BUG: stack guard page was hit in file_open (7)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=14148367700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=49b0a775b189a484805d
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=173b9277700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14e18f5d700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+49b0a7...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc900009c7ff8 (stack is ffffc900009c8000..ffffc900009cffff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 375 Comm: syz-executor339 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kasan_check_range+0xc/0x2f0 mm/kasan/generic.c:185
Code: ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 41 56 41 55 41 54 <53> b0 01 48 85 f6 0f 84 09 02 00 00 48 89 fb 48 01 f3 0f 82 8a 02
RSP: 0018:ffffc900009c8000 EFLAGS: 00010246
RAX: ffff8881067f13c0 RBX: ffffc900009c80e0 RCX: ffffffff813415e4
RDX: 0000000000000001 RSI: 0000000000000060 RDI: ffffc900009c80e0
RBP: ffffc900009c8020 R08: dffffc0000000000 R09: ffffc900009c81c0
R10: fffff5200013903b R11: 0000000000000000 R12: ffff8881067f13c0
R13: ffffc900009c80e0 R14: 0000000000000000 R15: 0000000000000060
FS: 00007f47b4585700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009c7ff8 CR3: 000000011d5d9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
memset+0x23/0x40 mm/kasan/shadow.c:44
__unwind_start+0x34/0x420 arch/x86/kernel/unwind_frame.c:368
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xdc/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:121
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
kmem_cache_zalloc include/linux/slab.h:654 [inline]
__alloc_file+0x29/0x3b0 fs/file_table.c:101
alloc_empty_file+0xac/0x1b0 fs/file_table.c:151
dentry_open+0x4e/0x100 fs/open.c:956
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open fs/open.c:942 [inline]
dentry_open+0xb8/0x100 fs/open.c:958
file_open+0x2a3/0x650 fs/incfs/vfs.c:1427
do_dentry_open+0x7a5/0x1090 fs/open.c:819
vfs_open+0x73/0x80 fs/open.c:942
do_open fs/namei.c:3327 [inline]
path_openat+0x264d/0x3500 fs/namei.c:3444
do_filp_open+0x200/0x440 fs/namei.c:3471
do_sys_openat2+0x13b/0x470 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__x64_sys_openat+0x243/0x290 fs/open.c:1238
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f47b45b5ac4
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 e6 fb ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 18 fc ff ff 8b 44
RSP: 002b:00007f47b4585160 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f47b45856b8 RCX: 00007f47b45b5ac4
RDX: 0000000000010000 RSI: 00000000200000c0 RDI: 00000000ffffff9c
RBP: 00000000200000c0 R08: 0000000000000000 R09: 00007f47b4585700
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000010000
R13: 00007f47b467c3fc R14: 0030656c69662f2e R15: 6e656d6572636e69
Modules linked in:
---[ end trace b668cf96dd6526d0 ]---
RIP: 0010:kasan_check_range+0xc/0x2f0 mm/kasan/generic.c:185
Code: ef 02 31 c0 5d c3 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 41 57 41 56 41 55 41 54 <53> b0 01 48 85 f6 0f 84 09 02 00 00 48 89 fb 48 01 f3 0f 82 8a 02
RSP: 0018:ffffc900009c8000 EFLAGS: 00010246
RAX: ffff8881067f13c0 RBX: ffffc900009c80e0 RCX: ffffffff813415e4
RDX: 0000000000000001 RSI: 0000000000000060 RDI: ffffc900009c80e0
RBP: ffffc900009c8020 R08: dffffc0000000000 R09: ffffc900009c81c0
R10: fffff5200013903b R11: 0000000000000000 R12: ffff8881067f13c0
R13: ffffc900009c80e0 R14: 0000000000000000 R15: 0000000000000060
FS: 00007f47b4585700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc900009c7ff8 CR3: 000000011d5d9000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: ef out %eax,(%dx)
1: 02 31 add (%rcx),%dh
3: c0 5d c3 0f rcrb $0xf,-0x3d(%rbp)
7: 0b eb or %ebx,%ebp
9: 02 0f add (%rdi),%cl
b: 0b b8 ea ff ff ff or -0x16(%rax),%edi
11: 5d pop %rbp
12: c3 retq
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: 55 push %rbp
1f: 48 89 e5 mov %rsp,%rbp
22: 41 57 push %r15
24: 41 56 push %r14
26: 41 55 push %r13
28: 41 54 push %r12
* 2a: 53 push %rbx <-- trapping instruction
2b: b0 01 mov $0x1,%al
2d: 48 85 f6 test %rsi,%rsi
30: 0f 84 09 02 00 00 je 0x23f
36: 48 89 fb mov %rdi,%rbx
39: 48 01 f3 add %rsi,%rbx
3c: 0f .byte 0xf
3d: 82 (bad)
3e: 8a 02 mov (%rdx),%al


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================


syzkaller
syzkaller login: [ 5.284302][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 15.499163][ T23] kauditd_printk_skb: 60 callbacks suppressed
[ 15.499174][ T23] audit: type=1400 audit(1648509443.400:71): avc: denied { transition } for pid=311 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 15.506708][ T23] audit: type=1400 audit(1648509443.400:72): avc: denied { write } for pid=311 comm="sh" path="pipe:[11500]" dev="pipefs" ino=11500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[ 15.884153][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
[ 16.274095][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!!
[ 17.004232][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #280!!!
[ 17.154194][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
Warning: Permanently added '10.128.0.90' (ECDSA) to the list of known hosts.
2022/03/28 23:17:30 fuzzer started
2022/03/28 23:17:30 connecting to host at 10.128.0.163:39765
2022/03/28 23:17:30 checking machine...
2022/03/28 23:17:30 checking revisions...
2022/03/28 23:17:30 testing simple program...
[ 22.730344][ T23] audit: type=1400 audit(1648509450.630:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.747000][ T370] cgroup: Unknown subsys name 'net'
[ 22.753868][ T23] audit: type=1400 audit(1648509450.630:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.779893][ T23] audit: type=1400 audit(1648509450.630:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 22.780067][ T370] cgroup: Unknown subsys name 'devices'
[ 22.803131][ T23] audit: type=1400 audit(1648509450.630:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 22.831279][ T23] audit: type=1400 audit(1648509450.630:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 22.854423][ T23] audit: type=1400 audit(1648509450.630:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 22.878752][ T23] audit: type=1400 audit(1648509450.630:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 22.901121][ T23] audit: type=1400 audit(1648509450.660:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 23.015678][ T370] cgroup: Unknown subsys name 'hugetlb'
[ 23.021316][ T370] cgroup: Unknown subsys name 'rlimit'
[ 23.095045][ T23] audit: type=1400 audit(1648509451.000:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 23.129425][ T23] audit: type=1400 audit(1648509451.030:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 23.181572][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.189528][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.197317][ T373] device bridge_slave_0 entered promiscuous mode
[ 23.204323][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.211470][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.219022][ T373] device bridge_slave_1 entered promiscuous mode
[ 23.249188][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.256240][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.263706][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.270784][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.289286][ T24] bridge0: port 1(bridge_slave_0) entered disabled state
[ 23.297140][ T24] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.305505][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 23.313354][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 23.324846][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 23.334140][ T74] bridge0: port 1(bridge_slave_0) entered blocking state
[ 23.341264][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 23.348640][ T74] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 23.356859][ T74] bridge0: port 2(bridge_slave_1) entered blocking state
[ 23.363897][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 23.375418][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 23.394266][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 23.402584][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 23.411096][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 23.423003][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 23.434956][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 23.446668][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 23.456093][ T5] ================================================================================
[ 23.465424][ T5] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 23.473223][ T5] member access within address ffffc900000571c0 with insufficient space
[ 23.481576][ T5] for an object of type 'struct sk_buff'
[ 23.487232][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 23.496925][ T5] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.507383][ T5] Workqueue: ipv6_addrconf addrconf_dad_work
[ 23.513351][ T5] Call Trace:
[ 23.516621][ T5] dump_stack_lvl+0x1e2/0x24b
[ 23.521274][ T5] ? show_regs_print_info+0x18/0x18
[ 23.526460][ T5] ? wg_allowedips_lookup_dst+0x190/0x190
[ 23.532155][ T5] dump_stack+0x15/0x1d
[ 23.536299][ T5] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 23.541993][ T5] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 23.548298][ T5] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 23.554615][ T5] wg_xmit+0x4a2/0xae0
[ 23.558659][ T5] ? wg_stop+0x5d0/0x5d0
[ 23.562875][ T5] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 23.569090][ T5] netdev_start_xmit+0x8a/0x160
[ 23.573914][ T5] dev_hard_start_xmit+0x18d/0x2f0
[ 23.578997][ T5] __dev_queue_xmit+0x100c/0x1c30
[ 23.583993][ T5] ? dev_queue_xmit+0x20/0x20
[ 23.588643][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.594852][ T5] ? ndisc_constructor+0x690/0x8a0
[ 23.599936][ T5] ? _raw_write_unlock_bh+0x31/0x47
[ 23.605122][ T5] ? ___neigh_create+0x162d/0x1ab0
[ 23.610220][ T5] ? dev_hard_header+0xdb/0xf0
[ 23.614979][ T5] dev_queue_xmit+0x17/0x20
[ 23.619468][ T5] neigh_connected_output+0x288/0x2b0
[ 23.624816][ T5] ip6_finish_output2+0xde2/0x1440
[ 23.629915][ T5] ? __rcu_read_lock+0x50/0x50
[ 23.634661][ T5] ? __ip6_finish_output+0x520/0x520
[ 23.640445][ T5] ? dst_cow_metrics_generic+0x55/0x1d0
[ 23.645964][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.652177][ T5] ? ip6_skb_dst_mtu+0xaf/0x260
[ 23.657002][ T5] __ip6_finish_output+0x3e4/0x520
[ 23.662087][ T5] ip6_finish_output+0x3f/0x220
[ 23.666924][ T5] ? ip6_output+0x1d3/0x4b0
[ 23.671398][ T5] ip6_output+0x1f8/0x4b0
[ 23.675707][ T5] ? asan.module_dtor+0x20/0x20
[ 23.680543][ T5] ? skb_dst+0x40/0x40
[ 23.684586][ T5] ? __rcu_read_lock+0x50/0x50
[ 23.689324][ T5] ? selinux_ipv6_forward+0x50/0x50
[ 23.694498][ T5] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 23.700687][ T5] ? nf_hook_slow+0x150/0x1b0
[ 23.705514][ T5] NF_HOOK+0xdd/0x280
[ 23.709485][ T5] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 23.715095][ T5] ? NF_HOOK+0x280/0x280
[ 23.719318][ T5] ? __rcu_read_lock+0x50/0x50
[ 23.724230][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.730709][ T5] ? ndisc_send_skb+0x547/0x9f0
[ 23.735559][ T5] ? memcpy+0x56/0x70
[ 23.739514][ T5] ndisc_send_skb+0x646/0x9f0
[ 23.744252][ T5] ? slab_post_alloc_hook+0x90/0xa0
[ 23.749512][ T5] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 23.755046][ T5] ? skb_set_owner_w+0x1a8/0x310
[ 23.759994][ T5] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 23.765707][ T5] ? skb_put+0x11d/0x210
[ 23.770237][ T5] ndisc_send_rs+0x26c/0x360
[ 23.774823][ T5] addrconf_dad_completed+0x4f3/0x9f0
[ 23.780367][ T5] ? addrconf_dad_stop+0x430/0x430
[ 23.785597][ T5] ? mutex_unlock+0x34/0x40
[ 23.790198][ T5] addrconf_dad_work+0x9c1/0x1520
[ 23.795423][ T5] ? move_linked_works+0x118/0x130
[ 23.800529][ T5] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 23.806267][ T5] ? __kasan_check_write+0x14/0x20
[ 23.811360][ T5] process_one_work+0x3ca/0x660
[ 23.816196][ T5] worker_thread+0x709/0xa20
[ 23.820763][ T5] kthread+0x389/0x3c0
[ 23.824808][ T5] ? pr_cont_work+0x110/0x110
[ 23.829468][ T5] ? __list_add+0xc0/0xc0
[ 23.833786][ T5] ret_from_fork+0x1f/0x30
[ 23.838213][ T5] ================================================================================
[ 23.847522][ T5] ================================================================================
[ 23.856841][ T5] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 23.864582][ T5] member access within address ffffc900000571c0 with insufficient space
[ 23.872878][ T5] for an object of type 'struct sk_buff'
[ 23.878785][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 23.889123][ T5] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 23.899172][ T5] Workqueue: ipv6_addrconf addrconf_dad_work
[ 23.905136][ T5] Call Trace:
[ 23.908402][ T5] dump_stack_lvl+0x1e2/0x24b
[ 23.913053][ T5] ? show_regs_print_info+0x18/0x18
[ 23.918228][ T5] ? wg_allowedips_lookup_dst+0x190/0x190
[ 23.923923][ T5] dump_stack+0x15/0x1d
[ 23.928054][ T5] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 23.933745][ T5] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 23.939699][ T5] wg_xmit+0x513/0xae0
[ 23.943741][ T5] ? wg_stop+0x5d0/0x5d0
[ 23.947958][ T5] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 23.954186][ T5] netdev_start_xmit+0x8a/0x160
[ 23.959023][ T5] dev_hard_start_xmit+0x18d/0x2f0
[ 23.964202][ T5] __dev_queue_xmit+0x100c/0x1c30
[ 23.969216][ T5] ? dev_queue_xmit+0x20/0x20
[ 23.973967][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 23.980197][ T5] ? ndisc_constructor+0x690/0x8a0
[ 23.985283][ T5] ? _raw_write_unlock_bh+0x31/0x47
[ 23.990457][ T5] ? ___neigh_create+0x162d/0x1ab0
[ 23.995560][ T5] ? dev_hard_header+0xdb/0xf0
[ 24.000332][ T5] dev_queue_xmit+0x17/0x20
[ 24.004816][ T5] neigh_connected_output+0x288/0x2b0
[ 24.010195][ T5] ip6_finish_output2+0xde2/0x1440
[ 24.015301][ T5] ? __rcu_read_lock+0x50/0x50
[ 24.020065][ T5] ? __ip6_finish_output+0x520/0x520
[ 24.025326][ T5] ? dst_cow_metrics_generic+0x55/0x1d0
[ 24.030845][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.037056][ T5] ? ip6_skb_dst_mtu+0xaf/0x260
[ 24.041912][ T5] __ip6_finish_output+0x3e4/0x520
[ 24.046996][ T5] ip6_finish_output+0x3f/0x220
[ 24.051838][ T5] ? ip6_output+0x1d3/0x4b0
[ 24.057470][ T5] ip6_output+0x1f8/0x4b0
[ 24.061771][ T5] ? asan.module_dtor+0x20/0x20
[ 24.066595][ T5] ? skb_dst+0x40/0x40
[ 24.070636][ T5] ? __rcu_read_lock+0x50/0x50
[ 24.075386][ T5] ? selinux_ipv6_forward+0x50/0x50
[ 24.080557][ T5] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 24.086247][ T5] ? nf_hook_slow+0x150/0x1b0
[ 24.090918][ T5] NF_HOOK+0xdd/0x280
[ 24.094903][ T5] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 24.100522][ T5] ? NF_HOOK+0x280/0x280
[ 24.104757][ T5] ? __rcu_read_lock+0x50/0x50
[ 24.109503][ T5] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 24.115723][ T5] ? ndisc_send_skb+0x547/0x9f0
[ 24.120633][ T5] ? memcpy+0x56/0x70
[ 24.124591][ T5] ndisc_send_skb+0x646/0x9f0
[ 24.129247][ T5] ? slab_post_alloc_hook+0x90/0xa0
[ 24.134419][ T5] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 24.139939][ T5] ? skb_set_owner_w+0x1a8/0x310
[ 24.144857][ T5] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 24.150573][ T5] ? skb_put+0x11d/0x210
[ 24.154801][ T5] ndisc_send_rs+0x26c/0x360
[ 24.159480][ T5] addrconf_dad_completed+0x4f3/0x9f0
[ 24.164851][ T5] ? addrconf_dad_stop+0x430/0x430
[ 24.169956][ T5] ? mutex_unlock+0x34/0x40
[ 24.174435][ T5] addrconf_dad_work+0x9c1/0x1520
[ 24.179435][ T5] ? move_linked_works+0x118/0x130
[ 24.184538][ T5] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 24.190232][ T5] ? __kasan_check_write+0x14/0x20
[ 24.195423][ T5] process_one_work+0x3ca/0x660
2022/03/28 23:17:32 building call list...
[ 24.200334][ T5] worker_thread+0x709/0xa20
[ 24.204896][ T5] kthread+0x389/0x3c0
[ 24.208952][ T5] ? pr_cont_work+0x110/0x110
[ 24.213614][ T5] ? __list_add+0xc0/0xc0
[ 24.217932][ T5] ret_from_fork+0x1f/0x30
[ 24.222381][ T5] ================================================================================
[ 24.240117][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 24.694424][ T7] device bridge_slave_1 left promiscuous mode
[ 24.700596][ T7] bridge0: port 2(bridge_slave_1) entered disabled state
[ 24.708683][ T7] device bridge_slave_0 left promiscuous mode
[ 24.714994][ T7] bridge0: port 1(bridge_slave_0) entered disabled state


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=14b3aac3700000


Tested on:

commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa

dashboard link: https://syzkaller.appspot.com/bug?extid=49b0a775b189a484805d
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

[Tadeusz Struk]

#syz test: https://android.googlesource.com/kernel/common android13-5.10

=======================================
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif

struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );

__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}

@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}

void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}

/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))

+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+49b0a7...@syzkaller.appspotmail.com

Tested on:

commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..

git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=49b0a775b189a484805d
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

patch: https://syzkaller.appspot.com/x/patch.diff?x=11d4e6e7700000

Note: testing is done by a robot and is best-effort only.

[Tadeusz Struk]

On 3/27/22 10:17, syzbot wrote:

#syz dup: BUG: stack guard page was hit in file_open