syzbot


kernel panic: corrupted stack end in tc_ctl_action

Status: fixed on 2023/02/24 13:50
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+aa5168afff9d42f601e7@syzkaller.appspotmail.com
Fix commit: b81d591386c3 riscv: Increase stack size under KASAN
First crash: 839d, last: 781d

Sample crash report:
netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'.
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 3876 Comm: syz-executor.0 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff83175742>] dump_stack+0x1c/0x24 lib/dump_stack.c:113
[<ffffffff83166fa8>] panic+0x24a/0x634 kernel/panic.c:233
[<ffffffff831a688a>] schedule_debug kernel/sched/core.c:5541 [inline]
[<ffffffff831a688a>] schedule+0x0/0x14c kernel/sched/core.c:6187
[<ffffffff831a6b00>] preempt_schedule_common+0x4e/0xde kernel/sched/core.c:6462
[<ffffffff831a6bc4>] preempt_schedule+0x34/0x36 kernel/sched/core.c:6487
[<ffffffff80121892>] vprintk_emit+0x126/0x416 kernel/printk/printk.c:2246
[<ffffffff80121ba4>] vprintk_default+0x22/0x2e kernel/printk/printk.c:2256
[<ffffffff8012254a>] vprintk+0x108/0x13e kernel/printk/printk_safe.c:50
[<ffffffff83169c5c>] _printk+0xa0/0xc8 kernel/printk/printk.c:2266
[<ffffffff80be7926>] __nla_validate_parse+0x165a/0x165e lib/nlattr.c:600
[<ffffffff80be79ba>] __nla_parse+0x40/0x56 lib/nlattr.c:685
[<ffffffff8286ab3e>] nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
[<ffffffff8286ab3e>] tc_action_load_ops+0xd4/0x2f8 net/sched/act_api.c:1274
[<ffffffff8286b3f0>] tcf_action_init+0x1f4/0x58a net/sched/act_api.c:1414
[<ffffffff8286da56>] tcf_action_add+0x126/0x36c net/sched/act_api.c:1947
[<ffffffff8286df1a>] tc_ctl_action+0x27e/0x2f0 net/sched/act_api.c:2006
[<ffffffff8276b46c>] rtnetlink_rcv_msg+0x338/0x9a0 net/core/rtnetlink.c:5592
[<ffffffff8296ded2>] netlink_rcv_skb+0xf8/0x2be net/netlink/af_netlink.c:2494
[<ffffffff827624f4>] rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:5610
[<ffffffff8296cbcc>] netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
[<ffffffff8296cbcc>] netlink_unicast+0x40e/0x5fe net/netlink/af_netlink.c:1343
[<ffffffff8296d29c>] netlink_sendmsg+0x4e0/0x994 net/netlink/af_netlink.c:1919
[<ffffffff826d264e>] sock_sendmsg_nosec net/socket.c:705 [inline]
[<ffffffff826d264e>] sock_sendmsg+0xa0/0xc4 net/socket.c:725
[<ffffffff826d4dd4>] ____sys_sendmsg+0x46e/0x484 net/socket.c:2413
[<ffffffff826d8bca>] ___sys_sendmsg+0x16c/0x1f6 net/socket.c:2467
[<ffffffff826d8e78>] __sys_sendmsg+0xba/0x150 net/socket.c:2496
[<ffffffff826d8f3a>] __do_sys_sendmsg net/socket.c:2505 [inline]
[<ffffffff826d8f3a>] sys_sendmsg+0x2c/0x3a net/socket.c:2503
[<ffffffff80005716>] ret_from_syscall+0x0/0x2
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/10/15 18:41 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d 67cb024c .config console log report info ci-qemu2-riscv64 kernel panic: corrupted stack end in tc_ctl_action
2022/08/18 11:02 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d d58e263f .config console log report info ci-qemu2-riscv64 kernel panic: corrupted stack end in tc_ctl_action
* Struck through repros no longer work on HEAD.