syzbot


BUG: unable to handle kernel NULL pointer dereference in depot_save_stack

Status: closed as dup on 2018/12/31 07:06
Reported-by: syzbot+ed56d5a9b979d862fb67@syzkaller.appspotmail.com
First crash: 1522d, last: 1522d
Duplicate of (1):
Title Repro Cause bisect Fix bisect Count Last Reported
kernel panic: corrupted stack end in wb_workfn C done 14 1498d 1499d

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
BUG: unable to handle kernel NULL pointer dereference at 0000000000000009
PGD 1b3eee067 P4D 1b3eee067 PUD 1b3eef067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 20236 Comm: syz-executor1 Not tainted 4.20.0-rc5+ #366
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 20 0a 2e 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff 49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08 75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff888180156d08 EFLAGS: 00010202
RAX: 0000000047977639 RBX: 00000000fef8ec23 RCX: ffff888180156d68
RDX: 000000001e65b1bd RSI: 00000000006080c0 RDI: 0000000000000018
RBP: ffff888180156d40 R08: 00000000000000b8 R09: 00000000dc2cc839
R10: 00000000fafaa4f6 R11: ffff8881dae2dafb R12: 0000000000000001
R13: ffff888180156d50 R14: 000000000008ec23 R15: ffff8881bba6641f
FS:  0000000000d33940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000009 CR3: 00000001b3ecd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 save_stack+0xa9/0xd0 mm/kasan/kasan.c:454
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3392 [inline]
 kmem_cache_alloc+0x11b/0x730 mm/slab.c:3552
 kmem_cache_zalloc include/linux/slab.h:731 [inline]
 __kernfs_new_node+0x127/0x8d0 fs/kernfs/dir.c:634
 kernfs_new_node+0x95/0x120 fs/kernfs/dir.c:695
 __kernfs_create_file+0x5a/0x340 fs/kernfs/file.c:992
 sysfs_add_file_mode_ns+0x222/0x530 fs/sysfs/file.c:306
 sysfs_create_file_ns+0x1a3/0x270 fs/sysfs/file.c:331
 sysfs_create_file include/linux/sysfs.h:513 [inline]
 device_create_file+0xf4/0x1e0 drivers/base/core.c:1381
 device_add+0x48c/0x18e0 drivers/base/core.c:1889
 netdev_register_kobject+0x187/0x3f0 net/core/net-sysfs.c:1751
 register_netdevice+0x99a/0x11d0 net/core/dev.c:8536
 register_netdev+0x30/0x50 net/core/dev.c:8651
 loopback_net_init+0x78/0x160 drivers/net/loopback.c:212
 ops_init+0x101/0x560 net/core/net_namespace.c:129
 setup_net+0x362/0x8d0 net/core/net_namespace.c:314
 copy_net_ns+0x2b1/0x4a0 net/core/net_namespace.c:437
 create_new_namespaces+0x6ad/0x900 kernel/nsproxy.c:107
 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:206
 ksys_unshare+0x79c/0x10b0 kernel/fork.c:2539
 __do_sys_unshare kernel/fork.c:2607 [inline]
 __se_sys_unshare kernel/fork.c:2605 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:2605
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a057
Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 dd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:0000000000a3ff78 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f2516b77000 RCX: 000000000045a057
RDX: 0000000000000006 RSI: 0000000000a3fa90 RDI: 0000000040000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000064 R11: 0000000000000202 R12: 0000000000000010
R13: 0000000000412e50 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000009
---[ end trace 8ed3c6a41fc89e09 ]---
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 20 0a 2e 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff 49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08 75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff888180156d08 EFLAGS: 00010202
RAX: 0000000047977639 RBX: 00000000fef8ec23 RCX: ffff888180156d68
RDX: 000000001e65b1bd RSI: 00000000006080c0 RDI: 0000000000000018
RBP: ffff888180156d40 R08: 00000000000000b8 R09: 00000000dc2cc839
R10: 00000000fafaa4f6 R11: ffff8881dae2dafb R12: 0000000000000001
R13: ffff888180156d50 R14: 000000000008ec23 R15: ffff8881bba6641f
FS:  0000000000d33940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000009 CR3: 00000001b3ecd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce 2018/12/07 13:27 upstream b72f711a4efa 1eb6a7e4 .config console log report
* Struck through repros no longer work on HEAD.