syzbot

 sign-in | mailing list | source | docs
🐞 Open [72] 🐞 Fixed [70] 🐞 Invalid [133] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: stack guard page was hit in sys_open (5)

Status: fixed on 2022/05/12 07:47
Reported-by: syzbot+4aafa9ecf770ac906f0a@syzkaller.appspotmail.com
Fix commit: 3e45af8a72c0 ANDROID: incremental-fs: limit mount stack depth
First crash: 727d, last: 722d
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: stack guard page was hit in sys_open (3) C error 2 741d 741d 0/2 closed as dup on 2022/04/11 14:20
android-5-10 BUG: stack guard page was hit in sys_open (4) C 2 735d 735d 0/2 closed as dup on 2022/04/15 19:26
android-5-10 BUG: stack guard page was hit in sys_open C error 3 763d 763d 0/2 closed as dup on 2022/03/18 15:53
android-5-10 BUG: stack guard page was hit in sys_open (2) C error 2 742d 742d 0/2 closed as dup on 2022/04/08 14:36

Sample crash report:
BUG: stack guard page was hit at ffffc9000a787ff8 (stack is ffffc9000a788000..ffffc9000a78ffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7813 Comm: syz-executor.3 Not tainted 5.10.111-syzkaller-00181-g904c5c08bb41 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> 94 27 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc9000a788000 EFLAGS: 00010246
RAX: ffff888152993b40 RBX: 1ffff920014f101e RCX: ffffc9000a788090
RDX: 0000000000000000 RSI: ffff888152993b40 RDI: ffffc9000a788000
RBP: ffffc9000a788090 R08: dffffc0000000000 R09: ffffc9000a788190
R10: 0000000000000002 R11: 0000000000000000 R12: ffff888152993b40
R13: ffffffff815b4cf0 R14: ffffc9000a7880e0 R15: 0000000000000000
FS:  00007fa6f58e5700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000a787ff8 CR3: 0000000116df0000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 stack_trace_save+0x12d/0x1f0 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 __kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
 kasan_slab_alloc include/linux/kasan.h:259 [inline]
 slab_post_alloc_hook mm/slab.h:583 [inline]
 slab_alloc_node mm/slub.c:2956 [inline]
 slab_alloc mm/slub.c:2964 [inline]
 kmem_cache_alloc+0x16c/0x300 mm/slub.c:2969
 __d_alloc+0x2d/0x6b0 fs/dcache.c:1709
 d_alloc fs/dcache.c:1788 [inline]
 d_alloc_parallel+0xe6/0x1330 fs/dcache.c:2540
 __lookup_slow+0x14e/0x400 fs/namei.c:1613
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 __lookup_slow+0x2b3/0x400 fs/namei.c:1628
 lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
 incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
 dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
 lookup_open fs/namei.c:3162 [inline]
 open_last_lookups fs/namei.c:3253 [inline]
 path_openat+0x119a/0x2fd0 fs/namei.c:3441
 do_filp_open+0x200/0x440 fs/namei.c:3471
 do_sys_openat2+0x13b/0x470 fs/open.c:1211
 do_sys_open fs/open.c:1227 [inline]
 __do_sys_open fs/open.c:1235 [inline]
 __se_sys_open fs/open.c:1231 [inline]
 __x64_sys_open+0x221/0x270 fs/open.c:1231
 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fa6f676f0e9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa6f58e5168 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 00007fa6f6881f60 RCX: 00007fa6f676f0e9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140
RBP: 00007fa6f67c908d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff63a81c0f R14: 00007fa6f58e5300 R15: 0000000000022000
Modules linked in:
---[ end trace 11dfb0e2cef19be1 ]---
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> 94 27 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc9000a788000 EFLAGS: 00010246
RAX: ffff888152993b40 RBX: 1ffff920014f101e RCX: ffffc9000a788090
RDX: 0000000000000000 RSI: ffff888152993b40 RDI: ffffc9000a788000
RBP: ffffc9000a788090 R08: dffffc0000000000 R09: ffffc9000a788190
R10: 0000000000000002 R11: 0000000000000000 R12: ffff888152993b40
R13: ffffffff815b4cf0 R14: ffffc9000a7880e0 R15: 0000000000000000
FS:  00007fa6f58e5700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc9000a787ff8 CR3: 0000000116df0000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	eb 1b                	jmp    0x1d
   2:	65 48 8b 04 25 80 6d 	mov    %gs:0x26d80,%rax
   9:	02 00
   b:	4c 39 e0             	cmp    %r12,%rax
   e:	74 0a                	je     0x1a
  10:	49 8b 8c 24 98 0e 00 	mov    0xe98(%r12),%rcx
  17:	00
  18:	eb 03                	jmp    0x1d
  1a:	48 89 e9             	mov    %rbp,%rcx
  1d:	48 8d bd 70 ff ff ff 	lea    -0x90(%rbp),%rdi
  24:	4c 89 e6             	mov    %r12,%rsi
  27:	4c 89 fa             	mov    %r15,%rdx
* 2a:	e8 94 27 06 00       	callq  0x627c3 <-- trapping instruction
  2f:	83 bd 70 ff ff ff 00 	cmpl   $0x0,-0x90(%rbp)
  36:	74 36                	je     0x6e
  38:	48 8d 9d 70 ff ff ff 	lea    -0x90(%rbp),%rbx
  3f:	0f                   	.byte 0xf

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/04/28 23:34 android12-5.10-lts 904c5c08bb41 e9076525 .config console log report info ci2-android-5-10 BUG: stack guard page was hit in sys_open
2022/04/27 11:17 android12-5.10-lts e08dd85cc95e 1fa34c1b .config console log report info ci2-android-5-10 BUG: stack guard page was hit in sys_open
2022/04/25 05:53 android12-5.10-lts e08dd85cc95e 131df97d .config console log report info ci2-android-5-10 BUG: stack guard page was hit in sys_open
2022/04/23 14:41 android12-5.10-lts e08dd85cc95e 131df97d .config console log report info ci2-android-5-10 BUG: stack guard page was hit in sys_open
* Struck through repros no longer work on HEAD.