From: "Jiayuan Chen" <jiayuan.chen@linux.dev>
To: "Eric Dumazet" <edumazet@google.com>
Cc: netdev@vger.kernel.org, razor@blackwall.org,
jiayuan.chen@shopee.com, "Jay Vosburgh" <jv@jvosburgh.net>,
"Andrew Lunn" <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Alexei Starovoitov" <ast@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
"John Fastabend" <john.fastabend@gmail.com>,
"Stanislav Fomichev" <sdf@fomichev.me>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Eduard Zingerman" <eddyz87@gmail.com>,
"Martin KaFai Lau" <martin.lau@linux.dev>,
"Song Liu" <song@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"KP Singh" <kpsingh@kernel.org>, "Hao Luo" <haoluo@google.com>,
"Jiri Olsa" <jolsa@kernel.org>, "Shuah Khan" <shuah@kernel.org>,
"Sebastian Andrzej Siewior" <bigeasy@linutronix.de>,
"Clark Williams" <clrkwllms@kernel.org>,
"Steven Rostedt" <rostedt@goodmis.org>,
"Jussi Maki" <joamaki@gmail.com>,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
linux-kselftest@vger.kernel.org, linux-rt-devel@lists.linux.dev
Subject: Re: [PATCH net v5 0/2] net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest
Date: Mon, 09 Mar 2026 09:41:20 +0000 [thread overview]
Message-ID: <903543b24e6e124ff970340e265185af176880f6@linux.dev> (raw)
In-Reply-To: <CANn89i+SCJmUuQo2pSVv_4YhjvXGvnGDH_HNo2XY6KxDX1Kcgg@mail.gmail.com>
March 9, 2026 at 15:46, "Eric Dumazet" <edumazet@google.com mailto:edumazet@google.com?to=%22Eric%20Dumazet%22%20%3Cedumazet%40google.com%3E > wrote:
>
> On Mon, Mar 9, 2026 at 4:07 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> >
> > syzkaller reported a kernel panic [1] with the following crash stack:
> >
> > Call Trace:
> > BUG: unable to handle page fault for address: ffff8ebd08580000
> > PF: supervisor write access in kernel mode
> > PF: error_code(0x0002) - not-present page
> > PGD 11f201067 P4D 11f201067 PUD 0
> > Oops: Oops: 0002 [#1] SMP PTI
> > CPU: 2 UID: 0 PID: 451 Comm: test_progs Not tainted 6.19.0+ #161 PREEMPT_RT
> > RIP: 0010:bond_rr_gen_slave_id+0x90/0xd0
> > RSP: 0018:ffffd3f4815f3448 EFLAGS: 00010246
> > RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffff8ebc8728b17e
> > RDX: 0000000000000000 RSI: ffffd3f4815f3538 RDI: ffff8ebc8abcce40
> > RBP: ffffd3f4815f3460 R08: 0000000000000000 R09: 0000000000000000
> > R10: 0000000000000000 R11: 0000000000000000 R12: ffffd3f4815f3538
> > R13: ffff8ebc8abcce40 R14: ffff8ebc8728b17f R15: ffff8ebc8728b170
> > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: ffff8ebd08580000 CR3: 000000010a808006 CR4: 0000000000770ef0
> > PKRU: 55555554
> > Call Trace:
> > <TASK>
> > bond_xdp_get_xmit_slave+0xc0/0x240
> > xdp_master_redirect+0x74/0xc0
> > bpf_prog_run_generic_xdp+0x2f2/0x3f0
> > do_xdp_generic+0x1fd/0x3d0
> > __netif_receive_skb_core.constprop.0+0x30d/0x1220
> > __netif_receive_skb_list_core+0xfc/0x250
> > netif_receive_skb_list_internal+0x20c/0x3d0
> > ? eth_type_trans+0x137/0x160
> > netif_receive_skb_list+0x25/0x140
> > xdp_test_run_batch.constprop.0+0x65b/0x6e0
> > bpf_test_run_xdp_live+0x1ec/0x3b0
> > bpf_prog_test_run_xdp+0x49d/0x6e0
> > __sys_bpf+0x446/0x27b0
> > __x64_sys_bpf+0x1a/0x30
> > x64_sys_call+0x146c/0x26e0
> > do_syscall_64+0xd3/0x1510
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> Please, can you always provide symbols in such traces ?
> You can use scripts/decode_stacktrace.sh to make the trace really
> nice, instead of ugly.
>
Hi Eric,
Thank you for the suggestion. I didn't include the fully decoded stack
trace in the cover letter because the syzkaller report already contains
the complete information. You can find it here if needed:
https://syzkaller.appspot.com/text?tag=CrashReport&x=15448952580000
https://syzkaller.appspot.com/bug?extid=80e046b8da2820b6ba73
next prev parent reply other threads:[~2026-03-09 9:41 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-09 3:06 [PATCH net v5 0/2] net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest Jiayuan Chen
2026-03-09 3:06 ` [PATCH net v5 1/2] bonding: fix null-ptr-deref in bond_rr_gen_slave_id() Jiayuan Chen
2026-03-10 11:49 ` Nikolay Aleksandrov
2026-03-10 12:00 ` Eric Dumazet
2026-03-10 12:07 ` Eric Dumazet
2026-03-10 12:39 ` Nikolay Aleksandrov
2026-03-12 10:36 ` Paolo Abeni
2026-03-12 11:02 ` Jiayuan Chen
2026-03-20 7:33 ` Jiayuan Chen
2026-03-12 11:06 ` Nikolay Aleksandrov
2026-03-09 3:06 ` [PATCH net v5 2/2] selftests/bpf: add test for xdp_master_redirect with bond not up Jiayuan Chen
2026-03-09 7:46 ` [PATCH net v5 0/2] net,bpf: fix null-ptr-deref in xdp_master_redirect() for bonding and add selftest Eric Dumazet
2026-03-09 9:41 ` Jiayuan Chen [this message]
2026-03-09 10:03 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=903543b24e6e124ff970340e265185af176880f6@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrew+netdev@lunn.ch \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bigeasy@linutronix.de \
--cc=bpf@vger.kernel.org \
--cc=clrkwllms@kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=edumazet@google.com \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=jiayuan.chen@shopee.com \
--cc=joamaki@gmail.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=jv@jvosburgh.net \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-rt-devel@lists.linux.dev \
--cc=martin.lau@linux.dev \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=razor@blackwall.org \
--cc=rostedt@goodmis.org \
--cc=sdf@fomichev.me \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox