syzbot


kernel panic: corrupted stack end in inet6_sendmsg

Status: internal: reported on 2022/09/29 14:01
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: b81d591386c3 riscv: Increase stack size under KASAN
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 128d, last: 128d

Sample crash report:
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 4332 Comm: syz-executor.0 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff83175742>] dump_stack+0x1c/0x24 lib/dump_stack.c:113
[<ffffffff83166fa8>] panic+0x24a/0x634 kernel/panic.c:233
[<ffffffff831a688a>] schedule_debug kernel/sched/core.c:5541 [inline]
[<ffffffff831a688a>] schedule+0x0/0x14c kernel/sched/core.c:6187
[<ffffffff831a6b00>] preempt_schedule_common+0x4e/0xde kernel/sched/core.c:6462
[<ffffffff831a6bc4>] preempt_schedule+0x34/0x36 kernel/sched/core.c:6487
[<ffffffff80061140>] __local_bh_enable_ip+0x29e/0x2a4 kernel/softirq.c:390
[<ffffffff831afc6a>] __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
[<ffffffff831afc6a>] _raw_spin_unlock_bh+0x34/0x40 kernel/locking/spinlock.c:210
[<ffffffff829d17cc>] spin_unlock_bh include/linux/spinlock.h:394 [inline]
[<ffffffff829d17cc>] nf_conntrack_tcp_packet+0x128a/0x3b6c net/netfilter/nf_conntrack_proto_tcp.c:1159
[<ffffffff829c2eaa>] nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1829 [inline]
[<ffffffff829c2eaa>] nf_conntrack_in+0xb8e/0x127e net/netfilter/nf_conntrack_core.c:1920
[<ffffffff829cd7f8>] ipv4_conntrack_local+0x166/0x180 net/netfilter/nf_conntrack_proto.c:213
[<ffffffff8299b738>] nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
[<ffffffff8299b738>] nf_hook_slow+0x8a/0x156 net/netfilter/core.c:619
[<ffffffff82af46cc>] nf_hook.constprop.0+0x17e/0x37e include/linux/netfilter.h:262
[<ffffffff82afaec4>] __ip_local_out+0x1a0/0x31c net/ipv4/ip_output.c:115
[<ffffffff82afbb6a>] ip_local_out net/ipv4/ip_output.c:124 [inline]
[<ffffffff82afbb6a>] __ip_queue_xmit+0x43c/0xeb2 net/ipv4/ip_output.c:525
[<ffffffff82afc616>] ip_queue_xmit+0x36/0x44 net/ipv4/ip_output.c:539
[<ffffffff82b4fd54>] __tcp_transmit_skb+0xce4/0x1f5e net/ipv4/tcp_output.c:1402
[<ffffffff82b522b4>] tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
[<ffffffff82b522b4>] tcp_send_syn_data net/ipv4/tcp_output.c:3798 [inline]
[<ffffffff82b522b4>] tcp_connect+0x12e6/0x27a4 net/ipv4/tcp_output.c:3837
[<ffffffff82b68448>] tcp_v4_connect+0xb12/0xca6 net/ipv4/tcp_ipv4.c:312
[<ffffffff82dc5134>] tcp_v6_connect+0x4cc/0x115a net/ipv6/tcp_ipv6.c:248
[<ffffffff82bb8bda>] __inet_stream_connect+0x26e/0x83c net/ipv4/af_inet.c:660
[<ffffffff82b1c76c>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1162 [inline]
[<ffffffff82b1c76c>] tcp_sendmsg_locked+0x164a/0x1d9e net/ipv4/tcp.c:1204
[<ffffffff82b1cef2>] tcp_sendmsg+0x32/0x4e net/ipv4/tcp.c:1440
[<ffffffff82d161aa>] inet6_sendmsg+0x78/0x98 net/ipv6/af_inet6.c:643
[<ffffffff826d264e>] sock_sendmsg_nosec net/socket.c:705 [inline]
[<ffffffff826d264e>] sock_sendmsg+0xa0/0xc4 net/socket.c:725
[<ffffffff826d4dd4>] ____sys_sendmsg+0x46e/0x484 net/socket.c:2413
[<ffffffff826d8bca>] ___sys_sendmsg+0x16c/0x1f6 net/socket.c:2467
[<ffffffff826d8e78>] __sys_sendmsg+0xba/0x150 net/socket.c:2496
[<ffffffff826d8f3a>] __do_sys_sendmsg net/socket.c:2505 [inline]
[<ffffffff826d8f3a>] sys_sendmsg+0x2c/0x3a net/socket.c:2503
[<ffffffff80005716>] ret_from_syscall+0x0/0x2
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-qemu2-riscv64 2022/09/29 14:00 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d d9da3ac6 .config console log report info kernel panic: corrupted stack end in inet6_sendmsg
* Struck through repros no longer work on HEAD.