BUG: stack guard page was hit in sys_mount

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=156db9b3700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=23fa32d499d540cfef18
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b103cd700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b40863700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+23fa32...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000bffff8 (stack is ffffc90000c00000..ffffc90000c07fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 377 Comm: syz-executor145 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:check_preemption_disabled+0x4/0x180 lib/smp_processor_id.c:13
Code: cc cc cc cc cc cc 55 48 89 e5 0f 1f 44 00 00 48 c7 c7 80 bf 49 85 48 c7 c6 c0 bf 49 85 e8 04 00 00 00 5d c3 66 90 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 48 83 ec 18 49 89 f6 49 89 ff 65 48 8b
RSP: 0018:ffffc90000c00000 EFLAGS: 00010802
RAX: f3f3f300f1f1f1f1 RBX: ffff8881f7056930 RCX: 1ffff92000180040
RDX: 1ffff92000180020 RSI: ffffffff8549bfc0 RDI: ffffffff8549bf80
RBP: ffffc90000c00000 R08: ffffffff86e3c008 R09: ffffffff86e3c018
R10: ffffffff86e3c010 R11: ffffffff86e3c003 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8881079f13c0 R15: ffff8881079f13c0
FS: 00007f970eeb6700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 0000000106f9c000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_smp_processor_id+0x1c/0x20 lib/smp_processor_id.c:59
rcu_note_context_switch+0x8a/0x10b0 kernel/rcu/tree_plugin.h:292
__schedule+0x119/0xda0 kernel/sched/core.c:4690
preempt_schedule_irq+0xce/0x140 kernel/sched/core.c:5051
irqentry_exit_cond_resched kernel/entry/common.c:357 [inline]
irqentry_exit+0x50/0x60 kernel/entry/common.c:387
sysvec_apic_timer_interrupt+0xcb/0xe0 arch/x86/kernel/apic/apic.c:1095
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:update_stack_state+0x415/0x530 arch/x86/kernel/unwind_frame.c:242
Code: 6d 02 00 49 39 06 74 0d 48 89 df e8 f5 fb ff ff 48 89 c3 eb 22 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 <74> 08 48 89 df e8 11 eb 72 00 48 8b 1b 49 83 c5 48 4c 89 e8 48 c1
RSP: 0018:ffffc90000c00420 EFLAGS: 00000246
RAX: 1ffff920001800db RBX: ffffc90000c006d8 RCX: dffffc0000000000
RDX: 1ffff920001800ae RSI: ffffc90000c006d0 RDI: ffffc90000c00560
RBP: ffffc90000c004b8 R08: ffffc90000c00648 R09: 0000000000000000
R10: ffffc90000c00650 R11: 0000000000000000 R12: 1ffff920001800b4
R13: ffffc90000c00560 R14: ffffc90000c00588 R15: ffffc90000c005a0
unwind_next_frame+0x3d4/0x740 arch/x86/kernel/unwind_frame.c:305
arch_stack_walk+0x112/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:121
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xf3/0x1360 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_slow fs/namei.c:1645 [inline]
walk_component+0x516/0x790 fs/namei.c:1940
lookup_last fs/namei.c:2389 [inline]
path_lookupat+0x19d/0x6c0 fs/namei.c:2413
filename_lookup+0x23f/0x6c0 fs/namei.c:2446
user_path_at_empty+0x40/0x50 fs/namei.c:2726
user_path_at include/linux/namei.h:59 [inline]
do_mount fs/namespace.c:3239 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x2bc/0x3b0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f970ef09359
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f970eeb6208 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 00007f970ef09359
RDX: 0000000020000340 RSI: 0000000020000000 RDI: 00000000200002c0
RBP: 00007f970ef8d3e0 R08: 0000000000000000 R09: 00007f970ef8d3e8
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f970ef8d3ec
R13: 00007ffd22849d2f R14: 00007f970eeb6300 R15: 0000000000022000
Modules linked in:
---[ end trace 273c4a4f86fee23c ]---
RIP: 0010:check_preemption_disabled+0x4/0x180 lib/smp_processor_id.c:13
Code: cc cc cc cc cc cc 55 48 89 e5 0f 1f 44 00 00 48 c7 c7 80 bf 49 85 48 c7 c6 c0 bf 49 85 e8 04 00 00 00 5d c3 66 90 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 48 83 ec 18 49 89 f6 49 89 ff 65 48 8b
RSP: 0018:ffffc90000c00000 EFLAGS: 00010802
RAX: f3f3f300f1f1f1f1 RBX: ffff8881f7056930 RCX: 1ffff92000180040
RDX: 1ffff92000180020 RSI: ffffffff8549bfc0 RDI: ffffffff8549bf80
RBP: ffffc90000c00000 R08: ffffffff86e3c008 R09: ffffffff86e3c018
R10: ffffffff86e3c010 R11: ffffffff86e3c003 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8881079f13c0 R15: ffff8881079f13c0
FS: 00007f970eeb6700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 0000000106f9c000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: 55 push %rbp
7: 48 89 e5 mov %rsp,%rbp
a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
f: 48 c7 c7 80 bf 49 85 mov $0xffffffff8549bf80,%rdi
16: 48 c7 c6 c0 bf 49 85 mov $0xffffffff8549bfc0,%rsi
1d: e8 04 00 00 00 callq 0x26
22: 5d pop %rbp
23: c3 retq
24: 66 90 xchg %ax,%ax
26: 55 push %rbp
27: 48 89 e5 mov %rsp,%rbp
* 2a: 41 57 push %r15 <-- trapping instruction
2c: 41 56 push %r14
2e: 41 55 push %r13
30: 41 54 push %r12
32: 53 push %rbx
33: 48 83 ec 18 sub $0x18,%rsp
37: 49 89 f6 mov %rsi,%r14
3a: 49 89 ff mov %rdi,%r15
3d: 65 gs
3e: 48 rex.W
3f: 8b .byte 0x8b


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+23fa32...@syzkaller.appspotmail.com

Tested on:

commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa

dashboard link: https://syzkaller.appspot.com/bug?extid=23fa32d499d540cfef18
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

[Tadeusz Struk]

#syz dup: BUG: stack guard page was hit in file_open

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

=======================================
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif

struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );

__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}

@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}

void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}

/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))

+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+23fa32...@syzkaller.appspotmail.com

Tested on:

commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..

git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=23fa32d499d540cfef18
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=17d4b06f700000

[Tadeusz Struk]

On 3/27/22 08:18, syzbot wrote:

#syz dup: BUG: stack guard page was hit in file_open