kernel panic: stack-protector: Kernel stack is corrupted in: br_dev_xmit

30 views
Skip to first unread message

syzbot

unread,
Mar 31, 2018, 4:47:10 PM3/31/18
to syzkaller-upst...@googlegroups.com
Hello,

syzbot hit the following crash on net-next commit
6f14f49ce5eb00f533133df06c663fbaea13cd50 (Fri Mar 30 17:00:11 2018 +0000)
Merge branch 'ieee802154-for-davem-2018-03-29' of
git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next
syzbot dashboard link:
https://syzkaller.appspot.com/bug?extid=94664b0cab0399c4b32a

So far this crash happened 3 times on net-next.
Unfortunately, I don't have any reproducer for this crash yet.
Raw console output:
https://syzkaller.appspot.com/x/log.txt?id=5240150741221376
Kernel config:
https://syzkaller.appspot.com/x/.config?id=3327544840960562528
compiler: gcc (GCC) 7.1.1 20170620
CC: [bri...@lists.linux-foundation.org da...@davemloft.net
linux-...@vger.kernel.org net...@vger.kernel.org
ste...@networkplumber.org]

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+94664b...@syzkaller.appspotmail.com
It will help syzbot understand when the bug is fixed. See footer for
details.
If you forward the report, please keep this part and the footer.

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000013
R13: 00000000000006a5 R14: 00000000006fc018 R15: 000000000000001d
tc_dump_action: action bad kind
device bridge0 left promiscuous mode
Dead loop on virtual device bridge0, fix it urgently!
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:
br_dev_xmit+0x12ec/0x1550 net/bridge/br_device.c:112

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.16.0-rc6+ #287
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x24d lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__stack_chk_fail+0x22/0x30 kernel/panic.c:643
br_dev_xmit+0x12ec/0x1550 net/bridge/br_device.c:112
__netdev_start_xmit include/linux/netdevice.h:4087 [inline]
netdev_start_xmit include/linux/netdevice.h:4096 [inline]
xmit_one net/core/dev.c:3058 [inline]
dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3074
__dev_queue_xmit+0x26bf/0x2fc0 net/core/dev.c:3589
dev_queue_xmit+0x17/0x20 net/core/dev.c:3622
neigh_hh_output include/net/neighbour.h:472 [inline]
neigh_output include/net/neighbour.h:480 [inline]
ip_finish_output2+0xf4d/0x1550 net/ipv4/ip_output.c:229
ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:277 [inline]
ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91
ip_tunnel_xmit+0x177b/0x3550 net/ipv4/ip_tunnel.c:768
__gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:449
gre_tap_xmit+0x2b7/0x4f0 net/ipv4/ip_gre.c:756
__netdev_start_xmit include/linux/netdevice.h:4087 [inline]
netdev_start_xmit include/linux/netdevice.h:4096 [inline]
xmit_one net/core/dev.c:3058 [inline]
dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3074
sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327
qdisc_restart net/sched/sch_generic.c:393 [inline]
__qdisc_run+0x57d/0x18e0 net/sched/sch_generic.c:401
__dev_xmit_skb net/core/dev.c:3249 [inline]
__dev_queue_xmit+0xb8b/0x2fc0 net/core/dev.c:3557
dev_queue_xmit+0x17/0x20 net/core/dev.c:3622
br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55
NF_HOOK include/linux/netfilter.h:288 [inline]
br_forward_finish+0xc8/0x530 net/bridge/br_forward.c:67
NF_HOOK include/linux/netfilter.h:288 [inline]
__br_forward+0x533/0xc80 net/bridge/br_forward.c:112
br_flood+0x665/0x770 net/bridge/br_forward.c:225
br_dev_xmit+0xa68/0x1550 net/bridge/br_device.c:87
__netdev_start_xmit include/linux/netdevice.h:4087 [inline]
netdev_start_xmit include/linux/netdevice.h:4096 [inline]
xmit_one net/core/dev.c:3058 [inline]
dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3074
__dev_queue_xmit+0x26bf/0x2fc0 net/core/dev.c:3589
dev_queue_xmit+0x17/0x20 net/core/dev.c:3622
neigh_hh_output include/net/neighbour.h:472 [inline]
neigh_output include/net/neighbour.h:480 [inline]
ip_finish_output2+0xf4d/0x1550 net/ipv4/ip_output.c:229
ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:277 [inline]
ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
iptunnel_xmit+0x556/0x810 net/ipv4/ip_tunnel_core.c:91
ip_tunnel_xmit+0x177b/0x3550 net/ipv4/ip_tunnel.c:768
__gre_xmit+0x546/0x8b0 net/ipv4/ip_gre.c:449
gre_tap_xmit+0x2b7/0x4f0 net/ipv4/ip_gre.c:756
__netdev_start_xmit include/linux/netdevice.h:4087 [inline]
netdev_start_xmit include/linux/netdevice.h:4096 [inline]
xmit_one net/core/dev.c:3058 [inline]
dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3074
sch_direct_xmit+0x40d/0x1140 net/sched/sch_generic.c:327
qdisc_restart net/sched/sch_generic.c:393 [inline]
__qdisc_run+0x57d/0x18e0 net/sched/sch_generic.c:401
__dev_xmit_skb net/core/dev.c:3249 [inline]
__dev_queue_xmit+0xb8b/0x2fc0 net/core/dev.c:3557
dev_queue_xmit+0x17/0x20 net/core/dev.c:3622
br_dev_queue_push_xmit+0x196/0x5a0 net/bridge/br_forward.c:55
NF_HOOK include/linux/netfilter.h:288 [inline]
br_forward_finish+0xc8/0x530 net/bridge/br_forward.c:67
NF_HOOK include/linux/netfilter.h:288 [inline]
__br_forward+0x533/0xc80 net/bridge/br_forward.c:112
br_flood+0x665/0x770 net/bridge/br_forward.c:225
br_dev_xmit+0xa68/0x1550 net/bridge/br_device.c:87
kernel msg: ebtables bug: please report to author: Entries_size never zero
__netdev_start_xmit include/linux/netdevice.h:4087 [inline]
netdev_start_xmit include/linux/netdevice.h:4096 [inline]
xmit_one net/core/dev.c:3058 [inline]
dev_hard_start_xmit+0x24e/0xac0 net/core/dev.c:3074
__dev_queue_xmit+0x26bf/0x2fc0 net/core/dev.c:3589
dev_queue_xmit+0x17/0x20 net/core/dev.c:3622
neigh_resolve_output+0x5e2/0xa00 net/core/neighbour.c:1350
neigh_output include/net/neighbour.h:482 [inline]
ip_finish_output2+0x91a/0x1550 net/ipv4/ip_output.c:229
ip_finish_output+0x864/0xd60 net/ipv4/ip_output.c:317
NF_HOOK_COND include/linux/netfilter.h:277 [inline]
ip_mc_output+0x271/0x1350 net/ipv4/ip_output.c:390
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124
ip_queue_xmit+0x8c0/0x1920 net/ipv4/ip_output.c:504
sctp_v4_xmit+0x108/0x140 net/sctp/protocol.c:942
sctp_packet_transmit+0x22a5/0x37c0 net/sctp/output.c:642
sctp_outq_flush+0x121b/0x4060 net/sctp/outqueue.c:1197
sctp_outq_uncork+0x5a/0x70 net/sctp/outqueue.c:776
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
sctp_do_sm+0x4e0/0x7040 net/sctp/sm_sideeffect.c:1191
sctp_generate_heartbeat_event+0x292/0x3f0 net/sctp/sm_sideeffect.c:406
call_timer_fn+0x228/0x820 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x7ee/0xb70 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2d7/0xb85 kernel/softirq.c:285
invoke_softirq kernel/softirq.c:365 [inline]
irq_exit+0x1cc/0x200 kernel/softirq.c:405
exiting_irq arch/x86/include/asm/apic.h:541 [inline]
smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:857
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
RSP: 0018:ffff8801d9b2fcb0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12
RAX: dffffc0000000000 RBX: 1ffff1003b365f99 RCX: ffffffff85185605
RDX: 1ffffffff10a24e8 RSI: 0000000000000000 RDI: ffffffff88512740
RBP: ffff8801d9b2fcb0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8801d9b2fa40 R11: ffff8801db125c18 R12: 0000000000000001
R13: ffff8801d9b2fd68 R14: ffffffff88ed3c60 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xbf/0x430 arch/x86/kernel/process.c:354
arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:345
default_idle_call+0x36/0x90 kernel/sched/idle.c:98
cpuidle_idle_call kernel/sched/idle.c:156 [inline]
do_idle+0x24a/0x3b0 kernel/sched/idle.c:246
cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351
start_secondary+0x40a/0x590 arch/x86/kernel/smpboot.c:267
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:239
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.

syzbot will keep track of this bug report.
If you forgot to add the Reported-by tag, once the fix for this bug is
merged
into any tree, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.
To upstream this report, please reply with:
#syz upstream

syzbot

unread,
Mar 31, 2018, 4:47:12 PM3/31/18
to syzkaller-upst...@googlegroups.com

syzbot

unread,
Feb 22, 2019, 5:22:12 AM2/22/19
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages