Re: BUG: corrupted list in nsim_fib6_rt_destroy

[Eric Dumazet]

On Tue, Feb 11, 2025 at 1:04 PM YAN KANG <kangyan91@xxxxxxxxxxx> wrote:
>
> Dear maintainers,
>
> I found a kernel  bug titiled "BUG: corrupted list in nsim_fib6_rt_destroy " while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc7) .
>
>
> After preliminary analysis, the bug is triggerd in  nsim_fib6_rt_destroy function  drivers/net/netdevsim/fib.c
> when kernel try to delete node from list :  list_del(&fib_rt->list);
> the node has already unlink from the list.

This analysis seems to be AI generated, this is literally rephrasing
the call stack.

>
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: yan kang <kangyan91@xxxxxxxxxxx>
> Reported-by: yue sun <samsun1006219@xxxxxxxxx
>
>
> I hope it helps.
> Best regards
> yan kang
>
> Kernel crash log  and reproducer are listed below.
>
> ==================================================================
> Syzkaller hit 'BUG: corrupted list in nsim_fib6_rt_destroy' bug.
>
> netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
> list_del corruption. prev->next should be ffff888112b16f28, but was 0000000000000000. (prev=ffff8881083184a8)
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:62!
> Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
> CPU: 0 UID: 0 PID: 9911 Comm: kworker/u8:4 Not tainted 6.13.0-rc1 #5

This is not 6.13.0-rc7