From: Kuniyuki Iwashima <kuniyu@google.com>
To: jiayuan.chen@linux.dev
Cc: davem@davemloft.net, dsahern@kernel.org, edumazet@google.com,
horms@kernel.org, jakub@cloudflare.com,
john.fastabend@gmail.com, kuba@kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
pabeni@redhat.com,
syzbot+5b3b7e51dda1be027b7a@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in inet_sock_destruct (6)
Date: Sun, 15 Feb 2026 20:16:28 +0000 [thread overview]
Message-ID: <20260215201653.3545146-1-kuniyu@google.com> (raw)
In-Reply-To: <pacq5eqmgrceli6anhy2fiz3zhen4ox3hir7z6tcdnc4ghca5d@yr7zb5lauovb>
From: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: Sat, 14 Feb 2026 13:46:38 +0800
> On Fri, Feb 13, 2026 at 12:08:38PM +0800, syzbot wrote:
>
> I identified this issue and submitted a fix before this syzbot report:
> https://lore.kernel.org/bpf/20250508062423.51978-1-jiayuan.chen@linux.dev/
> Unfortunately the patch was not accepted at the time.
The fix is not sufficient since sk->sk_forward_alloc is
still modified locklessly.
I'm releasing other related reports and going to send fix
shortly.
>
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit: 192c0159402e Merge tag 'powerpc-7.0-1' of git://git.kernel..
> > git tree: upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=17b8cc02580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=22c34f040954bbd1
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5b3b7e51dda1be027b7a
> > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1316a15a580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14140ffa580000
> >
> > Downloadable assets:
> > disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-192c0159.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/d1c911c7a5b8/vmlinux-192c0159.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/f9d4cfbb614a/bzImage-192c0159.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+5b3b7e51dda1be027b7a@syzkaller.appspotmail.com
> >
> > ------------[ cut here ]------------
> > sk->sk_forward_alloc
> > WARNING: net/ipv4/af_inet.c:157 at inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:157, CPU#0: ksoftirqd/0/15
> > Modules linked in:
> > CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0 PREEMPT(full)
> > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> > RIP: 0010:inet_sock_destruct+0x653/0x800 net/ipv4/af_inet.c:157
> > Code: b4 4f ff e9 06 fd ff ff e8 aa 25 10 f8 90 0f 0b 90 e9 35 fe ff ff e8 9c 25 10 f8 90 0f 0b 90 e9 c5 fe ff ff e8 8e 25 10 f8 90 <0f> 0b 90 e9 04 ff ff ff e8 80 25 10 f8 90 0f 0b 90 e9 65 fe ff ff
> > RSP: 0018:ffffc90000127bb0 EFLAGS: 00010246
> > RAX: 0000000000000000 RBX: ffff888100796300 RCX: ffffffff89f71e97
> > RDX: ffff88801dec4900 RSI: ffffffff89f71f92 RDI: ffff88801dec4900
> > RBP: 0000000000000090 R08: 0000000000000005 R09: 0000000000000000
> > R10: 0000000000000090 R11: 00000000000075f9 R12: ffff888100796300
> > R13: ffff888100796390 R14: ffffffff81ed1d7d R15: 0000000000000004
> > FS: 0000000000000000(0000) GS:ffff8880d65b3000(0000) knlGS:0000000000000000
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 00007ffe39b75ff4 CR3: 000000000e396000 CR4: 0000000000352ef0
> > Call Trace:
> > <TASK>
> > __sk_destruct+0x85/0xbb0 net/core/sock.c:2350
> > rcu_do_batch kernel/rcu/tree.c:2617 [inline]
> > rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
> > handle_softirqs+0x1ea/0x910 kernel/softirq.c:622
> > run_ksoftirqd kernel/softirq.c:1063 [inline]
> > run_ksoftirqd+0x38/0x60 kernel/softirq.c:1055
> > smpboot_thread_fn+0x3d3/0xaa0 kernel/smpboot.c:160
> > kthread+0x370/0x450 kernel/kthread.c:467
> > ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
> > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> > </TASK>
> >
prev parent reply other threads:[~2026-02-15 20:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-13 20:08 [syzbot] [net?] WARNING in inet_sock_destruct (6) syzbot
2026-02-14 5:46 ` Jiayuan Chen
2026-02-15 20:16 ` Kuniyuki Iwashima [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260215201653.3545146-1-kuniyu@google.com \
--to=kuniyu@google.com \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jakub@cloudflare.com \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+5b3b7e51dda1be027b7a@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox