syzbot


kernel panic: corrupted stack end in tun_chr_close

Status: internal: reported on 2022/05/09 00:03
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: b81d591386c3 riscv: Increase stack size under KASAN
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 272d, last: 272d

Sample crash report:
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 2886 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000a228>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113
[<ffffffff831668cc>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119
[<ffffffff831756ba>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff831756ba>] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106
[<ffffffff83175742>] dump_stack+0x1c/0x24 lib/dump_stack.c:113
[<ffffffff83166fa8>] panic+0x24a/0x634 kernel/panic.c:233
[<ffffffff831a688a>] schedule_debug kernel/sched/core.c:5541 [inline]
[<ffffffff831a688a>] schedule+0x0/0x14c kernel/sched/core.c:6187
[<ffffffff831a6b00>] preempt_schedule_common+0x4e/0xde kernel/sched/core.c:6462
[<ffffffff831a6bc4>] preempt_schedule+0x34/0x36 kernel/sched/core.c:6487
[<ffffffff831afc2c>] __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
[<ffffffff831afc2c>] _raw_spin_unlock+0x60/0x6a kernel/locking/spinlock.c:186
[<ffffffff8065be22>] spin_unlock include/linux/spinlock.h:389 [inline]
[<ffffffff8065be22>] start_unregistering fs/proc/proc_sysctl.c:306 [inline]
[<ffffffff8065be22>] drop_sysctl_table+0x124/0x320 fs/proc/proc_sysctl.c:1701
[<ffffffff8065c0c8>] unregister_sysctl_table fs/proc/proc_sysctl.c:1743 [inline]
[<ffffffff8065c0c8>] unregister_sysctl_table+0xaa/0x148 fs/proc/proc_sysctl.c:1718
[<ffffffff830542dc>] unregister_net_sysctl_table+0x1e/0x28 net/sysctl_net.c:175
[<ffffffff82d4099a>] __addrconf_sysctl_unregister net/ipv6/addrconf.c:7060 [inline]
[<ffffffff82d4099a>] addrconf_sysctl_unregister+0x82/0xdc net/ipv6/addrconf.c:7088
[<ffffffff82d42108>] addrconf_ifdown.isra.0+0xb5e/0xe96 net/ipv6/addrconf.c:3870
[<ffffffff82d4dc68>] addrconf_notify+0xca/0x1360 net/ipv6/addrconf.c:3651
[<ffffffff800aac84>] notifier_call_chain+0xb8/0x188 kernel/notifier.c:84
[<ffffffff800aad7e>] raw_notifier_call_chain+0x2a/0x38 kernel/notifier.c:392
[<ffffffff8271d086>] call_netdevice_notifiers_info+0x9e/0x10c net/core/dev.c:1919
[<ffffffff8272cd34>] call_netdevice_notifiers_extack net/core/dev.c:1931 [inline]
[<ffffffff8272cd34>] call_netdevice_notifiers net/core/dev.c:1945 [inline]
[<ffffffff8272cd34>] unregister_netdevice_many+0x77a/0xf50 net/core/dev.c:10415
[<ffffffff8272d746>] unregister_netdevice_queue+0x23c/0x29a net/core/dev.c:10349
[<ffffffff817bf6ac>] unregister_netdevice include/linux/netdevice.h:2901 [inline]
[<ffffffff817bf6ac>] __tun_detach+0xb9e/0xbf4 drivers/net/tun.c:676
[<ffffffff817bf78a>] tun_detach drivers/net/tun.c:693 [inline]
[<ffffffff817bf78a>] tun_chr_close+0x88/0x13e drivers/net/tun.c:3405
[<ffffffff804cb3c0>] __fput+0x164/0x502 fs/file_table.c:311
[<ffffffff804cb7d2>] ____fput+0x1a/0x24 fs/file_table.c:344
[<ffffffff800a0530>] task_work_run+0xdc/0x154 kernel/task_work.c:164
[<ffffffff80008c12>] tracehook_notify_resume include/linux/tracehook.h:188 [inline]
[<ffffffff80008c12>] do_notify_resume+0x894/0xa56 arch/riscv/kernel/signal.c:320
[<ffffffff80005724>] ret_from_exception+0x0/0x10
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-qemu2-riscv64 2022/05/09 00:02 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes 0966d385830d e60b1103 .config console log report info kernel panic: corrupted stack end in tun_chr_close
* Struck through repros no longer work on HEAD.