [inline]
> neigh_resolve_output+0x198/0x750 net/core/neighbour.c:1496
> neigh_output include/net/neighbour.h:539 [inline]
> ip6_finish_output2+0x11fb/0x16a0 net/ipv6/ip6_output.c:141
> __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
> ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:226
> rxe_send drivers/infiniband/sw/rxe/rxe_net.c:390 [inline]
> rxe_xmit_packet+0x79e/0xa30 drivers/infiniband/sw/rxe/rxe_net.c:449
> rxe_requester+0x1fea/0x3d20 drivers/infiniband/sw/rxe/rxe_req.c:805
> rxe_sender+0x16/0x50 drivers/infiniband/sw/rxe/rxe_req.c:839
> do_task drivers/infiniband/sw/rxe/rxe_task.c:127 [inline]
> do_work+0x1b1/0x6c0 drivers/infiniband/sw/rxe/rxe_task.c:187
> process_one_work kernel/workqueue.c:3238 [inline]
> process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
> kthread+0x70e/0x8a0 kernel/kthread.c:464
> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:rxe_skb_tx_dtor+0x78/0x240 drivers/infiniband/sw/rxe/rxe_net.c:364
> Code: 03 42 80 3c 28 00 74 08 4c 89 f7 e8 72 65 81 f9 4d 8b 36 4d 85 f6 0f 84 c3 00 00 00 4d 8d be 60 03 00 00 4c 89 f8 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 77 01 00 00 41 8b 2f 31 ff 89 ee e8 bf
> RSP: 0018:ffffc900000079e8 EFLAGS: 00010206
> RAX: 0000c0000000006c RBX: ffff8880122848c0 RCX: ffff8880330a8000
> RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8880122848c0
> RBP: 0000000000000000 R08: ffffffff8fa10ef7 R09: 1ffffffff1f421de
> R10: dffffc0000000000 R11: ffffffff88a26c60 R12: dffffc0000000000
> R13: dffffc0000000000 R14: 0006000000000000 R15: 0006000000000360
> FS: 0000000000000000(0000) GS:ffff88808d250000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007fb0aec28fc8 CR3: 000000004f814000 CR4: 0000000000352ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> ----------------
> Code disassembly (best guess):
> 0: 03 42 80 add -0x80(%rdx),%eax
> 3: 3c 28 cmp $0x28,%al
> 5: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
> 9: 89 f7 mov %esi,%edi
> b: e8 72 65 81 f9 call 0xf9816582
> 10: 4d 8b 36 mov (%r14),%r14
> 13: 4d 85 f6 test %r14,%r14
> 16: 0f 84 c3 00 00 00 je 0xdf
> 1c: 4d 8d be 60 03 00 00 lea 0x360(%r14),%r15
> 23: 4c 89 f8 mov %r15,%rax
> 26: 48 c1 e8 03 shr $0x3,%rax
> * 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
> 2f: 84 c0 test %al,%al
> 31: 0f 85 77 01 00 00 jne 0x1ae
> 37: 41 8b 2f mov (%r15),%ebp
> 3a: 31 ff xor %edi,%edi
> 3c: 89 ee mov %ebp,%esi
> 3e: e8 .byte 0xe8
> 3f: bf .byte 0xbf
>
>
> Tested on:
>
> commit: c0e71fcf RDNA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d9708c580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 23:10 ` Yanjun.Zhu
@ 2025-06-27 23:32 ` syzbot
2025-06-27 23:42 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-06-27 23:32 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, yanjun.zhu
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested on:
commit: fac5dcad RDMA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=17db0982580000
kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 23:32 ` syzbot
@ 2025-06-27 23:42 ` Yanjun.Zhu
2025-07-03 0:36 ` Yanjun.Zhu
0 siblings, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-06-27 23:42 UTC (permalink / raw)
To: syzbot, linux-kernel, syzkaller-bugs, Leon Romanovsky,
Jason Gunthorpe, linux-rdma
Thanks a lot.
I will organize the code, add a commit log, and then send the commit to
the RDMA mailing list for review.
Best Regards,
Yanjun.Zhu
On 6/27/25 4:32 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
> Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: fac5dcad RDMA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=17db0982580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
>
> Note: no patches were applied.
> Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-06-27 23:42 ` Yanjun.Zhu
@ 2025-07-03 0:36 ` Yanjun.Zhu
2025-07-03 0:58 ` syzbot
0 siblings, 1 reply; 27+ messages in thread
From: Yanjun.Zhu @ 2025-07-03 0:36 UTC (permalink / raw)
To: syzbot, linux-kernel, syzkaller-bugs, Leon Romanovsky,
Jason Gunthorpe, linux-rdma
#syz test: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
On 6/27/25 4:42 PM, Yanjun.Zhu wrote:
> Thanks a lot.
>
> I will organize the code, add a commit log, and then send the commit
> to the RDMA mailing list for review.
>
> Best Regards,
>
> Yanjun.Zhu
>
> On 6/27/25 4:32 PM, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch and the reproducer did not
>> trigger any issue:
>>
>> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>> Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>>
>> Tested on:
>>
>> commit: fac5dcad RDMA/rxe: Fix rxe_skb_tx_dtor problem
>> git tree: https://github.com/zhuyj/linux.git
>> v6.16_fix_rxe_skb_tx_dtor
>> console output: https://syzkaller.appspot.com/x/log.txt?x=17db0982580000
>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=79da270cec5ffd65
>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
>> compiler: Debian clang version 20.1.6
>> (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD
>> 20.1.6
>>
>> Note: no patches were applied.
>> Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-07-03 0:36 ` Yanjun.Zhu
@ 2025-07-03 0:58 ` syzbot
2025-07-06 21:04 ` Zhu Yanjun
0 siblings, 1 reply; 27+ messages in thread
From: syzbot @ 2025-07-03 0:58 UTC (permalink / raw)
To: jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs, yanjun.zhu
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
Tested on:
commit: 6f8d023e RDMA/rxe: Fix rxe_skb_tx_dtor problem
git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
console output: https://syzkaller.appspot.com/x/log.txt?x=13973770580000
kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor
2025-07-03 0:58 ` syzbot
@ 2025-07-06 21:04 ` Zhu Yanjun
0 siblings, 0 replies; 27+ messages in thread
From: Zhu Yanjun @ 2025-07-06 21:04 UTC (permalink / raw)
To: syzbot, jgg, leon, linux-kernel, linux-rdma, syzkaller-bugs
在 2025/7/2 17:58, syzbot 写道:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Today I made tests with rdma-core after this patch is applied on the
linux upstream. All the test cases in rdma-core can pass successfully.
I will send this commit out based on the rdma next repository.
Zhu Yanjun
>
> Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
> Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 6f8d023e RDMA/rxe: Fix rxe_skb_tx_dtor problem
> git tree: https://github.com/zhuyj/linux.git v6.16_fix_rxe_skb_tx_dtor
> console output: https://syzkaller.appspot.com/x/log.txt?x=13973770580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=36b0e72cad5298f8
> dashboard link: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
>
> Note: no patches were applied.
> Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 27+ messages in thread
end of thread, other threads:[~2025-07-06 21:05 UTC | newest]
Thread overview: 27+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <f63acb1b-083f-4a48-8352-d07d48827330@linux.dev>
2025-06-27 18:43 ` [syzbot] [rdma?] WARNING in rxe_skb_tx_dtor syzbot
2025-06-27 19:35 ` Yanjun.Zhu
2025-06-27 19:50 ` syzbot
2025-06-27 20:26 ` Yanjun.Zhu
2025-06-27 20:46 ` syzbot
2025-06-27 23:10 ` Yanjun.Zhu
2025-06-27 23:32 ` syzbot
2025-06-27 23:42 ` Yanjun.Zhu
2025-07-03 0:36 ` Yanjun.Zhu
2025-07-03 0:58 ` syzbot
2025-07-06 21:04 ` Zhu Yanjun
2025-05-01 16:45 syzbot
2025-05-02 9:54 ` Zhu Yanjun
2025-05-13 14:57 ` Zhu Yanjun
2025-06-26 20:55 ` syzbot
2025-06-26 22:22 ` Yanjun.Zhu
2025-06-26 22:25 ` syzbot
2025-06-26 22:38 ` Yanjun.Zhu
2025-06-26 22:54 ` syzbot
2025-06-27 2:49 ` Zhu Yanjun
2025-06-27 3:11 ` syzbot
2025-06-27 3:41 ` Zhu Yanjun
2025-06-27 3:57 ` syzbot
2025-06-27 4:53 ` Zhu Yanjun
2025-06-27 5:09 ` syzbot
2025-06-26 22:52 ` Hillf Danton
2025-06-26 23:09 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).