[moderation] [mm?] kernel panic: corrupted stack end in mntput

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1613e604df0c Linux 6.10-rc1
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=15982592980000
kernel config: https://syzkaller.appspot.com/x/.config?x=71e27a66e3476b52
dashboard link: https://syzkaller.appspot.com/bug?extid=f502952b32573c31f137
compiler: riscv64-linux-gnu-gcc (Debian 12.2.0-13) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: riscv64
CC: [ak...@linux-foundation.org da...@fromorbit.com linux-...@vger.kernel.org linu...@kvack.org muchu...@linux.dev roman.g...@linux.dev zhengq...@bytedance.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/a741b348759c/non_bootable_disk-1613e604.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e531dbb975b3/vmlinux-1613e604.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0f763ab94b0/Image-1613e604.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f50295...@syzkaller.appspotmail.com

NET: Registered PF_SMC protocol family
9pnet: Installing 9P2000 support
Key type dns_resolver registered
Key type ceph registered
libceph: loaded (mon/osd proto 15/24)
NET: Registered PF_VSOCK protocol family
Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
registered taskstats version 1
Loading compiled-in X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: ea7f3bda142c883f77af1295bf0d016c41f5f396'
zswap: loaded using pool lzo/zsmalloc
Demotion targets for Node 0: null
debug_vm_pgtable: [debug_vm_pgtable ]: Validating architecture page table helpers
Key type .fscrypt registered
Key type fscrypt-provisioning registered
Key type big_key registered
Key type encrypted registered
AppArmor: AppArmor sha256 policy hashing enabled
ima: No TPM chip found, activating TPM-bypass!
Loading compiled-in module X.509 certificates
Loaded X.509 cert 'Build time autogenerated kernel key: ea7f3bda142c883f77af1295bf0d016c41f5f396'
ima: Allocated hash algorithm: sha256
ima: No architecture policies found
evm: Initialising EVM extended attributes:
evm: security.selinux (disabled)
evm: security.SMACK64 (disabled)
evm: security.SMACK64EXEC (disabled)
evm: security.SMACK64TRANSMUTE (disabled)
evm: security.SMACK64MMAP (disabled)
evm: security.apparmor
evm: security.ima
evm: security.capability
evm: HMAC attrs: 0x1
printk: legacy console [netcon0] enabled
netconsole: network logging started
gtp: GTP module loaded (pdp ctx size 128 bytes)
rdma_rxe: loaded
clk: Disabling unused clocks
PM: genpd: Disabling unused power domains
ALSA device list:
#0: Dummy 1
#1: Loopback 1
#2: Virtual MIDI Card 1
md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
EXT4-fs (vda): mounted filesystem 34b94c48-234b-4869-b990-1f782e29954a ro with ordered data mode. Quota mode: none.
VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
devtmpfs: mounted
Freeing unused kernel image (initmem) memory: 2500K
Failed to set sysctl parameter 'max_rcu_stall_to_panic=1': parameter not found
Run /sbin/init as init process
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 1 Comm: init Not tainted 6.10.0-rc1-syzkaller-g1613e604df0c #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff8000f6f8>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:129
[<ffffffff85c29e7c>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:135
[<ffffffff85c83b6a>] __dump_stack lib/dump_stack.c:88 [inline]
[<ffffffff85c83b6a>] dump_stack_lvl+0x108/0x196 lib/dump_stack.c:114
[<ffffffff85c83c14>] dump_stack+0x1c/0x24 lib/dump_stack.c:123
[<ffffffff85c2aa42>] panic+0x382/0x800 kernel/panic.c:347
[<ffffffff85c92b18>] schedule_debug kernel/sched/core.c:5962 [inline]
[<ffffffff85c92b18>] __schedule+0x342e/0x3486 kernel/sched/core.c:6628
[<ffffffff85c930cc>] preempt_schedule_common kernel/sched/core.c:6924 [inline]
[<ffffffff85c930cc>] preempt_schedule+0xd2/0x1e2 kernel/sched/core.c:6948
[<ffffffff85ca759a>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
[<ffffffff85ca759a>] _raw_spin_unlock_irqrestore+0xb4/0xd6 kernel/locking/spinlock.c:194
[<ffffffff81429008>] debug_object_activate+0x298/0x378 lib/debugobjects.c:726
[<ffffffff802c268a>] debug_rcu_head_queue kernel/rcu/rcu.h:227 [inline]
[<ffffffff802c268a>] __call_rcu_common.constprop.0+0x3c/0x940 kernel/rcu/tree.c:3057
[<ffffffff802c2fae>] call_rcu+0xc/0x14 kernel/rcu/tree.c:3176
[<ffffffff8073f480>] shrinker_free+0x110/0x43c mm/shrinker.c:807
[<ffffffff809ca696>] deactivate_locked_super+0xb4/0x188 fs/super.c:472
[<ffffffff809ca7ea>] deactivate_super fs/super.c:506 [inline]
[<ffffffff809ca7ea>] deactivate_super+0x80/0x94 fs/super.c:502
[<ffffffff80a4ae22>] cleanup_mnt+0x278/0x4b6 fs/namespace.c:1267
[<ffffffff80a4a744>] mntput_no_expire+0xb9a/0xdaa fs/namespace.c:1353
[<ffffffff80a4a9c8>] mntput+0x74/0xa2 fs/namespace.c:1363
[<ffffffff809c623a>] __fput+0x4c2/0xa12 fs/file_table.c:433
[<ffffffff809c6824>] ____fput+0x1a/0x24 fs/file_table.c:450
[<ffffffff80148528>] task_work_run+0x16a/0x25e kernel/task_work.c:180
[<ffffffff85c86de0>] resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
[<ffffffff85c86de0>] exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
[<ffffffff85c86de0>] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
[<ffffffff85c86de0>] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
[<ffffffff85c86de0>] syscall_exit_to_user_mode+0x30a/0x31e kernel/entry/common.c:218
[<ffffffff85ca8744>] ret_from_exception+0x0/0x64 arch/riscv/kernel/entry.S:112
SMP: stopping secondary CPUs
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup