syzbot


kernel panic: corrupted stack end in tc_ctl_action

Status: moderation: reported on 2022/08/22 11:13
Reported-by: syzbot+aa5168afff9d42f601e7@syzkaller.appspotmail.com
Fix commit: b81d591386c3 riscv: Increase stack size under KASAN
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 164d, last: 106d

Sample crash report:
netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'.
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 3876 Comm: syz-executor.0 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff83175742>] dump_stack+0x1c/0x24 lib/dump_stack.c:113
[<ffffffff83166fa8>] panic+0x24a/0x634 kernel/panic.c:233
[<ffffffff831a688a>] schedule_debug kernel/sched/core.c:5541 [inline]
[<ffffffff831a688a>] schedule+0x0/0x14c kernel/sched/core.c:6187
[<ffffffff831a6b00>] preempt_schedule_common+0x4e/0xde kernel/sched/core.c:6462
[<ffffffff831a6bc4>] preempt_schedule+0x34/0x36 kernel/sched/core.c:6487
[<ffffffff80121892>] vprintk_emit+0x126/0x416 kernel/printk/printk.c:2246
[<ffffffff80121ba4>] vprintk_default+0x22/0x2e kernel/printk/printk.c:2256
[<ffffffff8012254a>] vprintk+0x108/0x13e kernel/printk/printk_safe.c:50
[<ffffffff83169c5c>] _printk+0xa0/0xc8 kernel/printk/printk.c:2266
[<ffffffff80be7926>] __nla_validate_parse+0x165a/0x165e lib/nlattr.c:600
[<ffffffff80be79ba>] __nla_parse+0x40/0x56 lib/nlattr.c:685
[<ffffffff8286ab3e>] nla_parse_nested_deprecated include/net/netlink.h:1231 [inline]
[<ffffffff8286ab3e>] tc_action_load_ops+0xd4/0x2f8 net/sched/act_api.c:1274
[<ffffffff8286b3f0>] tcf_action_init+0x1f4/0x58a net/sched/act_api.c:1414
[<ffffffff8286da56>] tcf_action_add+0x126/0x36c net/sched/act_api.c:1947
[<ffffffff8286df1a>] tc_ctl_action+0x27e/0x2f0 net/sched/act_api.c:2006
[<ffffffff8276b46c>] rtnetlink_rcv_msg+0x338/0x9a0 net/core/rtnetlink.c:5592
[<ffffffff8296ded2>] netlink_rcv_skb+0xf8/0x2be net/netlink/af_netlink.c:2494
[<ffffffff827624f4>] rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:5610
[<ffffffff8296cbcc>] netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
[<ffffffff8296cbcc>] netlink_unicast+0x40e/0x5fe net/netlink/af_netlink.c:1343
[<ffffffff8296d29c>] netlink_sendmsg+0x4e0/0x994 net/netlink/af_netlink.c:1919
[<ffffffff826d264e>] sock_sendmsg_nosec net/socket.c:705 [inline]
[<ffffffff826d264e>] sock_sendmsg+0xa0/0xc4 net/socket.c:725
[<ffffffff826d4dd4>] ____sys_sendmsg+0x46e/0x484 net/socket.c:2413
[<ffffffff826d8bca>] ___sys_sendmsg+0x16c/0x1f6 net/socket.c:2467
[<ffffffff826d8e78>] __sys_sendmsg+0xba/0x150 net/socket.c:2496
[<ffffffff826d8f3a>] __do_sys_sendmsg net/socket.c:2505 [inline]
[<ffffffff826d8f3a>] sys_sendmsg+0x2c/0x3a net/socket.c:2503
[<ffffffff80005716>] ret_from_syscall+0x0/0x2
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-qemu2-riscv64 2022/10/15 18:41 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d 67cb024c .config console log report info kernel panic: corrupted stack end in tc_ctl_action
ci-qemu2-riscv64 2022/08/18 11:02 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d d58e263f .config console log report info kernel panic: corrupted stack end in tc_ctl_action
* Struck through repros no longer work on HEAD.