BUG: stack guard page was hit in sys_mount (3)

0 views
Skip to first unread message

syzbot

unread,
Apr 7, 2022, 4:09:24 PM4/7/22
to syzkaller-a...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 414e6c8e941c ANDROID: fix up abi issue with struct snd_pcm..
git tree: android12-5.10-lts
console output: https://syzkaller.appspot.com/x/log.txt?x=127d8680f00000
kernel config: https://syzkaller.appspot.com/x/.config?x=19b81eb0d2d939d9
dashboard link: https://syzkaller.appspot.com/bug?extid=5f36cbea6967c2a250e7
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10d50018f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=157c962f700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5f36cb...@syzkaller.appspotmail.com

BUG: stack guard page was hit at ffffc90000bafff8 (stack is ffffc90000bb0000..ffffc90000bb7fff)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 379 Comm: syz-executor129 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> 94 27 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc90000bb0000 EFLAGS: 00010246
RAX: ffff88811d5cbb40 RBX: 1ffff9200017601e RCX: ffffc90000bb0090
RDX: 0000000000000000 RSI: ffff88811d5cbb40 RDI: ffffc90000bb0000
RBP: ffffc90000bb0090 R08: dffffc0000000000 R09: ffffc90000bb0190
R10: 0000000000000002 R11: 0000000000000000 R12: ffff88811d5cbb40
R13: ffffffff815b5630 R14: ffffc90000bb00e0 R15: 0000000000000000
FS: 00007fcef6116700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bafff8 CR3: 0000000106f93000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
stack_trace_save+0x12d/0x1f0 kernel/stacktrace.c:121
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:428 [inline]
__kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:583 [inline]
slab_alloc_node mm/slub.c:2956 [inline]
slab_alloc mm/slub.c:2964 [inline]
kmem_cache_alloc+0x16c/0x300 mm/slub.c:2969
__d_alloc+0x2d/0x6b0 fs/dcache.c:1709
d_alloc fs/dcache.c:1788 [inline]
d_alloc_parallel+0xe6/0x1330 fs/dcache.c:2540
__lookup_slow+0x14e/0x400 fs/namei.c:1613
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_one_len+0x43d/0x6a0 fs/namei.c:2642
incfs_lookup_dentry+0x5f/0xb0 fs/incfs/data_mgmt.c:211
dir_lookup+0x3b8/0x6e0 fs/incfs/vfs.c:967
__lookup_slow+0x2b3/0x400 fs/namei.c:1628
lookup_slow+0x5a/0x80 fs/namei.c:1645
walk_component+0x425/0x5a0 fs/namei.c:1940
lookup_last fs/namei.c:2389 [inline]
path_lookupat+0x18d/0x460 fs/namei.c:2413
filename_lookup+0x23f/0x6c0 fs/namei.c:2446
user_path_at_empty+0x40/0x50 fs/namei.c:2726
user_path_at include/linux/namei.h:59 [inline]
do_mount fs/namespace.c:3239 [inline]
__do_sys_mount fs/namespace.c:3450 [inline]
__se_sys_mount+0x293/0x3c0 fs/namespace.c:3427
__x64_sys_mount+0xbf/0xd0 fs/namespace.c:3427
do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fcef6164979
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcef61162f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000001d RCX: 00007fcef6164979
RDX: 0000000020000200 RSI: 0000000020000040 RDI: 0000000020000080
RBP: 00007fcef61ec3e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcef61ec3e0
R13: 00007fcef61ec3ec R14: 0030656c69662f2e R15: 6e656d6572636e69
Modules linked in:
---[ end trace 1af5b5a074c8756b ]---
RIP: 0010:unwind_start arch/x86/include/asm/unwind.h:60 [inline]
RIP: 0010:arch_stack_walk+0xd7/0x140 arch/x86/kernel/stacktrace.c:24
Code: eb 1b 65 48 8b 04 25 80 6d 02 00 4c 39 e0 74 0a 49 8b 8c 24 98 0e 00 00 eb 03 48 89 e9 48 8d bd 70 ff ff ff 4c 89 e6 4c 89 fa <e8> 94 27 06 00 83 bd 70 ff ff ff 00 74 36 48 8d 9d 70 ff ff ff 0f
RSP: 0018:ffffc90000bb0000 EFLAGS: 00010246
RAX: ffff88811d5cbb40 RBX: 1ffff9200017601e RCX: ffffc90000bb0090
RDX: 0000000000000000 RSI: ffff88811d5cbb40 RDI: ffffc90000bb0000
RBP: ffffc90000bb0090 R08: dffffc0000000000 R09: ffffc90000bb0190
R10: 0000000000000002 R11: 0000000000000000 R12: ffff88811d5cbb40
R13: ffffffff815b5630 R14: ffffc90000bb00e0 R15: 0000000000000000
FS: 00007fcef6116700(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000bafff8 CR3: 0000000106f93000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: eb 1b jmp 0x1d
2: 65 48 8b 04 25 80 6d mov %gs:0x26d80,%rax
9: 02 00
b: 4c 39 e0 cmp %r12,%rax
e: 74 0a je 0x1a
10: 49 8b 8c 24 98 0e 00 mov 0xe98(%r12),%rcx
17: 00
18: eb 03 jmp 0x1d
1a: 48 89 e9 mov %rbp,%rcx
1d: 48 8d bd 70 ff ff ff lea -0x90(%rbp),%rdi
24: 4c 89 e6 mov %r12,%rsi
27: 4c 89 fa mov %r15,%rdx
* 2a: e8 94 27 06 00 callq 0x627c3 <-- trapping instruction
2f: 83 bd 70 ff ff ff 00 cmpl $0x0,-0x90(%rbp)
36: 74 36 je 0x6e
38: 48 8d 9d 70 ff ff ff lea -0x90(%rbp),%rbx
3f: 0f .byte 0xf


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Tadeusz Struk

unread,
Apr 7, 2022, 4:14:53 PM4/7/22
to syzbot, syzkaller-a...@googlegroups.com
#syz test: https://android.googlesource.com/kernel/common android12-5.10

syzbot

unread,
Apr 7, 2022, 8:11:08 PM4/7/22
to syzkaller-a...@googlegroups.com, tadeus...@linaro.org
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+5f36cb...@syzkaller.appspotmail.com

Tested on:

commit: 3c06a5ce ANDROID: Split ANDROID_STRUCT_PADDING into se..
git tree: https://android.googlesource.com/kernel/common android12-5.10
kernel config: https://syzkaller.appspot.com/x/.config?x=97fcf0b9b4761f62
dashboard link: https://syzkaller.appspot.com/bug?extid=5f36cbea6967c2a250e7
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

Tadeusz Struk

unread,
Apr 8, 2022, 10:40:37 AM4/8/22
to syzbot, syzkaller-a...@googlegroups.com
#syz dup: BUG: stack guard page was hit in file_open
Reply all
Reply to author
Forward
0 new messages