syzbot


BUG: stack guard page was hit in loop_process_work

Status: moderation: reported on 2025/01/11 13:25
Subsystems: v9fs
[Documentation on labels]
Reported-by: syzbot+a4c1f408796b22593a2e@syzkaller.appspotmail.com
First crash: 7d19h, last: 7d19h

Sample crash report:
BUG: TASK stack guard page was hit at ffffc900001cfff8 (stack is ffffc900001d0000..ffffc900001d8000)
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 11 Comm: kworker/u32:0 Not tainted 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: loop8 loop_workfn
RIP: 0010:get_next_lpos+0x12/0xd0 kernel/printk/printk_ringbuffer.c:1013
Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 41 55 49 89 f5 41 54 55 48 89 fd 53 89 d3 <e8> 89 6b 1f 00 4e 8d 34 2b 48 89 ea 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900001d0000 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000058 RCX: ffffffff8179f88c
RDX: 0000000000000058 RSI: 0000000000015d28 RDI: ffffffff8dcc8250
RBP: ffffffff8dcc8250 R08: 0000000000000000 R09: fffffbfff1b9904c
R10: ffffffff8dcc8267 R11: 0000000000000003 R12: ffffffff8dd95d88
R13: 0000000000015d28 R14: ffffffff8dcc8250 R15: 00000000000013c8
FS:  0000000000000000(0000) GS:ffff88802b400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900001cfff8 CR3: 000000004b7c2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <#DF>
 </#DF>
 <TASK>
 data_alloc+0x10f/0x4a0 kernel/printk/printk_ringbuffer.c:1052
 prb_reserve+0xa8b/0xf00 kernel/printk/printk_ringbuffer.c:1669
 vprintk_store+0x4ca/0xc30 kernel/printk/printk.c:2326
 vprintk_emit+0x160/0x6f0 kernel/printk/printk.c:2408
 vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:86
 _printk+0xc8/0x100 kernel/printk/printk.c:2457
 panic+0x255/0x800 kernel/panic.c:348
 schedule_debug kernel/sched/core.c:5940 [inline]
 __schedule+0x5148/0x5ad0 kernel/sched/core.c:6655
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6848
 p9_virtio_zc_request+0xfe3/0x1460 net/9p/trans_virtio.c:534
 p9_client_zc_rpc.constprop.0+0x29a/0x880 net/9p/client.c:808
 p9_client_read_once+0x443/0x820 net/9p/client.c:1570
 p9_client_read+0x13f/0x1b0 net/9p/client.c:1534
 v9fs_issue_read+0x115/0x340 fs/9p/vfs_addr.c:76
 netfs_retry_read_subrequests fs/netfs/read_retry.c:62 [inline]
 netfs_retry_reads+0x1508/0x1d40 fs/netfs/read_retry.c:234
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_retry_reads+0x159a/0x1d40 fs/netfs/read_retry.c:237
 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374
 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409
 netfs_dispatch_unbuffered_reads fs/netfs/direct_read.c:103 [inline]
 netfs_unbuffered_read fs/netfs/direct_read.c:127 [inline]
 netfs_unbuffered_read_iter_locked+0x12e1/0x19a0 fs/netfs/direct_read.c:221
 netfs_unbuffered_read_iter+0xc5/0x100 fs/netfs/direct_read.c:256
 v9fs_file_read_iter+0xbf/0x100 fs/9p/vfs_file.c:361
 lo_rw_aio.isra.0+0x90a/0xcc0 drivers/block/loop.c:470
 do_req_filebacked drivers/block/loop.c:514 [inline]
 loop_handle_cmd drivers/block/loop.c:1909 [inline]
 loop_process_work+0xa65/0x2000 drivers/block/loop.c:1944
 process_one_work+0x958/0x1b30 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:get_next_lpos+0x12/0xd0 kernel/printk/printk_ringbuffer.c:1013
Code: 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 41 55 49 89 f5 41 54 55 48 89 fd 53 89 d3 <e8> 89 6b 1f 00 4e 8d 34 2b 48 89 ea 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc900001d0000 EFLAGS: 00010093
RAX: 0000000000000000 RBX: 0000000000000058 RCX: ffffffff8179f88c
RDX: 0000000000000058 RSI: 0000000000015d28 RDI: ffffffff8dcc8250
RBP: ffffffff8dcc8250 R08: 0000000000000000 R09: fffffbfff1b9904c
R10: ffffffff8dcc8267 R11: 0000000000000003 R12: ffffffff8dd95d88
R13: 0000000000015d28 R14: ffffffff8dcc8250 R15: 00000000000013c8
FS:  0000000000000000(0000) GS:ffff88802b400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900001cfff8 CR3: 000000004b7c2000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	84 00                	test   %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	00 00                	add    %al,(%rax)
   6:	66 90                	xchg   %ax,%ax
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	41 57                	push   %r15
  1a:	41 56                	push   %r14
  1c:	41 55                	push   %r13
  1e:	49 89 f5             	mov    %rsi,%r13
  21:	41 54                	push   %r12
  23:	55                   	push   %rbp
  24:	48 89 fd             	mov    %rdi,%rbp
  27:	53                   	push   %rbx
  28:	89 d3                	mov    %edx,%ebx
* 2a:	e8 89 6b 1f 00       	call   0x1f6bb8 <-- trapping instruction
  2f:	4e 8d 34 2b          	lea    (%rbx,%r13,1),%r14
  33:	48 89 ea             	mov    %rbp,%rdx
  36:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  3d:	fc ff df

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/07 13:20 upstream fbfd64d25c7a f3558dbf .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: stack guard page was hit in loop_process_work
* Struck through repros no longer work on HEAD.