syzbot


BUG: MAX_STACK_TRACE_ENTRIES too low!

Status: upstream: reported C repro on 2024/03/19 07:46
Reported-by: syzbot+d83eeff73983945eae3d@syzkaller.appspotmail.com
First crash: 40d, last: 25d
Bug presence (1)
Date Name Commit Repro Result
2024/04/17 upstream (ToT) 96fca68c4fbf C Failed due to an error; will retry later
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: MAX_STACK_TRACE_ENTRIES too low! (3) net 2 1103d 1104d 20/26 fixed on 2021/11/10 00:50
upstream BUG: MAX_STACK_TRACE_ENTRIES too low! (2) C done 5045 1688d 1857d 13/26 fixed on 2019/10/15 23:40
upstream BUG: MAX_STACK_TRACE_ENTRIES too low! C done 1725 1858d 1884d 11/26 fixed on 2019/03/28 12:00

Sample crash report:
BUG: MAX_STACK_TRACE_ENTRIES too low!
turning off the locking correctness validator.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.153-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 save_trace+0x88a/0xab0 kernel/locking/lockdep.c:547
 check_prev_add kernel/locking/lockdep.c:3114 [inline]
 check_prevs_add kernel/locking/lockdep.c:3172 [inline]
 validate_chain+0x28fa/0x5930 kernel/locking/lockdep.c:3788
 __lock_acquire+0x1295/0x1ff0 kernel/locking/lockdep.c:5012
 lock_acquire+0x1db/0x4f0 kernel/locking/lockdep.c:5623
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
 htab_lock_bucket kernel/bpf/hashtab.c:183 [inline]
 htab_lru_map_delete_elem+0x1c2/0x650 kernel/bpf/hashtab.c:1394
 bpf_prog_bf22a42cb70295a9+0x47/0xfa0
 bpf_dispatcher_nop_func include/linux/bpf.h:785 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:1880 [inline]
 bpf_trace_run2+0x19e/0x340 kernel/trace/bpf_trace.c:1917
 __bpf_trace_kfree+0x6e/0x90 include/trace/events/kmem.h:118
 __traceiter_kfree+0x26/0x40 include/trace/events/kmem.h:118
 trace_kfree include/trace/events/kmem.h:118 [inline]
 kfree+0x22f/0x270 mm/slub.c:4549
 skb_free_head net/core/skbuff.c:655 [inline]
 skb_release_data+0x73a/0x8a0 net/core/skbuff.c:677
 skb_release_all net/core/skbuff.c:742 [inline]
 __kfree_skb+0x4c/0x60 net/core/skbuff.c:756
 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3342 [inline]
 tcp_ack+0x2326/0x6ab0 net/ipv4/tcp_input.c:3899
 tcp_rcv_established+0xf2d/0x1e20 net/ipv4/tcp_input.c:5902
 tcp_v4_do_rcv+0x423/0x960 net/ipv4/tcp_ipv4.c:1727
 tcp_v4_rcv+0x2740/0x2d80 net/ipv4/tcp_ipv4.c:2130
 ip_protocol_deliver_rcu+0x381/0x730 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x1db/0x320 net/ipv4/ip_input.c:231
 NF_HOOK+0x364/0x410 include/linux/netfilter.h:302
 dst_input include/net/dst.h:453 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:577 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:628 [inline]
 ip_sublist_rcv+0xb0f/0xe50 net/ipv4/ip_input.c:636
 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:671
 __netif_receive_skb_list_ptype net/core/dev.c:5528 [inline]
 __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5576
 __netif_receive_skb_list net/core/dev.c:5628 [inline]
 netif_receive_skb_list_internal+0x9ed/0xdf0 net/core/dev.c:5719
 gro_normal_list net/core/dev.c:5873 [inline]
 napi_complete_done+0x352/0x820 net/core/dev.c:6611
 virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline]
 virtnet_poll+0xbef/0x1270 drivers/net/virtio_net.c:1592
 __napi_poll+0xc7/0x440 net/core/dev.c:7035
 napi_poll net/core/dev.c:7102 [inline]
 net_rx_action+0x617/0xda0 net/core/dev.c:7192
 __do_softirq+0x3b3/0x93a kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x155/0x240 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 common_interrupt+0xa4/0xc0 arch/x86/kernel/irq.c:240
 </IRQ>
 <TASK>
 asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:629
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:132 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:110 [inline]
RIP: 0010:acpi_idle_do_entry+0x10f/0x340 drivers/acpi/processor_idle.c:570
Code: d0 5a f7 48 83 e3 08 0f 85 0a 01 00 00 4c 8d 74 24 20 e8 d4 4a 61 f7 0f 1f 44 00 00 e8 ea cc 5a f7 0f 00 2d f3 49 bd 00 fb f4 <4c> 89 f3 48 c1 eb 03 42 80 3c 3b 00 74 08 4c 89 f7 e8 3b 8c a4 f7
RSP: 0018:ffffc90000d67b00 EFLAGS: 000002d3
RAX: ffffffff8a256cc6 RBX: 0000000000000000 RCX: ffff88813fe68000
RDX: 0000000000000000 RSI: ffffffff8a8b1500 RDI: ffffffff8ad88fc0
RBP: ffffc90000d67b90 R08: ffffffff8186b7c0 R09: ffffed1027fcd001
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920001acf60
R13: ffff888142ffc804 R14: ffffc90000d67b20 R15: dffffc0000000000
 acpi_idle_enter+0x352/0x4f0 drivers/acpi/processor_idle.c:705
 cpuidle_enter_state+0x521/0xef0 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x3e4/0x670 kernel/sched/idle.c:306
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403
 start_secondary+0x371/0x500 arch/x86/kernel/smpboot.c:281
 secondary_startup_64_no_verify+0xb1/0xbb
 </TASK>
----------------
Code disassembly (best guess):
   0:	d0 5a f7             	rcrb   -0x9(%rdx)
   3:	48 83 e3 08          	and    $0x8,%rbx
   7:	0f 85 0a 01 00 00    	jne    0x117
   d:	4c 8d 74 24 20       	lea    0x20(%rsp),%r14
  12:	e8 d4 4a 61 f7       	call   0xf7614aeb
  17:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  1c:	e8 ea cc 5a f7       	call   0xf75acd0b
  21:	0f 00 2d f3 49 bd 00 	verw   0xbd49f3(%rip)        # 0xbd4a1b
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	4c 89 f3             	mov    %r14,%rbx <-- trapping instruction
  2d:	48 c1 eb 03          	shr    $0x3,%rbx
  31:	42 80 3c 3b 00       	cmpb   $0x0,(%rbx,%r15,1)
  36:	74 08                	je     0x40
  38:	4c 89 f7             	mov    %r14,%rdi
  3b:	e8 3b 8c a4 f7       	call   0xf7a48c7b

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/02 20:39 linux-5.15.y 9465fef4ae35 eb2966c4 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf BUG: MAX_STACK_TRACE_ENTRIES too low!
2024/03/29 20:37 linux-5.15.y 9465fef4ae35 c52bcb23 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf BUG: MAX_STACK_TRACE_ENTRIES too low!
2024/03/21 04:36 linux-5.15.y b95c01af2113 5b7d42ae .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf BUG: MAX_STACK_TRACE_ENTRIES too low!
2024/03/21 00:42 linux-5.15.y b95c01af2113 5b7d42ae .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf BUG: MAX_STACK_TRACE_ENTRIES too low!
2024/03/19 07:45 linux-5.15.y b95c01af2113 baa80228 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf BUG: MAX_STACK_TRACE_ENTRIES too low!
* Struck through repros no longer work on HEAD.