[syzbot] [block?] [virt?] kernel panic: corrupted stack end in kernel_init (2)
6 views
Skip to first unread message
syzbot
Sep 15, 2024, 1:50:26 AMSep 15
to ak...@linux-foundation.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, syzkall...@googlegroups.com, virtual...@lists.linux.dev
Hello,
syzbot found the following issue on:
HEAD commit: 1ff95eb2bebd riscv: Fix RISCV_ALTERNATIVE_EARLY
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=172cb0a9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c79e90d7b2f5b364
dashboard link: https://syzkaller.appspot.com/bug?extid=ec17b78de14721dd3bdc
compiler: riscv64-linux-gnu-gcc (Debian 12.2.0-13) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: riscv64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-1ff95eb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1491182abe4e/vmlinux-1ff95eb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/926302c5c645/Image-1ff95eb2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec17b7...@syzkaller.appspotmail.com
Registered RDS/tcp transport
NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
NET: Registered PF_VSOCK protocol family
registered taskstats version 1
Loading compiled-in X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: f2a59455c4296818b28c73c1d87b1152c8ec3b9d'
zswap: loaded using pool 842/z3fold
Demotion targets for Node 0: null
debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
Key type .fscrypt registered
Key type fscrypt-provisioning registered
Key type big_key registered
Key type encrypted registered
AppArmor: AppArmor sha256 policy hashing enabled
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: f2a59455c4296818b28c73c1d87b1152c8ec3b9d'
ima: Allocated hash algorithm: sha256
ima: No architecture policies found
evm: Initialising EVM extended attributes:
evm: security.selinux (disabled)
evm: security.SMACK64 (disabled)
evm: security.SMACK64EXEC (disabled)
evm: security.SMACK64TRANSMUTE (disabled)
evm: security.SMACK64MMAP (disabled)
evm: security.apparmor
evm: security.ima
evm: security.capability
evm: HMAC attrs: 0x1
printk: legacy console [netcon0] enabled
netconsole: network logging started
gtp: GTP module loaded (pdp ctx size 128 bytes)
rdma_rxe: loaded
clk: Disabling unused clocks
PM: genpd: Disabling unused power domains
ALSA device list:
#0: Dummy 1
#1: Loopback 1
#2: Virtual MIDI Card 1
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
EXT4-fs (vda): mounted filesystem 34b94c48-234b-4869-b990-1f782e29954a ro with ordered data mode. Quota mode: none.
VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
devtmpfs: mounted
Freeing unused kernel image (initmem) memory: 2532K
Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
Run /sbin/init as init process
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.11.0-rc2-syzkaller-g1ff95eb2bebd #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff80010216>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:130
[<ffffffff85edbc4e>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:136
[<ffffffff85f3714c>] __dump_stack lib/dump_stack.c:93 [inline]
[<ffffffff85f3714c>] dump_stack_lvl+0x108/0x196 lib/dump_stack.c:119
[<ffffffff85f371f6>] dump_stack+0x1c/0x24 lib/dump_stack.c:128
[<ffffffff85edc812>] panic+0x388/0x806 kernel/panic.c:348
[<ffffffff85f4533a>] schedule_debug kernel/sched/core.c:5745 [inline]
[<ffffffff85f4533a>] __schedule+0x3230/0x3288 kernel/sched/core.c:6411
[<ffffffff85f45a4c>] preempt_schedule_notrace+0xe0/0x2be kernel/sched/core.c:6801
[<ffffffff85f39cc0>] lockdep_enabled kernel/locking/lockdep.c:118 [inline]
[<ffffffff85f39cc0>] lock_is_held_type+0x7a/0x1f2 kernel/locking/lockdep.c:5824
[<ffffffff816b51d8>] lock_is_held include/linux/lockdep.h:249 [inline]
[<ffffffff816b51d8>] depot_fetch_stack+0x86/0xc8 lib/stackdepot.c:448
[<ffffffff816b5e7e>] __stack_depot_get_stack_record+0xe/0x1e lib/stackdepot.c:688
[<ffffffff809774ee>] inc_stack_record_count mm/page_owner.c:197 [inline]
[<ffffffff809774ee>] __set_page_owner+0x2fe/0x70c mm/page_owner.c:329
[<ffffffff8087cbf6>] set_page_owner include/linux/page_owner.h:32 [inline]
[<ffffffff8087cbf6>] post_alloc_hook+0xea/0x1e2 mm/page_alloc.c:1493
[<ffffffff80883c0a>] prep_new_page mm/page_alloc.c:1501 [inline]
[<ffffffff80883c0a>] get_page_from_freelist+0x123c/0x27e8 mm/page_alloc.c:3442
[<ffffffff80885ec6>] __alloc_pages_noprof+0x1f0/0x2142 mm/page_alloc.c:4700
[<ffffffff809079f2>] alloc_pages_mpol_noprof+0xf8/0x48a mm/mempolicy.c:2263
[<ffffffff80907ef8>] alloc_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2343
[<ffffffff80908098>] folio_alloc_noprof+0x24/0x6c mm/mempolicy.c:2350
[<ffffffff806bd12c>] filemap_alloc_folio_noprof+0x348/0x44e mm/filemap.c:1008
[<ffffffff806fa3ae>] page_cache_ra_unbounded+0x17c/0x4e6 mm/readahead.c:248
[<ffffffff806fa808>] do_page_cache_ra+0xf0/0x134 mm/readahead.c:303
[<ffffffff806fb2fe>] page_cache_ra_order+0xe8/0x17a mm/readahead.c:488
[<ffffffff806fc28c>] page_cache_async_ra+0x51c/0x7c2 mm/readahead.c:638
[<ffffffff806cb988>] filemap_readahead mm/filemap.c:2504 [inline]
[<ffffffff806cb988>] filemap_get_pages+0x310/0x1628 mm/filemap.c:2545
[<ffffffff806ccfee>] filemap_read+0x34e/0xc30 mm/filemap.c:2625
[<ffffffff806cdb66>] generic_file_read_iter+0x296/0x38a mm/filemap.c:2806
[<ffffffff80d323a6>] ext4_file_read_iter fs/ext4/file.c:147 [inline]
[<ffffffff80d323a6>] ext4_file_read_iter+0x15e/0x400 fs/ext4/file.c:130
[<ffffffff809df5c8>] __kernel_read+0x302/0x886 fs/read_write.c:434
[<ffffffff810b71ce>] integrity_kernel_read+0x92/0xc4 security/integrity/iint.c:28
[<ffffffff810c1224>] ima_calc_file_hash_tfm+0x2da/0x3ec security/integrity/ima/ima_crypto.c:480
[<ffffffff810c2b90>] ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
[<ffffffff810c2b90>] ima_calc_file_hash+0x19e/0x456 security/integrity/ima/ima_crypto.c:568
[<ffffffff810c4c98>] ima_collect_measurement+0x7b4/0x918 security/integrity/ima/ima_api.c:293
[<ffffffff810bd664>] process_measurement+0x10e4/0x2026 security/integrity/ima/ima_main.c:372
[<ffffffff810beb44>] ima_file_mmap+0x1be/0x1de security/integrity/ima/ima_main.c:462
[<ffffffff80feef5a>] security_mmap_file+0x102/0x184 security/security.c:2860
[<ffffffff8076b28c>] vm_mmap_pgoff+0xd2/0x310 mm/util.c:584
[<ffffffff8076b54e>] vm_mmap+0x84/0xac mm/util.c:607
[<ffffffff80b83f8a>] elf_map fs/binfmt_elf.c:381 [inline]
[<ffffffff80b83f8a>] elf_load+0x186/0x716 fs/binfmt_elf.c:408
[<ffffffff80b878dc>] load_elf_interp fs/binfmt_elf.c:675 [inline]
[<ffffffff80b878dc>] load_elf_binary+0x33c2/0x4c1e fs/binfmt_elf.c:1235
[<ffffffff809fa6b0>] search_binary_handler fs/exec.c:1821 [inline]
[<ffffffff809fa6b0>] exec_binprm fs/exec.c:1863 [inline]
[<ffffffff809fa6b0>] bprm_execve fs/exec.c:1914 [inline]
[<ffffffff809fa6b0>] bprm_execve+0x744/0x18a4 fs/exec.c:1890
[<ffffffff809fe1e2>] kernel_execve+0x2c8/0x378 fs/exec.c:2081
[<ffffffff85edace4>] run_init_process+0x194/0x1a8 init/main.c:1388
[<ffffffff85edad16>] try_to_run_init_process+0x1e/0x66 init/main.c:1395
[<ffffffff85f3cf60>] kernel_init+0x180/0x224 init/main.c:1523
[<ffffffff85f5b972>] ret_from_fork+0xe/0x1c arch/riscv/kernel/entry.S:239
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 1ff95eb2bebd riscv: Fix RISCV_ALTERNATIVE_EARLY
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=172cb0a9980000
kernel config: https://syzkaller.appspot.com/x/.config?x=c79e90d7b2f5b364
dashboard link: https://syzkaller.appspot.com/bug?extid=ec17b78de14721dd3bdc
compiler: riscv64-linux-gnu-gcc (Debian 12.2.0-13) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: riscv64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-1ff95eb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1491182abe4e/vmlinux-1ff95eb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/926302c5c645/Image-1ff95eb2.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec17b7...@syzkaller.appspotmail.com
Registered RDS/tcp transport
NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
NET: Registered PF_VSOCK protocol family
registered taskstats version 1
Loading compiled-in X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: f2a59455c4296818b28c73c1d87b1152c8ec3b9d'
zswap: loaded using pool 842/z3fold
Demotion targets for Node 0: null
debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
Key type .fscrypt registered
Key type fscrypt-provisioning registered
Key type big_key registered
Key type encrypted registered
AppArmor: AppArmor sha256 policy hashing enabled
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: f2a59455c4296818b28c73c1d87b1152c8ec3b9d'
ima: Allocated hash algorithm: sha256
ima: No architecture policies found
evm: Initialising EVM extended attributes:
evm: security.selinux (disabled)
evm: security.SMACK64 (disabled)
evm: security.SMACK64EXEC (disabled)
evm: security.SMACK64TRANSMUTE (disabled)
evm: security.SMACK64MMAP (disabled)
evm: security.apparmor
evm: security.ima
evm: security.capability
evm: HMAC attrs: 0x1
printk: legacy console [netcon0] enabled
netconsole: network logging started
gtp: GTP module loaded (pdp ctx size 128 bytes)
rdma_rxe: loaded
clk: Disabling unused clocks
PM: genpd: Disabling unused power domains
ALSA device list:
#0: Dummy 1
#1: Loopback 1
#2: Virtual MIDI Card 1
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
EXT4-fs (vda): mounted filesystem 34b94c48-234b-4869-b990-1f782e29954a ro with ordered data mode. Quota mode: none.
VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
devtmpfs: mounted
Freeing unused kernel image (initmem) memory: 2532K
Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
Run /sbin/init as init process
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 UID: 0 PID: 1 Comm: init Not tainted 6.11.0-rc2-syzkaller-g1ff95eb2bebd #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff80010216>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:130
[<ffffffff85edbc4e>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:136
[<ffffffff85f3714c>] __dump_stack lib/dump_stack.c:93 [inline]
[<ffffffff85f3714c>] dump_stack_lvl+0x108/0x196 lib/dump_stack.c:119
[<ffffffff85f371f6>] dump_stack+0x1c/0x24 lib/dump_stack.c:128
[<ffffffff85edc812>] panic+0x388/0x806 kernel/panic.c:348
[<ffffffff85f4533a>] schedule_debug kernel/sched/core.c:5745 [inline]
[<ffffffff85f4533a>] __schedule+0x3230/0x3288 kernel/sched/core.c:6411
[<ffffffff85f45a4c>] preempt_schedule_notrace+0xe0/0x2be kernel/sched/core.c:6801
[<ffffffff85f39cc0>] lockdep_enabled kernel/locking/lockdep.c:118 [inline]
[<ffffffff85f39cc0>] lock_is_held_type+0x7a/0x1f2 kernel/locking/lockdep.c:5824
[<ffffffff816b51d8>] lock_is_held include/linux/lockdep.h:249 [inline]
[<ffffffff816b51d8>] depot_fetch_stack+0x86/0xc8 lib/stackdepot.c:448
[<ffffffff816b5e7e>] __stack_depot_get_stack_record+0xe/0x1e lib/stackdepot.c:688
[<ffffffff809774ee>] inc_stack_record_count mm/page_owner.c:197 [inline]
[<ffffffff809774ee>] __set_page_owner+0x2fe/0x70c mm/page_owner.c:329
[<ffffffff8087cbf6>] set_page_owner include/linux/page_owner.h:32 [inline]
[<ffffffff8087cbf6>] post_alloc_hook+0xea/0x1e2 mm/page_alloc.c:1493
[<ffffffff80883c0a>] prep_new_page mm/page_alloc.c:1501 [inline]
[<ffffffff80883c0a>] get_page_from_freelist+0x123c/0x27e8 mm/page_alloc.c:3442
[<ffffffff80885ec6>] __alloc_pages_noprof+0x1f0/0x2142 mm/page_alloc.c:4700
[<ffffffff809079f2>] alloc_pages_mpol_noprof+0xf8/0x48a mm/mempolicy.c:2263
[<ffffffff80907ef8>] alloc_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2343
[<ffffffff80908098>] folio_alloc_noprof+0x24/0x6c mm/mempolicy.c:2350
[<ffffffff806bd12c>] filemap_alloc_folio_noprof+0x348/0x44e mm/filemap.c:1008
[<ffffffff806fa3ae>] page_cache_ra_unbounded+0x17c/0x4e6 mm/readahead.c:248
[<ffffffff806fa808>] do_page_cache_ra+0xf0/0x134 mm/readahead.c:303
[<ffffffff806fb2fe>] page_cache_ra_order+0xe8/0x17a mm/readahead.c:488
[<ffffffff806fc28c>] page_cache_async_ra+0x51c/0x7c2 mm/readahead.c:638
[<ffffffff806cb988>] filemap_readahead mm/filemap.c:2504 [inline]
[<ffffffff806cb988>] filemap_get_pages+0x310/0x1628 mm/filemap.c:2545
[<ffffffff806ccfee>] filemap_read+0x34e/0xc30 mm/filemap.c:2625
[<ffffffff806cdb66>] generic_file_read_iter+0x296/0x38a mm/filemap.c:2806
[<ffffffff80d323a6>] ext4_file_read_iter fs/ext4/file.c:147 [inline]
[<ffffffff80d323a6>] ext4_file_read_iter+0x15e/0x400 fs/ext4/file.c:130
[<ffffffff809df5c8>] __kernel_read+0x302/0x886 fs/read_write.c:434
[<ffffffff810b71ce>] integrity_kernel_read+0x92/0xc4 security/integrity/iint.c:28
[<ffffffff810c1224>] ima_calc_file_hash_tfm+0x2da/0x3ec security/integrity/ima/ima_crypto.c:480
[<ffffffff810c2b90>] ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
[<ffffffff810c2b90>] ima_calc_file_hash+0x19e/0x456 security/integrity/ima/ima_crypto.c:568
[<ffffffff810c4c98>] ima_collect_measurement+0x7b4/0x918 security/integrity/ima/ima_api.c:293
[<ffffffff810bd664>] process_measurement+0x10e4/0x2026 security/integrity/ima/ima_main.c:372
[<ffffffff810beb44>] ima_file_mmap+0x1be/0x1de security/integrity/ima/ima_main.c:462
[<ffffffff80feef5a>] security_mmap_file+0x102/0x184 security/security.c:2860
[<ffffffff8076b28c>] vm_mmap_pgoff+0xd2/0x310 mm/util.c:584
[<ffffffff8076b54e>] vm_mmap+0x84/0xac mm/util.c:607
[<ffffffff80b83f8a>] elf_map fs/binfmt_elf.c:381 [inline]
[<ffffffff80b83f8a>] elf_load+0x186/0x716 fs/binfmt_elf.c:408
[<ffffffff80b878dc>] load_elf_interp fs/binfmt_elf.c:675 [inline]
[<ffffffff80b878dc>] load_elf_binary+0x33c2/0x4c1e fs/binfmt_elf.c:1235
[<ffffffff809fa6b0>] search_binary_handler fs/exec.c:1821 [inline]
[<ffffffff809fa6b0>] exec_binprm fs/exec.c:1863 [inline]
[<ffffffff809fa6b0>] bprm_execve fs/exec.c:1914 [inline]
[<ffffffff809fa6b0>] bprm_execve+0x744/0x18a4 fs/exec.c:1890
[<ffffffff809fe1e2>] kernel_execve+0x2c8/0x378 fs/exec.c:2081
[<ffffffff85edace4>] run_init_process+0x194/0x1a8 init/main.c:1388
[<ffffffff85edad16>] try_to_run_init_process+0x1e/0x66 init/main.c:1395
[<ffffffff85f3cf60>] kernel_init+0x180/0x224 init/main.c:1523
[<ffffffff85f5b972>] ret_from_fork+0xe/0x1c arch/riscv/kernel/entry.S:239
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Sep 24, 2024, 6:00:31 AMSep 24
to ak...@linux-foundation.org, almaz.ale...@paragon-software.com, ar...@kernel.org, linux...@vger.kernel.org, linu...@vger.kernel.org, linux-...@vger.kernel.org, linu...@kvack.org, nt...@lists.linux.dev, syzkall...@googlegroups.com, virtual...@lists.linux.dev
syzbot has found a reproducer for the following issue on:
HEAD commit: 5f5673607153 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1298499f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=dedbcb1ff4387972
dashboard link: https://syzkaller.appspot.com/bug?extid=ec17b78de14721dd3bdc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11323107980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/40172aed5414/disk-5f567360.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/58372f305e9d/vmlinux-5f567360.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d2aae6fa798f/Image-5f567360.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/33ba6e22aaa5/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec17b7...@syzkaller.appspotmail.com
x8 : 8f1719b15e27f800 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000000
x2 : ffff0000d7975ac0 x1 : 0000000000000000 x0 : ffff800080872848
Kernel panic - not syncing: kernel stack overflow
CPU: 1 UID: 0 PID: 16523 Comm: syz.3.4916 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
panic+0x300/0x884 kernel/panic.c:354
nmi_panic+0x11c/0x23c kernel/panic.c:205
panic_bad_stack+0x200/0x28c arch/arm64/kernel/traps.c:917
enter_from_kernel_mode+0x0/0x74 arch/arm64/kernel/entry-common.c:928
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:566
el1h_64_sync+0x0/0x68 arch/arm64/kernel/entry.S:591
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x10,00000207,00200128,42017203
Memory Limit: none
================================
WARNING: inconsistent lock state
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.3.4916/16523 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff800091c892b8 ((efivars_lock).lock){....}-{2:2}, at: down_trylock+0x28/0xd8 kernel/locking/semaphore.c:139
{INITIAL USE} state was registered at:
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
down_interruptible+0x3c/0xfc kernel/locking/semaphore.c:83
efivars_register+0x2c/0x10c drivers/firmware/efi/vars.c:68
generic_ops_register drivers/firmware/efi/efi.c:229 [inline]
efisubsys_init+0x414/0x5f8 drivers/firmware/efi/efi.c:433
do_one_initcall+0x24c/0x9c0 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 10106
hardirqs last enabled at (10105): [<ffff80008b3388f8>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
hardirqs last enabled at (10105): [<ffff80008b3388f8>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
hardirqs last disabled at (10106): [<ffff80008b42e1b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (10106): [<ffff80008b42e1b4>] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:170
softirqs last enabled at (8930): [<ffff8000800307f8>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (8928): [<ffff8000800307c4>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((efivars_lock).lock);
<Interrupt>
lock((efivars_lock).lock);
*** DEADLOCK ***
1 lock held by syz.3.4916/16523:
#0: ffff0000ef1b60e0 (&type->s_umount_key#52/1){+.+.}-{3:3}, at: alloc_super+0x1b0/0x83c fs/super.c:344
stack backtrace:
CPU: 1 UID: 0 PID: 16523 Comm: syz.3.4916 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000
verify_lock_unused+0xc0/0x114 kernel/locking/lockdep.c:5691
lock_acquire+0x3b0/0x728 kernel/locking/lockdep.c:5750
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
down_trylock+0x28/0xd8 kernel/locking/semaphore.c:139
efivar_trylock+0x20/0xa0 drivers/firmware/efi/vars.c:160
efi_pstore_write+0x21c/0x63c drivers/firmware/efi/efi-pstore.c:223
pstore_dump+0x764/0xad0 fs/pstore/platform.c:354
kmsg_dump+0x17c/0x274 kernel/printk/printk.c:4214
panic+0x34c/0x884 kernel/panic.c:385
nmi_panic+0x11c/0x23c kernel/panic.c:205
panic_bad_stack+0x200/0x28c arch/arm64/kernel/traps.c:917
enter_from_kernel_mode+0x0/0x74 arch/arm64/kernel/entry-common.c:928
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:566
el1h_64_sync+0x0/0x68 arch/arm64/kernel/entry.S:591
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 5f5673607153 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1298499f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=dedbcb1ff4387972
dashboard link: https://syzkaller.appspot.com/bug?extid=ec17b78de14721dd3bdc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11323107980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/40172aed5414/disk-5f567360.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/58372f305e9d/vmlinux-5f567360.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d2aae6fa798f/Image-5f567360.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/33ba6e22aaa5/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ec17b7...@syzkaller.appspotmail.com
x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000000
x2 : ffff0000d7975ac0 x1 : 0000000000000000 x0 : ffff800080872848
Kernel panic - not syncing: kernel stack overflow
CPU: 1 UID: 0 PID: 16523 Comm: syz.3.4916 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
panic+0x300/0x884 kernel/panic.c:354
nmi_panic+0x11c/0x23c kernel/panic.c:205
panic_bad_stack+0x200/0x28c arch/arm64/kernel/traps.c:917
enter_from_kernel_mode+0x0/0x74 arch/arm64/kernel/entry-common.c:928
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:566
el1h_64_sync+0x0/0x68 arch/arm64/kernel/entry.S:591
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x10,00000207,00200128,42017203
Memory Limit: none
================================
WARNING: inconsistent lock state
6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.3.4916/16523 [HC1[1]:SC0[0]:HE0:SE1] takes:
ffff800091c892b8 ((efivars_lock).lock){....}-{2:2}, at: down_trylock+0x28/0xd8 kernel/locking/semaphore.c:139
{INITIAL USE} state was registered at:
lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
down_interruptible+0x3c/0xfc kernel/locking/semaphore.c:83
efivars_register+0x2c/0x10c drivers/firmware/efi/vars.c:68
generic_ops_register drivers/firmware/efi/efi.c:229 [inline]
efisubsys_init+0x414/0x5f8 drivers/firmware/efi/efi.c:433
do_one_initcall+0x24c/0x9c0 init/main.c:1267
do_initcall_level+0x154/0x214 init/main.c:1329
do_initcalls+0x58/0xac init/main.c:1345
do_basic_setup+0x8c/0xa0 init/main.c:1364
kernel_init_freeable+0x324/0x478 init/main.c:1578
kernel_init+0x24/0x2a0 init/main.c:1467
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 10106
hardirqs last enabled at (10105): [<ffff80008b3388f8>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:85 [inline]
hardirqs last enabled at (10105): [<ffff80008b3388f8>] exit_to_kernel_mode+0xdc/0x10c arch/arm64/kernel/entry-common.c:95
hardirqs last disabled at (10106): [<ffff80008b42e1b4>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:117 [inline]
hardirqs last disabled at (10106): [<ffff80008b42e1b4>] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:170
softirqs last enabled at (8930): [<ffff8000800307f8>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (8928): [<ffff8000800307c4>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((efivars_lock).lock);
<Interrupt>
lock((efivars_lock).lock);
*** DEADLOCK ***
1 lock held by syz.3.4916/16523:
#0: ffff0000ef1b60e0 (&type->s_umount_key#52/1){+.+.}-{3:3}, at: alloc_super+0x1b0/0x83c fs/super.c:344
stack backtrace:
CPU: 1 UID: 0 PID: 16523 Comm: syz.3.4916 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
dump_stack+0x1c/0x28 lib/dump_stack.c:128
print_usage_bug+0x698/0x9ac kernel/locking/lockdep.c:4000
verify_lock_unused+0xc0/0x114 kernel/locking/lockdep.c:5691
lock_acquire+0x3b0/0x728 kernel/locking/lockdep.c:5750
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162
down_trylock+0x28/0xd8 kernel/locking/semaphore.c:139
efivar_trylock+0x20/0xa0 drivers/firmware/efi/vars.c:160
efi_pstore_write+0x21c/0x63c drivers/firmware/efi/efi-pstore.c:223
pstore_dump+0x764/0xad0 fs/pstore/platform.c:354
kmsg_dump+0x17c/0x274 kernel/printk/printk.c:4214
panic+0x34c/0x884 kernel/panic.c:385
nmi_panic+0x11c/0x23c kernel/panic.c:205
panic_bad_stack+0x200/0x28c arch/arm64/kernel/traps.c:917
enter_from_kernel_mode+0x0/0x74 arch/arm64/kernel/entry-common.c:928
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:566
el1h_64_sync+0x0/0x68 arch/arm64/kernel/entry.S:591
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages