BUG: stack guard page was hit in sys_lchown (3)

4 views
Skip to first unread message

syzbot

unread,
Mar 26, 2022, 5:04:27 PM3/26/22
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: ab2d1d40a128 Revert "vsock: each transport cycles only on ..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=1030321b700000
kernel config: https://syzkaller.appspot.com/x/.config?x=75791a4a1d0f0a62
dashboard link: https://syzkaller.appspot.com/bug?extid=1ab71039a2b30e77c213
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=131f8b93700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1245d425700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1ab710...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000bffff8 (stack is ffffc90000c00000..ffffc90000c07fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 365 Comm: syz-executor249 Not tainted 5.10.108-syzkaller-00653-gab2d1d40a128 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> f4 17 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc90000c00000 EFLAGS: 00010246
RAX: ffff8881079e62c0 RBX: 1ffff9200018001e RCX: ffffc90000c00090
RDX: 0000000000000000 RSI: ffff8881079e62c0 RDI: ffffc90000c00000
RBP: ffffc90000c00090 R08: dffffc0000000000 R09: ffffc90000c000e0
R10: fffff5200018001f R11: 0000000000000000 R12: ffff8881079e62c0
R13: ffffffff815bf690 R14: ffffc90000c000e0 R15: 0000000000000000
FS: 00005555567f3300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 000000011d08a000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:121
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xf3/0x1360 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x17f/0x2c0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_slow fs/namei.c:1645 [inline]
walk_component+0x516/0x790 fs/namei.c:1940
lookup_last fs/namei.c:2389 [inline]
path_lookupat+0x19d/0x6c0 fs/namei.c:2413
filename_lookup+0x23f/0x6c0 fs/namei.c:2446
user_path_at_empty+0x40/0x50 fs/namei.c:2726
user_path_at include/linux/namei.h:59 [inline]
do_fchownat+0xed/0x240 fs/open.c:699
__do_sys_lchown fs/open.c:730 [inline]
__se_sys_lchown fs/open.c:728 [inline]
__x64_sys_lchown+0x85/0x90 fs/open.c:728
do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5e7539f109
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9b68d628 EFLAGS: 00000246 ORIG_RAX: 000000000000005e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5e7539f109
RDX: 00000000ffffffff RSI: 00000000ffffffff RDI: 0000000020000180
RBP: 00007f5e753630f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5e75363180
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 912af7327b52b407 ]---
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> f4 17 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc90000c00000 EFLAGS: 00010246
RAX: ffff8881079e62c0 RBX: 1ffff9200018001e RCX: ffffc90000c00090
RDX: 0000000000000000 RSI: ffff8881079e62c0 RDI: ffffc90000c00000
RBP: ffffc90000c00090 R08: dffffc0000000000 R09: ffffc90000c000e0
R10: fffff5200018001f R11: 0000000000000000 R12: ffff8881079e62c0
R13: ffffffff815bf690 R14: ffffc90000c000e0 R15: 0000000000000000
FS: 00005555567f3300(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bffff8 CR3: 000000011d08a000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: eb 1b jmp 0x1d
2: 65 48 8b 04 25 80 6d mov %gs:0x26d80,%rax
9: 02 00
b: 4c 39 e0 cmp %r12,%rax
e: 74 0a je 0x1a
10: 49 8b 8c 24 98 0e 00 mov 0xe98(%r12),%rcx
17: 00
18: eb 03 jmp 0x1d
1a: 48 89 e9 mov %rbp,%rcx
1d: 48 8d bd 70 ff ff ff lea -0x90(%rbp),%rdi
24: 4c 89 e6 mov %r12,%rsi
27: 4c 89 fa mov %r15,%rdx
* 2a: e8 f4 17 06 00 callq 0x61823 <-- trapping instruction
2f: 83 bd 70 ff ff ff 00 cmpl $0x0,-0x90(%rbp)
36: 74 36 je 0x6e
38: 48 8d 9d 70 ff ff ff lea -0x90(%rbp),%rbx
3f: 0f .byte 0xf


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Tadeusz Struk

unread,
Mar 28, 2022, 12:21:45 PM3/28/22
to syzbot, syzkaller-a...@googlegroups.com
#syz test: https://android.googlesource.com/kernel/common android13-5.10

syzbot

unread,
Mar 28, 2022, 6:45:16 PM3/28/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,

syzbot tried to test the proposed patch but the build/boot failed:

_queue_before include/linux/skbuff.h:2039 [inline]
__skb_queue_tail include/linux/skbuff.h:2072 [inline]
wg_xmit+0x513/0xae0 drivers/net/wireguard/device.c:185
__netdev_start_xmit include/linux/netdevice.h:4831 [inline]
netdev_start_xmit+0x8a/0x160 include/linux/netdevice.h:4845
xmit_one net/core/dev.c:3591 [inline]
dev_hard_start_xmit+0x18d/0x2f0 net/core/dev.c:3607
__dev_queue_xmit+0x100c/0x1c30 net/core/dev.c:4173
dev_queue_xmit+0x17/0x20 net/core/dev.c:4206
neigh_connected_output+0x288/0x2b0 net/core/neighbour.c:1531
neigh_output include/net/neighbour.h:524 [inline]
ip6_finish_output2+0xde2/0x1440 net/ipv6/ip6_output.c:145
__ip6_finish_output+0x3e4/0x520 net/ipv6/ip6_output.c:210
ip6_finish_output+0x3f/0x220 net/ipv6/ip6_output.c:220
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip6_output+0x1f8/0x4b0 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:443 [inline]
NF_HOOK+0xdd/0x280 include/linux/netfilter.h:304
ndisc_send_skb+0x646/0x9f0 net/ipv6/ndisc.c:508
ndisc_send_rs+0x26c/0x360 net/ipv6/ndisc.c:702
addrconf_dad_completed+0x4f3/0x9f0 net/ipv6/addrconf.c:4241
addrconf_dad_work+0x9c1/0x1520
process_one_work+0x3ca/0x660 kernel/workqueue.c:2298
worker_thread+0x709/0xa20 kernel/workqueue.c:2444
kthread+0x389/0x3c0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30
================================================================================


Starting sshd: OK

syzkaller
syzkaller login: [ 4.893743][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
[ 13.581694][ T23] kauditd_printk_skb: 60 callbacks suppressed
[ 13.581702][ T23] audit: type=1400 audit(1648507455.600:71): avc: denied { transition } for pid=290 comm="sshd" path="/bin/sh" dev="sda1" ino=73 scontext=system_u:system_r:initrc_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 13.587548][ T23] audit: type=1400 audit(1648507455.610:72): avc: denied { write } for pid=290 comm="sh" path="pipe:[1424]" dev="pipefs" ino=1424 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:initrc_t tclass=fifo_file permissive=1
[ 14.193472][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!!
Warning: Permanently added '10.128.0.136' (ECDSA) to the list of known hosts.
2022/03/28 22:44:22 fuzzer started
2022/03/28 22:44:22 connecting to host at 10.128.0.163:35153
2022/03/28 22:44:22 checking machine...
2022/03/28 22:44:22 checking revisions...
2022/03/28 22:44:23 testing simple program...
[ 21.020445][ T23] audit: type=1400 audit(1648507463.040:73): avc: denied { getattr } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 21.036783][ T370] cgroup: Unknown subsys name 'net'
[ 21.045733][ T23] audit: type=1400 audit(1648507463.040:74): avc: denied { read } for pid=362 comm="syz-fuzzer" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 21.070263][ T370] cgroup: Unknown subsys name 'devices'
[ 21.070442][ T23] audit: type=1400 audit(1648507463.040:75): avc: denied { open } for pid=362 comm="syz-fuzzer" path="user:[4026531837]" dev="nsfs" ino=4026531837 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[ 21.099409][ T23] audit: type=1400 audit(1648507463.040:76): avc: denied { read } for pid=362 comm="syz-fuzzer" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 21.122719][ T23] audit: type=1400 audit(1648507463.040:77): avc: denied { open } for pid=362 comm="syz-fuzzer" path="/dev/raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 21.146446][ T23] audit: type=1400 audit(1648507463.040:78): avc: denied { mounton } for pid=370 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1136 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[ 21.169230][ T23] audit: type=1400 audit(1648507463.040:79): avc: denied { mount } for pid=370 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 21.191795][ T23] audit: type=1400 audit(1648507463.070:80): avc: denied { unmount } for pid=370 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[ 21.305237][ T370] cgroup: Unknown subsys name 'hugetlb'
[ 21.311190][ T370] cgroup: Unknown subsys name 'rlimit'
[ 21.404967][ T23] audit: type=1400 audit(1648507463.430:81): avc: denied { setattr } for pid=370 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=165 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[ 21.428306][ T23] audit: type=1400 audit(1648507463.430:82): avc: denied { execmem } for pid=372 comm="syz-executor.0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 21.478088][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.485206][ T373] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.492560][ T373] device bridge_slave_0 entered promiscuous mode
[ 21.499663][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.506877][ T373] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.514340][ T373] device bridge_slave_1 entered promiscuous mode
[ 21.546550][ T373] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.553810][ T373] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.561249][ T373] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.568286][ T373] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.586623][ T50] bridge0: port 1(bridge_slave_0) entered disabled state
[ 21.593856][ T50] bridge0: port 2(bridge_slave_1) entered disabled state
[ 21.601135][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 21.609323][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 21.622105][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 21.630612][ T50] bridge0: port 1(bridge_slave_0) entered blocking state
[ 21.637722][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 21.645773][ T50] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 21.654189][ T50] bridge0: port 2(bridge_slave_1) entered blocking state
[ 21.661286][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 21.671601][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 21.682185][ T24] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 21.694807][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 21.706404][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 21.720782][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 21.729848][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 21.742002][ T108] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 21.750702][ T24] ================================================================================
[ 21.760530][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:2039:28
[ 21.768418][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 21.776866][ T24] for an object of type 'struct sk_buff'
[ 21.782487][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 21.792394][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 21.802728][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 21.808779][ T24] Call Trace:
[ 21.812139][ T24] dump_stack_lvl+0x1e2/0x24b
[ 21.817888][ T24] ? show_regs_print_info+0x18/0x18
[ 21.823104][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 21.828831][ T24] dump_stack+0x15/0x1d
[ 21.833117][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 21.838846][ T24] ? __sanitizer_cov_trace_switch+0x74/0x90
[ 21.844930][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 21.851059][ T24] wg_xmit+0x4a2/0xae0
[ 21.855223][ T24] ? wg_stop+0x5d0/0x5d0
[ 21.859456][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 21.865686][ T24] netdev_start_xmit+0x8a/0x160
[ 21.870542][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 21.875635][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 21.880651][ T24] ? dev_queue_xmit+0x20/0x20
[ 21.885323][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.891554][ T24] ? ndisc_constructor+0x690/0x8a0
[ 21.896663][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 21.901854][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 21.906950][ T24] ? dev_hard_header+0xdb/0xf0
[ 21.912043][ T24] dev_queue_xmit+0x17/0x20
[ 21.916794][ T24] neigh_connected_output+0x288/0x2b0
[ 21.922153][ T24] ip6_finish_output2+0xde2/0x1440
[ 21.927258][ T24] ? __rcu_read_lock+0x50/0x50
[ 21.931998][ T24] ? __ip6_finish_output+0x520/0x520
[ 21.937274][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 21.942796][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 21.949043][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 21.954009][ T24] __ip6_finish_output+0x3e4/0x520
[ 21.959111][ T24] ip6_finish_output+0x3f/0x220
[ 21.963940][ T24] ? ip6_output+0x1d3/0x4b0
[ 21.968446][ T24] ip6_output+0x1f8/0x4b0
[ 21.972750][ T24] ? asan.module_dtor+0x20/0x20
[ 21.977577][ T24] ? skb_dst+0x40/0x40
[ 21.981620][ T24] ? __rcu_read_lock+0x50/0x50
[ 21.986357][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 21.991675][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 21.997812][ T24] ? nf_hook_slow+0x150/0x1b0
[ 22.002561][ T24] NF_HOOK+0xdd/0x280
[ 22.006659][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 22.012274][ T24] ? NF_HOOK+0x280/0x280
[ 22.016508][ T24] ? __rcu_read_lock+0x50/0x50
[ 22.021248][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.027462][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 22.032342][ T24] ? memcpy+0x56/0x70
[ 22.036442][ T24] ndisc_send_skb+0x646/0x9f0
[ 22.041228][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 22.046513][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 22.052056][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 22.057081][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 22.062880][ T24] ? skb_put+0x11d/0x210
[ 22.067099][ T24] ndisc_send_rs+0x26c/0x360
[ 22.071835][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 22.077204][ T24] ? addrconf_dad_stop+0x430/0x430
[ 22.082390][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 22.088123][ T24] addrconf_dad_work+0x9c1/0x1520
[ 22.093256][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 22.098973][ T24] ? __kasan_check_write+0x14/0x20
[ 22.104183][ T24] process_one_work+0x3ca/0x660
[ 22.109015][ T24] worker_thread+0x709/0xa20
[ 22.113587][ T24] ? __kthread_parkme+0x11b/0x150
[ 22.118635][ T24] kthread+0x389/0x3c0
[ 22.122696][ T24] ? pr_cont_work+0x110/0x110
[ 22.127427][ T24] ? __list_add+0xc0/0xc0
[ 22.131741][ T24] ret_from_fork+0x1f/0x30
[ 22.136197][ T24] ================================================================================
[ 22.145499][ T24] ================================================================================
[ 22.155184][ T24] UBSAN: object-size-mismatch in ./include/linux/skbuff.h:1932:2
[ 22.163010][ T24] member access within address ffffc9000019f1c0 with insufficient space
[ 22.171374][ T24] for an object of type 'struct sk_buff'
[ 22.177676][ T24] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 5.10.107-syzkaller-00420-gec7c9ea9d496 #0
[ 22.187632][ T24] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 22.197708][ T24] Workqueue: ipv6_addrconf addrconf_dad_work
[ 22.203683][ T24] Call Trace:
[ 22.206970][ T24] dump_stack_lvl+0x1e2/0x24b
[ 22.211632][ T24] ? show_regs_print_info+0x18/0x18
[ 22.216822][ T24] ? wg_allowedips_lookup_dst+0x190/0x190
[ 22.222538][ T24] dump_stack+0x15/0x1d
[ 22.226929][ T24] ubsan_type_mismatch_common+0x1ed/0x3a0
[ 22.232623][ T24] __ubsan_handle_type_mismatch_v1+0x5b/0x70
[ 22.238576][ T24] wg_xmit+0x513/0xae0
[ 22.242622][ T24] ? wg_stop+0x5d0/0x5d0
[ 22.247162][ T24] ? __sanitizer_cov_trace_const_cmp2+0x19/0x20
[ 22.253497][ T24] netdev_start_xmit+0x8a/0x160
[ 22.258365][ T24] dev_hard_start_xmit+0x18d/0x2f0
[ 22.263636][ T24] __dev_queue_xmit+0x100c/0x1c30
[ 22.269004][ T24] ? dev_queue_xmit+0x20/0x20
[ 22.273674][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.279907][ T24] ? ndisc_constructor+0x690/0x8a0
[ 22.285123][ T24] ? _raw_write_unlock_bh+0x31/0x47
[ 22.290433][ T24] ? ___neigh_create+0x162d/0x1ab0
[ 22.295620][ T24] ? dev_hard_header+0xdb/0xf0
[ 22.300394][ T24] dev_queue_xmit+0x17/0x20
[ 22.304893][ T24] neigh_connected_output+0x288/0x2b0
[ 22.310255][ T24] ip6_finish_output2+0xde2/0x1440
[ 22.318087][ T24] ? __rcu_read_lock+0x50/0x50
[ 22.322851][ T24] ? __ip6_finish_output+0x520/0x520
[ 22.328121][ T24] ? dst_cow_metrics_generic+0x55/0x1d0
[ 22.333760][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.339994][ T24] ? ip6_skb_dst_mtu+0xaf/0x260
[ 22.344827][ T24] __ip6_finish_output+0x3e4/0x520
[ 22.350044][ T24] ip6_finish_output+0x3f/0x220
[ 22.354868][ T24] ? ip6_output+0x1d3/0x4b0
[ 22.359434][ T24] ip6_output+0x1f8/0x4b0
[ 22.363749][ T24] ? asan.module_dtor+0x20/0x20
[ 22.368669][ T24] ? skb_dst+0x40/0x40
[ 22.372752][ T24] ? __rcu_read_lock+0x50/0x50
[ 22.377806][ T24] ? selinux_ipv6_forward+0x50/0x50
[ 22.382990][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 22.388715][ T24] ? nf_hook_slow+0x150/0x1b0
[ 22.393396][ T24] NF_HOOK+0xdd/0x280
[ 22.397358][ T24] ? addrconf_addr_solict_mult+0xe0/0xe0
[ 22.402986][ T24] ? NF_HOOK+0x280/0x280
[ 22.407205][ T24] ? __rcu_read_lock+0x50/0x50
[ 22.411958][ T24] ? __sanitizer_cov_trace_const_cmp4+0x19/0x20
[ 22.418248][ T24] ? ndisc_send_skb+0x547/0x9f0
[ 22.423236][ T24] ? memcpy+0x56/0x70
[ 22.427295][ T24] ndisc_send_skb+0x646/0x9f0
[ 22.432036][ T24] ? slab_post_alloc_hook+0x90/0xa0
[ 22.438025][ T24] ? ndisc_fill_addr_option+0x2f0/0x2f0
[ 22.443587][ T24] ? skb_set_owner_w+0x1a8/0x310
[ 22.448700][ T24] ? __sanitizer_cov_trace_cmp4+0x19/0x20
[ 22.454404][ T24] ? skb_put+0x11d/0x210
[ 22.458633][ T24] ndisc_send_rs+0x26c/0x360
[ 22.463386][ T24] addrconf_dad_completed+0x4f3/0x9f0
[ 22.468745][ T24] ? addrconf_dad_stop+0x430/0x430
[ 22.473851][ T24] ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 22.479694][ T24] addrconf_dad_work+0x9c1/0x1520
[ 22.484700][ T24] ? ipv6_use_optimistic_addr+0x1d0/0x1d0
[ 22.490404][ T24] ? __kasan_check_write+0x14/0x20
[ 22.495503][ T24] process_one_work+0x3ca/0x660
[ 22.500350][ T24] worker_thread+0x709/0xa20
[ 22.505455][ T24] ? __kthread_parkme+0x11b/0x150
[ 22.510622][ T24] kthread+0x389/0x3c0
[ 22.514698][ T24] ? pr_cont_work+0x110/0x110
[ 22.519359][ T24] ? __list_add+0xc0/0xc0
[ 22.523667][ T24] ret_from_fork+0x1f/0x30
[ 22.528120][ T24] ================================================================================
2022/03/28 22:44:24 building call list...
[ 22.544119][ T373] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation
[ 23.053666][ T177] device bridge_slave_1 left promiscuous mode
[ 23.063656][ T177] bridge0: port 2(bridge_slave_1) entered disabled state
[ 23.071382][ T177] device bridge_slave_0 left promiscuous mode
[ 23.078032][ T177] bridge0: port 1(bridge_slave_0) entered disabled state


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=10e7313b700000


Tested on:

commit: ec7c9ea9 ANDROID: Update the ABI representation
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=1ab71039a2b30e77c213
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

Tadeusz Struk

unread,
Mar 29, 2022, 6:23:16 PM3/29/22
to syzbot+1ab710...@syzkaller.appspotmail.com, syzkaller-a...@googlegroups.com, tadeus...@linaro.org
#syz test: https://android.googlesource.com/kernel/common android13-5.10

=======================================
index 3a02503b3637..76cc25bc140d 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -291,9 +291,11 @@ struct tc_skb_ext {
#endif

struct sk_buff_head {
+ struct_group_tagged(sk_buff_list, list,
/* These two members must be first. */
struct sk_buff *next;
struct sk_buff *prev;
+ );

__u32 qlen;
spinlock_t lock;
@@ -1929,8 +1931,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
*/
WRITE_ONCE(newsk->next, next);
WRITE_ONCE(newsk->prev, prev);
- WRITE_ONCE(next->prev, newsk);
- WRITE_ONCE(prev->next, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+ WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
WRITE_ONCE(list->qlen, list->qlen + 1);
}

@@ -2026,7 +2028,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
struct sk_buff *prev,
struct sk_buff *newsk)
{
- __skb_insert(newsk, prev, prev->next, list);
+ __skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
}

void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2036,7 +2038,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
struct sk_buff *next,
struct sk_buff *newsk)
{
- __skb_insert(newsk, next->prev, next, list);
+ __skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
}

/**
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 998a4ba28eba..938216f8ab7e 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -36,4 +36,52 @@ enum {
#define offsetofend(TYPE, MEMBER) \
(offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))

+/**
+ * struct_group() - Wrap a set of declarations in a mirrored struct
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members.
+ */
+#define struct_group(NAME, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, /* no attrs */, MEMBERS)
+
+/**
+ * struct_group_attr() - Create a struct_group() with trailing attributes
+ *
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes to apply
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes structure attributes argument.
+ */
+#define struct_group_attr(NAME, ATTRS, MEMBERS...) \
+ __struct_group(/* no tag */, NAME, ATTRS, MEMBERS)
+
+/**
+ * struct_group_tagged() - Create a struct_group with a reusable tag
+ *
+ * @TAG: The tag name for the named sub-struct
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical
+ * layout and size: one anonymous and one named. The former can be
+ * used normally without sub-struct naming, and the latter can be
+ * used to reason about the start, end, and size of the group of
+ * struct members. Includes struct tag argument for the named copy,
+ * so the specified layout can be reused later.
+ */
+#define struct_group_tagged(TAG, NAME, MEMBERS...) \
+ __struct_group(TAG, NAME, /* no attrs */, MEMBERS)
+
#endif
diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
index ee8220f8dcf5..22aa0e2177ea 100644
--- a/include/uapi/linux/stddef.h
+++ b/include/uapi/linux/stddef.h
@@ -4,3 +4,41 @@
#ifndef __always_inline
#define __always_inline inline
#endif
+
+/**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+ * @TAG: The tag name for the named sub-struct (usually empty)
+ * @NAME: The identifier name of the mirrored sub-struct
+ * @ATTRS: Any struct attributes (usually empty)
+ * @MEMBERS: The member declarations for the mirrored structs
+ *
+ * Used to create an anonymous union of two structs with identical layout
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+ * The named struct can also be explicitly tagged for layer reuse, as well
+ * as both having struct attributes appended.
+ */
+#define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+ struct TAG { MEMBERS } ATTRS NAME; \
+ }
+
+/**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+ *
+ * @TYPE: The type of each flexible array element
+ * @NAME: The name of the flexible array member
+ *
+ * In order to have a flexible array member in a union or alone in a
+ * struct, it needs to be wrapped in an anonymous struct with at least 1
+ * named member, but that member can be empty.
+ */
+#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
+ struct { \
+ struct { } __empty_ ## NAME; \
+ TYPE NAME[]; \
+ }
+
--
2.35.1

syzbot

unread,
Mar 29, 2022, 6:36:08 PM3/29/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+1ab710...@syzkaller.appspotmail.com

Tested on:

commit: e69c61cf ANDROID: KVM: arm64: iommu: Create parent/chi..
git tree: https://android.googlesource.com/kernel/common android13-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=c49accf4224b02fa
dashboard link: https://syzkaller.appspot.com/bug?extid=1ab71039a2b30e77c213
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1087f305700000

Note: testing is done by a robot and is best-effort only.

Tadeusz Struk

unread,
Mar 30, 2022, 1:24:36 PM3/30/22
to syzbot, syzkaller-a...@googlegroups.com
On 3/26/22 14:04, syzbot wrote:
#syz dup: BUG: stack guard page was hit in file_open

Tadeusz Struk

unread,
Mar 30, 2022, 1:25:16 PM3/30/22
to syzbot, syzkaller-a...@googlegroups.com
On 3/26/22 14:04, syzbot wrote:
#syz dup: BUG: stack guard page was hit in file_open
Reply all
Reply to author
Forward
0 new messages