syzbot


kernel panic: corrupted stack end in openat

Status: auto-closed as invalid on 2022/03/01 01:08
Subsystems: fs mm
[Documentation on labels]
Reported-by: syzbot+0b06ef9b44d00d600183@syzkaller.appspotmail.com
First crash: 1137d, last: 907d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] kernel panic: corrupted stack end in openat 15 (16) 2021/03/17 08:50

Sample crash report:
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 3267 Comm: syz-fuzzer Not tainted 5.12.0-rc3-syzkaller #0
Hardware name: ARM-Versatile Express
Backtrace: 
[<81802550>] (dump_backtrace) from [<818027c4>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252)
 r7:00000080 r6:60000093 r5:00000000 r4:82b58344
[<818027ac>] (show_stack) from [<81809e98>] (__dump_stack lib/dump_stack.c:79 [inline])
[<818027ac>] (show_stack) from [<81809e98>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<81809de0>] (dump_stack) from [<81803358>] (panic+0x130/0x378 kernel/panic.c:231)
 r7:81f4bca4 r6:82a390a4 r5:00000000 r4:82c6b0d0
[<81803228>] (panic) from [<818200c0>] (schedule_debug kernel/sched/core.c:4822 [inline])
[<81803228>] (panic) from [<818200c0>] (__schedule+0xcb8/0xcc8 kernel/sched/core.c:4967)
 r3:57ac6e9d r2:855f2080 r1:81f5a420 r0:81f4bca4
 r7:00000001
[<8181f408>] (__schedule) from [<818202bc>] (preempt_schedule_common+0x3c/0xac kernel/sched/core.c:5233)
 r10:0000071f r9:ffefd000 r8:00000001 r7:81820360 r6:00000001 r5:81820360
 r4:85abc000
[<81820280>] (preempt_schedule_common) from [<81820360>] (preempt_schedule+0x34/0x38 kernel/sched/core.c:5258)
 r7:82c6a4e0 r6:00000001 r5:85abc000 r4:df2c9aa0
[<8182032c>] (preempt_schedule) from [<8048c644>] (__kunmap_atomic include/linux/highmem-internal.h:114 [inline])
[<8182032c>] (preempt_schedule) from [<8048c644>] (clear_highpage include/linux/highmem.h:204 [inline])
[<8182032c>] (preempt_schedule) from [<8048c644>] (kernel_init_free_pages+0xc4/0xd0 mm/page_alloc.c:1212)
[<8048c580>] (kernel_init_free_pages) from [<80492aa8>] (post_alloc_hook mm/page_alloc.c:2305 [inline])
[<8048c580>] (kernel_init_free_pages) from [<80492aa8>] (prep_new_page mm/page_alloc.c:2311 [inline])
[<8048c580>] (kernel_init_free_pages) from [<80492aa8>] (get_page_from_freelist+0x163c/0x1698 mm/page_alloc.c:3951)
 r10:df2c9a70 r9:82bf87c0 r8:df2c9a70 r7:0000000c r6:00000002 r5:00000001
 r4:df2c9a78 r3:00000001
[<8049146c>] (get_page_from_freelist) from [<80493188>] (__alloc_pages_nodemask+0x164/0x1850 mm/page_alloc.c:5001)
 r10:00000000 r9:86447700 r8:00112cca r7:0000000c r6:00000081 r5:00000008
 r4:00000000
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (__alloc_pages include/linux/gfp.h:525 [inline])
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (__alloc_pages_node include/linux/gfp.h:538 [inline])
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (alloc_pages_node include/linux/gfp.h:552 [inline])
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (alloc_pages include/linux/gfp.h:571 [inline])
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (__page_cache_alloc include/linux/pagemap.h:289 [inline])
[<80493024>] (__alloc_pages_nodemask) from [<8042eeb8>] (page_cache_ra_unbounded+0xc4/0x294 mm/readahead.c:216)
 r10:86447704 r9:86447700 r8:85abd56c r7:0000000c r6:00000188 r5:85abd688
 r4:df2c9a40
[<8042edf4>] (page_cache_ra_unbounded) from [<8042f184>] (do_page_cache_ra+0xfc/0x150 mm/readahead.c:267)
 r10:8644762c r9:00000001 r8:00000020 r7:80000013 r6:8042f3e4 r5:85abd688
 r4:86447588
[<8042f088>] (do_page_cache_ra) from [<8042f3e4>] (ondemand_readahead+0x20c/0x47c mm/readahead.c:549)
 r10:00000001 r9:0000017c r8:00000020 r7:0000015c r6:85abd688 r5:00000000
 r4:858085e0
[<8042f1d8>] (ondemand_readahead) from [<8042f718>] (page_cache_async_ra mm/readahead.c:607 [inline])
[<8042f1d8>] (ondemand_readahead) from [<8042f718>] (page_cache_async_ra+0xc4/0x110 mm/readahead.c:581)
 r10:85abd818 r9:df2c8c60 r8:86447700 r7:85abd714 r6:00000000 r5:85abd688
 r4:858085e0
[<8042f654>] (page_cache_async_ra) from [<80420adc>] (page_cache_async_readahead include/linux/pagemap.h:863 [inline])
[<8042f654>] (page_cache_async_ra) from [<80420adc>] (filemap_readahead mm/filemap.c:2350 [inline])
[<8042f654>] (page_cache_async_ra) from [<80420adc>] (filemap_get_pages+0x254/0x648 mm/filemap.c:2391)
 r7:85abd714 r6:0000015b r5:85abd830 r4:0000015c
[<80420888>] (filemap_get_pages) from [<80420f98>] (filemap_read+0xc8/0x4e0 mm/filemap.c:2458)
 r10:85abd818 r9:86447588 r8:805ff25c r7:85abd830 r6:00000000 r5:85abd818
 r4:85abd830
[<80420ed0>] (filemap_read) from [<80421548>] (generic_file_read_iter+0x198/0x234 mm/filemap.c:2609)
 r10:00001000 r9:00000000 r8:805ff25c r7:00001000 r6:00000000 r5:85abd818
 r4:85abd830
[<804213b0>] (generic_file_read_iter) from [<805ff25c>] (ext4_file_read_iter fs/ext4/file.c:130 [inline])
[<804213b0>] (generic_file_read_iter) from [<805ff25c>] (ext4_file_read_iter+0x54/0x118 fs/ext4/file.c:113)
 r10:00001000 r9:00000000 r8:00001000 r7:85abd888 r6:86447588 r5:85abd830
 r4:85abd818
[<805ff208>] (ext4_file_read_iter) from [<804da2bc>] (__kernel_read+0x130/0x314 fs/read_write.c:454)
 r7:85abd888 r6:00000000 r5:00000000 r4:85808500
[<804da18c>] (__kernel_read) from [<8073759c>] (integrity_kernel_read+0x20/0x28 security/integrity/iint.c:191)
 r9:00000000 r8:00400000 r7:85836000 r6:00000000 r5:85808500 r4:0015b000
[<8073757c>] (integrity_kernel_read) from [<8073a754>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484)
[<8073a5dc>] (ima_calc_file_hash_tfm) from [<8073ac7c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline])
[<8073a5dc>] (ima_calc_file_hash_tfm) from [<8073ac7c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572)
 r10:8644762c r9:00000000 r8:00000001 r7:00000013 r6:832fab90 r5:856dad00
 r4:85808500
[<8073ab58>] (ima_calc_file_hash) from [<8073bff8>] (ima_collect_measurement+0x224/0x260 security/integrity/ima/ima_api.c:252)
 r10:85fa2a04 r9:86447644 r8:857fdcc0 r7:00000003 r6:00000000 r5:857fdcc0
 r4:85808500
[<8073bdd4>] (ima_collect_measurement) from [<807392a8>] (process_measurement+0x46c/0x7b0 security/integrity/ima/ima_main.c:330)
 r10:00000000 r9:86447644 r8:857fdcc0 r7:00000001 r6:00000001 r5:00000000
 r4:85808500
[<80738e3c>] (process_measurement) from [<80739664>] (ima_file_check+0x78/0xa0 security/integrity/ima/ima_main.c:499)
 r10:00000000 r9:00000000 r8:85808500 r7:00000000 r6:00000000 r5:85abdd48
 r4:00000006
[<807395ec>] (ima_file_check) from [<804ec638>] (do_open fs/namei.c:3367 [inline])
[<807395ec>] (ima_file_check) from [<804ec638>] (path_openat+0x20c/0x10f8 fs/namei.c:3498)
 r7:85abde58 r6:82a3c39c r5:85abdf20 r4:00020002
[<804ec42c>] (path_openat) from [<804ef4ac>] (do_filp_open+0x7c/0x12c fs/namei.c:3525)
 r10:00000142 r9:85abc000 r8:80200224 r7:00000001 r6:85abdf20 r5:85abde58
 r4:85abdf58
[<804ef430>] (do_filp_open) from [<804d782c>] (do_sys_openat2+0xa8/0x160 fs/open.c:1187)
 r7:ffffff9c r6:00000009 r5:85b5d000 r4:85abdf58
[<804d7784>] (do_sys_openat2) from [<804d7cd0>] (do_sys_open fs/open.c:1203 [inline])
[<804d7784>] (do_sys_openat2) from [<804d7cd0>] (__do_sys_openat fs/open.c:1219 [inline])
[<804d7784>] (do_sys_openat2) from [<804d7cd0>] (sys_openat+0xa4/0xcc fs/open.c:1214)
 r7:00000142 r6:00000000 r5:0c1a42c0 r4:ffffff9c
[<804d7c2c>] (sys_openat) from [<80200060>] (ret_fast_syscall+0x0/0x2c arch/arm/mm/proc-v7.S:64)
Exception stack(0x85abdfa8 to 0x85abdff0)
dfa0:                   00000000 00000000 ffffff9c 0c1a42c0 000a0002 000001a4
dfc0: 00000000 00000000 00000000 00000142 00000005 7ef7e3bf 024000e0 00d3da38
dfe0: 0c1a42c3 024fcb68 00012368 000b8dbc
 r5:00000000 r4:00000000
Rebooting in 86400 seconds..

Crashes (42):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/11/01 01:07 upstream bf152b0b41dc 098b5d53 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/10/12 06:55 upstream bf152b0b41dc 838e7e2c .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/10/10 07:56 upstream bf152b0b41dc 838e7e2c .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/10/02 18:22 upstream bf152b0b41dc db0f5787 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/23 08:08 upstream bf152b0b41dc 8cac236e .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/19 08:23 upstream bf152b0b41dc 70b76c1d .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/15 18:21 upstream bf152b0b41dc 07e953c1 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/12 13:43 upstream bf152b0b41dc 3ce60af8 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/09 15:51 upstream bf152b0b41dc e2776ee4 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/06 09:21 upstream bf152b0b41dc d236a457 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/09/06 01:59 upstream bf152b0b41dc d236a457 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/08/27 16:47 upstream bf152b0b41dc b318694d .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/08/26 06:51 upstream bf152b0b41dc b599f2fc .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/08/01 20:23 upstream bf152b0b41dc 6c236867 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/07/27 07:20 upstream bf152b0b41dc fd511809 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/07/27 03:29 upstream bf152b0b41dc fd511809 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/07/17 01:58 upstream bf152b0b41dc f115ae98 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/28 22:34 upstream bf152b0b41dc 9d2ab5df .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/17 11:36 upstream bf152b0b41dc aba2b2fb .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/09 02:36 upstream bf152b0b41dc 5c2fe346 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/05 21:09 upstream bf152b0b41dc 500c2339 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/04 05:07 upstream bf152b0b41dc 0740de69 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/01 16:15 upstream bf152b0b41dc 032639db .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/06/01 06:05 upstream bf152b0b41dc 032639db .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/30 21:27 upstream bf152b0b41dc 858ea628 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/24 01:35 upstream bf152b0b41dc 3c7fef33 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/23 16:12 upstream bf152b0b41dc 3c7fef33 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/22 14:26 upstream bf152b0b41dc 3c7fef33 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/16 11:16 upstream bf152b0b41dc f54a5c09 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/02 05:32 upstream bf152b0b41dc 77e2b668 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/05/01 22:00 upstream bf152b0b41dc 77e2b668 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/30 22:00 upstream bf152b0b41dc 77e2b668 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/29 09:14 upstream bf152b0b41dc 77e2b668 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/18 14:58 upstream bf152b0b41dc 7e2b734b .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/10 18:01 upstream bf152b0b41dc bfeda1b1 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/06 12:40 upstream bf152b0b41dc 6a81331a .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/04/04 10:37 upstream bf152b0b41dc 6a81331a .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/03/28 18:42 upstream bf152b0b41dc a8529b82 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/03/27 04:53 upstream bf152b0b41dc a8529b82 .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/03/25 14:38 upstream bf152b0b41dc 6a383ecf .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/03/25 04:26 upstream bf152b0b41dc 607e3baf .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
2021/03/16 00:38 upstream 1e28eed17697 fdb2bb2c .config console log report info ci-qemu2-arm32 kernel panic: corrupted stack end in openat
* Struck through repros no longer work on HEAD.