syzbot


kernel panic: stack is corrupted in __schedule

Status: upstream: reported C repro on 2025/06/18 02:33
Reported-by: syzbot+8d8828a8f74bc9420fd9@syzkaller.appspotmail.com
First crash: 72d, last: 2d19h
Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel panic: stack is corrupted in __schedule (3) kernel 2 2 1100d 1109d 0/29 auto-obsoleted due to no activity on 2022/11/23 03:17
linux-6.1 kernel panic: stack is corrupted in __schedule 2 1 466d 466d 0/3 auto-obsoleted due to no activity on 2024/08/27 17:04
linux-6.1 kernel panic: stack is corrupted in __schedule (2) 2 4 227d 314d 0/3 auto-obsoleted due to no activity on 2025/04/24 00:04
upstream kernel panic: stack is corrupted in __schedule kernel 2 1 1831d 1827d 0/29 auto-closed as invalid on 2020/11/21 13:35
linux-6.1 kernel panic: stack is corrupted in __schedule (3) origin:upstream missing-backport 2 C 5 4d09h 109d 0/3 upstream: reported C repro on 2025/05/11 08:28
upstream kernel panic: stack is corrupted in __schedule (2) kernel 2 1 1370d 1366d 0/29 auto-closed as invalid on 2022/01/26 17:30
upstream kernel panic: stack is corrupted in __schedule (4) ntfs3 2 syz 56 29d 373d 0/29 upstream: reported syz repro on 2024/08/20 16:14

Sample crash report:
loop3: detected capacity change from 0 to 4096
ntfs3: loop3: Different NTFS sector size (1024) and media sector size (512).
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __schedule+0x1808/0x44d0 kernel/sched/core.c:-1
CPU: 1 PID: 6586 Comm: syz.3.572 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 panic+0x2c0/0x710 kernel/panic.c:340
 __stack_chk_fail+0x25/0x30 kernel/panic.c:771
 __schedule+0x1808/0x44d0 kernel/sched/core.c:-1
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:filemap_read_folio+0x1c5/0x760 mm/filemap.c:2434
Code: 00 00 00 65 48 8b 04 25 28 00 00 00 48 3b 84 24 80 00 00 00 0f 85 c3 01 00 00 44 89 e0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f <5d> c3 48 b8 00 00 00 00 00 fc ff df 41 80 3c 06 00 74 08 4c 89 ff
RSP: 0000:ffffc90004e07908 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000100cca RCX: 1ffff920009c0f10
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000
RBP: ffffc90004e07908 R08: ffffea0001622087 R09: 1ffffd40002c4410
R10: dffffc0000000000 R11: fffff940002c4411 R12: ffff88806be7a958
R13: ffff88806be7a958 R14: 0000000000000000 R15: dffffc0000000000
 do_read_cache_folio+0x470/0x7e0 mm/filemap.c:3789
 do_read_cache_page+0x32/0x250 mm/filemap.c:3855
 read_mapping_page include/linux/pagemap.h:892 [inline]
 ntfs_map_page+0x1d/0x60 fs/ntfs/aops.h:75
 ntfs_fill_super+0x3415/0x42e0 fs/ntfs3/super.c:1434
 get_tree_bdev+0x3e4/0x510 fs/super.c:1591
 vfs_get_tree+0x8c/0x280 fs/super.c:1764
 do_new_mount+0x24b/0xa40 fs/namespace.c:3371
 do_mount fs/namespace.c:3711 [inline]
 __do_sys_mount fs/namespace.c:3920 [inline]
 __se_sys_mount+0x2da/0x3c0 fs/namespace.c:3897
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fae95f9038a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff9abb5fb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff9abb6040 RCX: 00007fae95f9038a
RDX: 00002000000002c0 RSI: 0000200000000040 RDI: 00007fff9abb6000
RBP: 00002000000002c0 R08: 00007fff9abb6040 R09: 0000000000000082
R10: 0000000000000082 R11: 0000000000000246 R12: 0000200000000040
R13: 00007fff9abb6000 R14: 000000000001f84f R15: 00002000000000c0
 </TASK>
Kernel Offset: disabled
Rebooting in 86400 seconds..
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 65 48             	add    %ah,0x48(%rbp)
   5:	8b 04 25 28 00 00 00 	mov    0x28,%eax
   c:	48 3b 84 24 80 00 00 	cmp    0x80(%rsp),%rax
  13:	00
  14:	0f 85 c3 01 00 00    	jne    0x1dd
  1a:	44 89 e0             	mov    %r12d,%eax
  1d:	48 8d 65 d8          	lea    -0x28(%rbp),%rsp
  21:	5b                   	pop    %rbx
  22:	41 5c                	pop    %r12
  24:	41 5d                	pop    %r13
  26:	41 5e                	pop    %r14
  28:	41 5f                	pop    %r15
* 2a:	5d                   	pop    %rbp <-- trapping instruction
  2b:	c3                   	ret
  2c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  33:	fc ff df
  36:	41 80 3c 06 00       	cmpb   $0x0,(%r14,%rax,1)
  3b:	74 08                	je     0x45
  3d:	4c 89 ff             	mov    %r15,%rdi

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/26 08:51 linux-6.6.y bb9c90ab9c5a bf27483f .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-6-kasan kernel panic: stack is corrupted in __schedule
2025/06/18 02:32 linux-6.6.y c2603c511feb e77fae15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan kernel panic: stack is corrupted in __schedule
* Struck through repros no longer work on HEAD.