BUG: stack guard page was hit in sys_unlink (7)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 9a559b886861 Merge branch 'android12-5.10' into `android12..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=15619347700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c75d1e9921386ae5
dashboard link: https://syzkaller.appspot.com/bug?extid=df538b53b7f9c1434eb9
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14516eb3700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d57863700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+df538b...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000bffff8 (stack is ffffc90000c00000..ffffc90000c07fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 365 Comm: syz-executor252 Not tainted 5.10.107-syzkaller-00620-g9a559b886861 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kasan_check_range+0x4/0x2f0 mm/kasan/generic.c:185
Code: 01 c6 48 89 c7 e8 dc 48 ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 09 02 00 00 48 89
RSP: 0018:ffffc90000c00000 EFLAGS: 00010246
RAX: ffff8881079862c0 RBX: ffffc90000c000c0 RCX: ffffffff813415e4
RDX: 0000000000000001 RSI: 0000000000000060 RDI: ffffc90000c000c0
RBP: ffffc90000c00000 R08: dffffc0000000000 R09: ffffc90000c001a0
R10: fffff52000180037 R11: 0000000000000000 R12: ffff8881079862c0
R13: ffffc90000c000c0 R14: 0000000000000000 R15: 0000000000000060
FS: 0000555555aec300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 00000001081d8000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
memset+0x23/0x40 mm/kasan/shadow.c:44
__unwind_start+0x34/0x420 arch/x86/kernel/unwind_frame.c:368
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xdc/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:121
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xf3/0x1360 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_hash+0x141/0x290 fs/namei.c:1529
do_unlinkat+0x298/0x960 fs/namei.c:3959
__do_sys_unlink fs/namei.c:4018 [inline]
__se_sys_unlink fs/namei.c:4016 [inline]
__x64_sys_unlink+0x49/0x50 fs/namei.c:4016
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7ff6d8eb4099
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc362e00f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff6d8eb4099
RDX: 00007ff6d8eb4099 RSI: 0000000020000200 RDI: 0000000020000000
RBP: 00007ff6d8e78080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff6d8e78110
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 6d9b3c0828b5073e ]---
RIP: 0010:kasan_check_range+0x4/0x2f0 mm/kasan/generic.c:185
Code: 01 c6 48 89 c7 e8 dc 48 ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 09 02 00 00 48 89
RSP: 0018:ffffc90000c00000 EFLAGS: 00010246
RAX: ffff8881079862c0 RBX: ffffc90000c000c0 RCX: ffffffff813415e4
RDX: 0000000000000001 RSI: 0000000000000060 RDI: ffffc90000c000c0
RBP: ffffc90000c00000 R08: dffffc0000000000 R09: ffffc90000c001a0
R10: fffff52000180037 R11: 0000000000000000 R12: ffff8881079862c0
R13: ffffc90000c000c0 R14: 0000000000000000 R15: 0000000000000060
FS: 0000555555aec300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 00000001081d8000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 01 c6 add %eax,%esi
2: 48 89 c7 mov %rax,%rdi
5: e8 dc 48 ef 02 callq 0x2ef48e6
a: 31 c0 xor %eax,%eax
c: 5d pop %rbp
d: c3 retq
e: 0f 0b ud2
10: eb 02 jmp 0x14
12: 0f 0b ud2
14: b8 ea ff ff ff mov $0xffffffea,%eax
19: 5d pop %rbp
1a: c3 retq
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: 55 push %rbp
27: 48 89 e5 mov %rsp,%rbp
* 2a: 41 57 push %r15 <-- trapping instruction
2c: 41 56 push %r14
2e: 41 55 push %r13
30: 41 54 push %r12
32: 53 push %rbx
33: b0 01 mov $0x1,%al
35: 48 85 f6 test %rsi,%rsi
38: 0f 84 09 02 00 00 je 0x247
3e: 48 rex.W
3f: 89 .byte 0x89


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

l Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
dump_stack+0x15/0x1d lib/dump_stack.c:135
ubsan_epilogue lib/ubsan.c:148 [inline]
handle_object_size_mismatch lib/ubsan.c:297 [inline]
ubsan_type_mismatch_common+0x1ed/0x3a0 lib/ubsan.c:310
__ubsan_handle_type_mismatch_v1+0x5b/0x70 lib/ubsan.c:339
__skb_insert include/linux/skbuff.h:1932 [inline]
__skb_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================


[ 16.789481][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
Warning: Permanently added '10.128.0.181' (ECDSA) to the list of known hosts.
[ 22.420719][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
2022/03/23 23:29:28 fuzzer started
2022/03/23 23:29:29 connecting to host at 10.128.0.163:42973
2022/03/23 23:29:29 checking machine...
2022/03/23 23:29:29 checking revisions...
2022/03/23 23:29:29 testing simple program...
[ 22.842793][ T23] audit: type=1400 audit(1648078169.139:73): avc: denied { getattr } for pid=373 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.866300][ T382] cgroup: Unknown subsys name 'net'
[ 22.870711][ T23] audit: type=1400 audit(1648078169.139:74): avc: denied { read } for pid=373 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.896807][ T23] audit: type=1400 audit(1648078169.139:75): avc: denied { open } for pid=373 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.896949][ T382] cgroup: Unknown subsys name 'devices'
[ 22.920001][ T23] audit: type=1400 audit(1648078169.139:76): avc: denied { read } for pid=373 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 22.948390][ T23] audit: type=1400 audit(1648078169.139:77): avc: denied { open } for pid=373 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 22.971652][ T23] audit: type=1400 audit(1648078169.139:78): avc: denied { mounton } for pid=382 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 22.994358][ T23] audit: type=1400 audit(1648078169.139:79): avc: denied { mount } for pid=382 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.016463][ T23] audit: type=1400 audit(1648078169.169:80): avc: denied { unmount } for pid=382 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.091129][ T382] cgroup: Unknown subsys name 'hugetlb'
[ 23.096831][ T382] cgroup: Unknown subsys name 'rlimit'
[ 23.200666][ T23] audit: type=1400 audit(1648078169.499:81): avc: denied { setattr } for pid=382 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.223861][ T23] audit: type=1400 audit(1648078169.499:82): avc: denied { execmem } for pid=384 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 23.270456][ T385] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.277494][ T385] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.285209][ T385] device bridge_slave_0 entered promiscuous mode
[ 23.292000][ T385] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.299005][ T385] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.306372][ T385] device bridge_slave_1 entered promiscuous mode
[ 23.336456][ T385] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.343516][ T385] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.350795][ T385] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.357898][ T385] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.377286][ T51] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.384529][ T51] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.392090][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 23.399695][ T51] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 23.408429][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 23.416579][ T24] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.423610][ T24] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.439616][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 23.449036][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 23.457321][ T24] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.464338][ T24] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.472228][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 23.480322][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 23.499464][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 23.507717][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 23.516719][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 23.525138][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 23.533666][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 23.544819][ T24] ================================================================================
[ 23.554120][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 23.561909][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 23.570236][ T24] for an object of type 'struct sk_buff'
[ 23.575858][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00370-gcf9be86ac40d #0
[ 23.585627][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.595680][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 23.601635][ T24] Call Trace:
[ 23.604902][ T24] dump_stack_lvl+0x1e2/0x24b
[ 23.609567][ T24] ? show_regs_print_info+0x18/0x18
[ 23.614744][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 23.620437][ T24] dump_stack+0x15/0x1d
[ 23.624567][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 23.630260][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 23.636129][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 23.642085][ T24] wg_xmit+0x4a2/0xae0
[ 23.646130][ T24] ? wg_stop+0x5d0/0x5d0
[ 23.650359][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 23.656584][ T24] netdev_start_xmit+0x8a/0x160
[ 23.661414][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 23.666500][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 23.671503][ T24] ? dev_queue_xmit+0x20/0x20
[ 23.676156][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.682369][ T24] ? ndisc_constructor+0x690/0x8a0
[ 23.687459][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 23.692645][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 23.697741][ T24] ? dev_hard_header+0xdb/0xf0
[ 23.702492][ T24] dev_queue_xmit+0x17/0x20
[ 23.706978][ T24] neigh_connected_output+0x288/0x2b0
[ 23.712336][ T24] ip6_finish_output2+0xde2/0x1440
[ 23.717424][ T24] ? __rcu_read_lock+0x50/0x50
[ 23.722162][ T24] ? __ip6_finish_output+0x520/0x520
[ 23.727421][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 23.732941][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.739153][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 23.743977][ T24] __ip6_finish_output+0x3e4/0x520
[ 23.749063][ T24] ip6_finish_output+0x3f/0x220
[ 23.753888][ T24] ? ip6_output+0x1d3/0x4b0
[ 23.758379][ T24] ip6_output+0x1f8/0x4b0
[ 23.762689][ T24] ? asan.module_dtor+0x20/0x20
[ 23.767513][ T24] ? skb_dst+0x40/0x40
[ 23.771554][ T24] ? __rcu_read_lock+0x50/0x50
[ 23.776301][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 23.781471][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 23.787161][ T24] ? nf_hook_slow+0x150/0x1b0
[ 23.791813][ T24] NF_HOOK+0xdd/0x280
[ 23.795768][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 23.801373][ T24] ? NF_HOOK+0x280/0x280
[ 23.805588][ T24] ? __rcu_read_lock+0x50/0x50
[ 23.810325][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.816552][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 23.821375][ T24] ? memcpy+0x56/0x70
[ 23.825328][ T24] ndisc_send_skb+0x646/0x9f0
[ 23.829977][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 23.835158][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 23.840676][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 23.845600][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 23.851293][ T24] ? skb_put+0x11d/0x210
[ 23.855507][ T24] ndisc_send_rs+0x26c/0x360
[ 23.860074][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 23.865419][ T24] ? addrconf_dad_stop+0x430/0x430
[ 23.870500][ T24] ? __queue_delayed_work+0x16c/0x1f0
[ 23.875847][ T24] addrconf_dad_work+0x9c1/0x1520
[ 23.880844][ T24] ? __kasan_check_write+0x14/0x20
[ 23.885928][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 23.891619][ T24] ? __kasan_check_write+0x14/0x20
[ 23.896716][ T24] process_one_work+0x3ca/0x660
[ 23.901569][ T24] worker_thread+0x709/0xa20
[ 23.906138][ T24] ? __kthread_parkme+0x11b/0x150
[ 23.911156][ T24] kthread+0x389/0x3c0
[ 23.915206][ T24] ? pr_cont_work+0x110/0x110
[ 23.919860][ T24] ? __list_add+0xc0/0xc0
[ 23.924167][ T24] ret_from_fork+0x1f/0x30
[ 23.928603][ T24] ================================================================================
[ 23.937896][ T24] ================================================================================
[ 23.947283][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 23.955085][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 23.963406][ T24] for an object of type 'struct sk_buff'
[ 23.969022][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00370-gcf9be86ac40d #0
[ 23.978792][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.988837][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 23.994796][ T24] Call Trace:
[ 23.998066][ T24] dump_stack_lvl+0x1e2/0x24b
[ 24.002725][ T24] ? show_regs_print_info+0x18/0x18
[ 24.007904][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 24.013600][ T24] dump_stack+0x15/0x1d
[ 24.017735][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 24.023437][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 24.029401][ T24] wg_xmit+0x513/0xae0
[ 24.033451][ T24] ? wg_stop+0x5d0/0x5d0
[ 24.037680][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 24.043901][ T24] netdev_start_xmit+0x8a/0x160
[ 24.048732][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 24.053822][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 24.058822][ T24] ? dev_queue_xmit+0x20/0x20
[ 24.063481][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.069693][ T24] ? ndisc_constructor+0x690/0x8a0
[ 24.074785][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 24.079956][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 24.085041][ T24] ? dev_hard_header+0xdb/0xf0
[ 24.089781][ T24] dev_queue_xmit+0x17/0x20
[ 24.094259][ T24] neigh_connected_output+0x288/0x2b0
[ 24.099607][ T24] ip6_finish_output2+0xde2/0x1440
[ 24.104696][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.109441][ T24] ? __ip6_finish_output+0x520/0x520
[ 24.114711][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 24.120234][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.126450][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 24.131276][ T24] __ip6_finish_output+0x3e4/0x520
[ 24.136364][ T24] ip6_finish_output+0x3f/0x220
[ 24.141188][ T24] ? ip6_output+0x1d3/0x4b0
[ 24.145670][ T24] ip6_output+0x1f8/0x4b0
[ 24.149982][ T24] ? asan.module_dtor+0x20/0x20
[ 24.154808][ T24] ? skb_dst+0x40/0x40
[ 24.158852][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.163593][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 24.168784][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 24.174477][ T24] ? nf_hook_slow+0x150/0x1b0
[ 24.179129][ T24] NF_HOOK+0xdd/0x280
[ 24.183085][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 24.188713][ T24] ? NF_HOOK+0x280/0x280
[ 24.192930][ T24] ? __rcu_read_lock+0x50/0x50
[ 24.197671][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.203888][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 24.208720][ T24] ? memcpy+0x56/0x70
[ 24.212679][ T24] ndisc_send_skb+0x646/0x9f0
[ 24.217339][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 24.222513][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 24.228049][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 24.233055][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 24.238751][ T24] ? skb_put+0x11d/0x210
[ 24.242988][ T24] ndisc_send_rs+0x26c/0x360
[ 24.247566][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 24.252917][ T24] ? addrconf_dad_stop+0x430/0x430
[ 24.258007][ T24] ? __queue_delayed_work+0x16c/0x1f0
[ 24.263357][ T24] addrconf_dad_work+0x9c1/0x1520
[ 24.268362][ T24] ? __kasan_check_write+0x14/0x20
[ 24.273453][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 24.279152][ T24] ? __kasan_check_write+0x14/0x20
[ 24.284244][ T24] process_one_work+0x3ca/0x660
[ 24.289074][ T24] worker_thread+0x709/0xa20
[ 24.293644][ T24] ? __kthread_parkme+0x11b/0x150
[ 24.298648][ T24] kthread+0x389/0x3c0
2022/03/23 23:29:30 building call list...
[ 24.302694][ T24] ? pr_cont_work+0x110/0x110
[ 24.307356][ T24] ? __list_add+0xc0/0xc0
[ 24.311663][ T24] ret_from_fork+0x1f/0x30
[ 24.316101][ T24] ================================================================================
[ 24.331890][ T385] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 24.819749][ T9] device bridge_slave_1 left promiscuous mode
[ 24.826006][ T9] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.834341][ T9] device bridge_slave_0 left promiscuous mode
[ 24.840670][ T9] bridge0: port 1(bridge_slave_0) entered disabled state


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=125419bd700000


Tested on:

commit: cf9be86a ANDROID: GKI: 3/23/2022 KMI update
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=feec866d5b2cb66b

dashboard link: https://syzkaller.appspot.com/bug?extid=df538b53b7f9c1434eb9
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Tadeusz Struk]

On 3/23/22 06:44, syzbot wrote:

#syz dup: BUG: stack guard page was hit in file_open

--
Thanks,
Tadeusz