syzbot ci has tested the following series [v6] tun/tap & vhost-net: netdev queue flow control to avoid ptr_ring tail drop https://lore.kernel.org/all/[email protected] * [PATCH net-next v6 1/8] ptr_ring: add __ptr_ring_full_next() to predict imminent fullness * [PATCH net-next v6 2/8] ptr_ring: add helper to check if consume created space * [PATCH net-next v6 3/8] tun/tap: add synchronized ring produce/consume with queue management * [PATCH net-next v6 4/8] tun/tap: add batched ring consume function * [PATCH net-next v6 5/8] tun/tap: add uncomsume function for returning entries to ring * [PATCH net-next v6 6/8] tun/tap: add helper functions to check file type * [PATCH net-next v6 7/8] tun/tap/vhost: use {tun|tap}_ring_{consume|produce} to avoid tail drops * [PATCH net-next v6 8/8] tun/tap: drop get ring exports
and found the following issue: general protection fault in tun_net_xmit Full report is available here: https://ci.syzbot.org/series/63c35694-3fa6-48b6-ba11-f893f55bcc1a *** general protection fault in tun_net_xmit tree: net-next URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git base: 45a1cd8346ca245a1ca475b26eb6ceb9d8b7c6f0 arch: amd64 compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8 config: https://ci.syzbot.org/builds/e1084fb4-2e0a-4c87-8e42-bc8fa70e1c77/config syz repro: https://ci.syzbot.org/findings/cf1c9121-7e31-4bc8-a254-f9e6c8ee2d26/syz_repro Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:__ptr_ring_full include/linux/ptr_ring.h:51 [inline] RIP: 0010:tun_ring_produce drivers/net/tun.c:1023 [inline] RIP: 0010:tun_net_xmit+0xdf0/0x1840 drivers/net/tun.c:1164 Code: 00 00 00 fc ff df 48 89 44 24 50 0f b6 04 18 84 c0 0f 85 1f 07 00 00 4c 89 7c 24 30 4d 63 37 4f 8d 3c f4 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 92 ba e3 fb 49 83 3f 00 74 0a e8 17 RSP: 0018:ffffc90000126f80 EFLAGS: 00010202 RAX: 0000000000000002 RBX: dffffc0000000000 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000126f00 RBP: ffffc900001270b0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000024de0 R12: 0000000000000010 R13: ffff8881730b6a48 R14: 0000000000000000 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff8882a9f38000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002280 CR3: 00000001bb189000 CR4: 0000000000352ef0 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:5259 [inline] netdev_start_xmit include/linux/netdevice.h:5268 [inline] xmit_one net/core/dev.c:3853 [inline] dev_hard_start_xmit+0x2d7/0x830 net/core/dev.c:3869 __dev_queue_xmit+0x172a/0x3740 net/core/dev.c:4811 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK include/linux/netfilter.h:318 [inline] ndisc_send_skb+0xbce/0x1510 net/ipv6/ndisc.c:512 addrconf_dad_completed+0x7ae/0xd60 net/ipv6/addrconf.c:4360 addrconf_dad_work+0xc36/0x14b0 net/ipv6/addrconf.c:-1 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__ptr_ring_full include/linux/ptr_ring.h:51 [inline] RIP: 0010:tun_ring_produce drivers/net/tun.c:1023 [inline] RIP: 0010:tun_net_xmit+0xdf0/0x1840 drivers/net/tun.c:1164 Code: 00 00 00 fc ff df 48 89 44 24 50 0f b6 04 18 84 c0 0f 85 1f 07 00 00 4c 89 7c 24 30 4d 63 37 4f 8d 3c f4 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ff e8 92 ba e3 fb 49 83 3f 00 74 0a e8 17 RSP: 0018:ffffc90000126f80 EFLAGS: 00010202 RAX: 0000000000000002 RBX: dffffc0000000000 RCX: dffffc0000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000126f00 RBP: ffffc900001270b0 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff52000024de0 R12: 0000000000000010 R13: ffff8881730b6a48 R14: 0000000000000000 R15: 0000000000000010 FS: 0000000000000000(0000) GS:ffff8882a9f38000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000002280 CR3: 00000001bb189000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess), 5 bytes skipped: 0: df 48 89 fisttps -0x77(%rax) 3: 44 24 50 rex.R and $0x50,%al 6: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax a: 84 c0 test %al,%al c: 0f 85 1f 07 00 00 jne 0x731 12: 4c 89 7c 24 30 mov %r15,0x30(%rsp) 17: 4d 63 37 movslq (%r15),%r14 1a: 4f 8d 3c f4 lea (%r12,%r14,8),%r15 1e: 4c 89 f8 mov %r15,%rax 21: 48 c1 e8 03 shr $0x3,%rax * 25: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 29: 74 08 je 0x33 2b: 4c 89 ff mov %r15,%rdi 2e: e8 92 ba e3 fb call 0xfbe3bac5 33: 49 83 3f 00 cmpq $0x0,(%r15) 37: 74 0a je 0x43 39: e8 .byte 0xe8 3a: 17 (bad) *** If these findings have caused you to resend the series or submit a separate fix, please add the following tag to your commit message: Tested-by: [email protected] --- This report is generated by a bot. It may contain errors. syzbot ci engineers can be reached at [email protected].
