syzbot


kernel panic: corrupted stack end in hub_event (2)

Status: upstream: reported on 2024/02/07 12:41
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+bb6c69482c4c8c2f79ad@syzkaller.appspotmail.com
First crash: 73d, last: 65d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] kernel panic: corrupted stack end in hub_event (2) 0 (1) 2024/02/07 12:41
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel panic: corrupted stack end in hub_event kernfs 93 425d 770d 22/26 fixed on 2023/02/24 13:50

Sample crash report:
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 1 PID: 3647 Comm: kworker/1:4 Not tainted 6.8.0-rc1-syzkaller-00008-g3951f6add519 #0
Hardware name: riscv-virtio,qemu (DT)
Workqueue: usb_hub_wq hub_event
Call Trace:
[<ffffffff80010868>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:121
[<ffffffff858aa2a8>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:127
[<ffffffff859055e4>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff859055e4>] dump_stack_lvl+0xe8/0x154 lib/dump_stack.c:106
[<ffffffff8590566c>] dump_stack+0x1c/0x24 lib/dump_stack.c:113
[<ffffffff858aacfa>] panic+0x33c/0x77a kernel/panic.c:344
[<ffffffff85913330>] schedule_debug kernel/sched/core.c:5954 [inline]
[<ffffffff85913330>] __schedule+0x313e/0x3196 kernel/sched/core.c:6620
[<ffffffff8591419c>] preempt_schedule_irq+0x7c/0x18e kernel/sched/core.c:7047
[<ffffffff85908a42>] raw_irqentry_exit_cond_resched kernel/entry/common.c:305 [inline]
[<ffffffff85908a42>] raw_irqentry_exit_cond_resched kernel/entry/common.c:297 [inline]
[<ffffffff85908a42>] irqentry_exit+0x138/0x17a kernel/entry/common.c:348
[<ffffffff85907804>] do_irq+0x34/0x4c arch/riscv/kernel/traps.c:375
[<ffffffff85928d60>] ret_from_exception+0x0/0x64 arch/riscv/kernel/entry.S:112
[<ffffffff803d08ac>] __sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:432
[<ffffffff843c885e>] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:773 [inline]
[<ffffffff843c885e>] snd_seq_deliver_event+0x186/0x4a0 sound/core/seq/seq_clientmgr.c:816
[<ffffffff843c8cd6>] snd_seq_kernel_client_dispatch+0x15e/0x184 sound/core/seq/seq_clientmgr.c:2496
[<ffffffff843d68d0>] snd_seq_system_broadcast+0xfc/0x144 sound/core/seq/seq_system.c:86
[<ffffffff843c11b6>] snd_seq_ioctl_create_port+0x386/0x840 sound/core/seq/seq_clientmgr.c:1348
[<ffffffff843c424e>] snd_seq_kernel_client_ctl+0x10a/0x1a4 sound/core/seq/seq_clientmgr.c:2526
[<ffffffff843f00d4>] snd_seq_midisynth_probe+0x62a/0x13f2 sound/core/seq/seq_midi.c:389
[<ffffffff8254d476>] call_driver_probe drivers/base/dd.c:579 [inline]
[<ffffffff8254d476>] really_probe+0x234/0xbbc drivers/base/dd.c:658
[<ffffffff8254dfd2>] __driver_probe_device+0x1d4/0x458 drivers/base/dd.c:800
[<ffffffff8254e2b6>] driver_probe_device+0x60/0x1ce drivers/base/dd.c:830
[<ffffffff8254e608>] __device_attach_driver+0x1e4/0x2fe drivers/base/dd.c:958
[<ffffffff82547caa>] bus_for_each_drv+0x142/0x1da drivers/base/bus.c:457
[<ffffffff8254f22a>] __device_attach+0x1c4/0x462 drivers/base/dd.c:1030
[<ffffffff8254f850>] device_initial_probe+0x1c/0x26 drivers/base/dd.c:1079
[<ffffffff8254a72c>] bus_probe_device+0x15c/0x192 drivers/base/bus.c:532
[<ffffffff825432b4>] device_add+0x112c/0x186e drivers/base/core.c:3625
[<ffffffff8438b638>] snd_seq_device_dev_register+0x3e/0xea sound/core/seq_device.c:170
[<ffffffff84330094>] __snd_device_register sound/core/device.c:149 [inline]
[<ffffffff84330094>] snd_device_register+0x12e/0x1b6 sound/core/device.c:179
[<ffffffff8438dc4c>] snd_rawmidi_dev_register+0x7a6/0xf68 sound/core/rawmidi.c:2096
[<ffffffff84330d42>] __snd_device_register sound/core/device.c:149 [inline]
[<ffffffff84330d42>] snd_device_register_all+0xee/0x15c sound/core/device.c:197
[<ffffffff8431ea38>] snd_card_register+0x11c/0x6ee sound/core/init.c:897
[<ffffffff844e1ccc>] try_to_register_card+0x1c0/0x316 sound/usb/card.c:754
[<ffffffff844e2d7e>] usb_audio_probe+0xa00/0x3024 sound/usb/card.c:896
[<ffffffff830a2008>] usb_probe_interface+0x2d4/0x8a2 drivers/usb/core/driver.c:399
[<ffffffff8254d476>] call_driver_probe drivers/base/dd.c:579 [inline]
[<ffffffff8254d476>] really_probe+0x234/0xbbc drivers/base/dd.c:658
[<ffffffff8254dfd2>] __driver_probe_device+0x1d4/0x458 drivers/base/dd.c:800
[<ffffffff8254e2b6>] driver_probe_device+0x60/0x1ce drivers/base/dd.c:830
[<ffffffff8254e608>] __device_attach_driver+0x1e4/0x2fe drivers/base/dd.c:958
[<ffffffff82547caa>] bus_for_each_drv+0x142/0x1da drivers/base/bus.c:457
[<ffffffff8254f22a>] __device_attach+0x1c4/0x462 drivers/base/dd.c:1030
[<ffffffff8254f850>] device_initial_probe+0x1c/0x26 drivers/base/dd.c:1079
[<ffffffff8254a72c>] bus_probe_device+0x15c/0x192 drivers/base/bus.c:532
[<ffffffff825432b4>] device_add+0x112c/0x186e drivers/base/core.c:3625
[<ffffffff8309b9fc>] usb_set_configuration+0xfe0/0x1b10 drivers/usb/core/message.c:2207
[<ffffffff830c449e>] usb_generic_driver_probe+0xae/0x128 drivers/usb/core/generic.c:254
[<ffffffff830a0d4e>] usb_probe_device+0xd6/0x340 drivers/usb/core/driver.c:294
[<ffffffff8254d476>] call_driver_probe drivers/base/dd.c:579 [inline]
[<ffffffff8254d476>] really_probe+0x234/0xbbc drivers/base/dd.c:658
[<ffffffff8254dfd2>] __driver_probe_device+0x1d4/0x458 drivers/base/dd.c:800
[<ffffffff8254e2b6>] driver_probe_device+0x60/0x1ce drivers/base/dd.c:830
[<ffffffff8254e608>] __device_attach_driver+0x1e4/0x2fe drivers/base/dd.c:958
[<ffffffff82547caa>] bus_for_each_drv+0x142/0x1da drivers/base/bus.c:457
[<ffffffff8254f22a>] __device_attach+0x1c4/0x462 drivers/base/dd.c:1030
[<ffffffff8254f850>] device_initial_probe+0x1c/0x26 drivers/base/dd.c:1079
[<ffffffff8254a72c>] bus_probe_device+0x15c/0x192 drivers/base/bus.c:532
[<ffffffff825432b4>] device_add+0x112c/0x186e drivers/base/core.c:3625
[<ffffffff83077f46>] usb_new_device+0x960/0x1648 drivers/usb/core/hub.c:2596
[<ffffffff8307e390>] hub_port_connect drivers/usb/core/hub.c:5465 [inline]
[<ffffffff8307e390>] hub_port_connect_change drivers/usb/core/hub.c:5605 [inline]
[<ffffffff8307e390>] port_event drivers/usb/core/hub.c:5765 [inline]
[<ffffffff8307e390>] hub_event+0x2954/0x4756 drivers/usb/core/hub.c:5847
[<ffffffff80123766>] process_one_work+0x7ce/0x179c kernel/workqueue.c:2633
[<ffffffff80125210>] process_scheduled_works kernel/workqueue.c:2706 [inline]
[<ffffffff80125210>] worker_thread+0xadc/0x10f8 kernel/workqueue.c:2787
[<ffffffff801446d0>] kthread+0x28c/0x3a6 kernel/kthread.c:388
[<ffffffff85928e6a>] ret_from_fork+0xe/0x1c arch/riscv/kernel/entry.S:229
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/11 18:53 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 3951f6add519 77b23aa1 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 kernel panic: corrupted stack end in hub_event
2024/02/03 12:25 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 6613476e225e a67b2c42 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 kernel panic: corrupted stack end in hub_event
* Struck through repros no longer work on HEAD.