[moderation] [mm?] BUG: stack guard page was hit in compat_sys_sendfile
0 views
Skip to first unread message
syzbot
Sep 30, 2024, 9:40:32 AMSep 30
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15518d9f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=425d661bd3c2e364
dashboard link: https://syzkaller.appspot.com/bug?extid=cd16b153811e057524f3
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org linu...@kvack.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ad46e8f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/05ab0ab32ade/vmlinux-ad46e8f9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3d67cd7ca135/bzImage-ad46e8f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd16b1...@syzkaller.appspotmail.com
BUG: TASK stack guard page was hit at ffffc90003e6ff38 (stack is ffffc90003e70000..ffffc90003e78000)
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 15168 Comm: syz.3.1925 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57
RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082
RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080
RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440
RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388
R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002
R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440
FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<#DF>
</#DF>
<TASK>
mark_usage kernel/locking/lockdep.c:4631 [inline]
__lock_acquire+0x8a3/0x3ce0 kernel/locking/lockdep.c:5153
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5822
__raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
_raw_spin_trylock+0x63/0x80 kernel/locking/spinlock.c:138
spin_trylock include/linux/spinlock.h:361 [inline]
rmqueue_pcplist mm/page_alloc.c:3012 [inline]
rmqueue mm/page_alloc.c:3056 [inline]
get_page_from_freelist+0x371/0x3070 mm/page_alloc.c:3454
__alloc_pages_noprof+0x223/0x25c0 mm/page_alloc.c:4733
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265
alloc_slab_page mm/slub.c:2413 [inline]
allocate_slab mm/slub.c:2579 [inline]
new_slab+0x2ba/0x3f0 mm/slub.c:2632
___slab_alloc+0xd1d/0x16f0 mm/slub.c:3819
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__do_kmalloc_node mm/slub.c:4264 [inline]
__kmalloc_noprof+0x379/0x410 mm/slub.c:4277
kmalloc_noprof include/linux/slab.h:882 [inline]
p9_fcall_init+0x97/0x260 net/9p/client.c:233
p9_tag_alloc+0x21c/0x870 net/9p/client.c:300
p9_client_prepare_req+0x19f/0x4d0 net/9p/client.c:644
p9_client_zc_rpc.constprop.0+0x105/0x880 net/9p/client.c:793
p9_client_read_once+0x443/0x820 net/9p/client.c:1560
p9_client_read+0x13f/0x1b0 net/9p/client.c:1524
v9fs_issue_read+0x115/0x310 fs/9p/vfs_addr.c:74
netfs_retry_read_subrequests fs/netfs/read_retry.c:60 [inline]
netfs_retry_reads+0x153a/0x1d00 fs/netfs/read_retry.c:232
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_dispatch_unbuffered_reads fs/netfs/direct_read.c:103 [inline]
netfs_unbuffered_read fs/netfs/direct_read.c:127 [inline]
netfs_unbuffered_read_iter_locked+0x12f6/0x19b0 fs/netfs/direct_read.c:221
netfs_unbuffered_read_iter+0xc5/0x100 fs/netfs/direct_read.c:256
v9fs_file_read_iter+0xbf/0x100 fs/9p/vfs_file.c:361
copy_splice_read+0x620/0xb90 fs/splice.c:365
v9fs_file_splice_read+0xc8/0xe0 fs/9p/vfs_file.c:385
do_splice_read fs/splice.c:985 [inline]
do_splice_read+0x282/0x370 fs/splice.c:959
splice_direct_to_actor+0x2a4/0xa40 fs/splice.c:1089
do_splice_direct_actor fs/splice.c:1207 [inline]
do_splice_direct+0x178/0x250 fs/splice.c:1233
do_sendfile+0xb0c/0xe40 fs/read_write.c:1388
__do_compat_sys_sendfile fs/read_write.c:1470 [inline]
__se_compat_sys_sendfile fs/read_write.c:1459 [inline]
__ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1459
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7fa6579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f572656c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003
RDX: 00000000200000c0 RSI: 0000000000000fff RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57
RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082
RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080
RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440
RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388
R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002
R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440
FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 55 push %rbp
6: 48 89 e5 mov %rsp,%rbp
9: 41 57 push %r15
b: 41 56 push %r14
d: 41 89 d6 mov %edx,%r14d
10: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
17: fc ff df
1a: 41 55 push %r13
1c: 41 54 push %r12
1e: 53 push %rbx
1f: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
23: 48 81 ec 10 01 00 00 sub $0x110,%rsp
* 2a: 48 c7 44 24 30 b3 8a movq $0x41b58ab3,0x30(%rsp) <-- trapping instruction
31: b5 41
33: 48 8d 44 24 30 lea 0x30(%rsp),%rax
38: 48 rex.W
39: c7 .byte 0xc7
3a: 44 24 38 rex.R and $0x38,%al
3d: d0 42 57 rolb 0x57(%rdx)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: ad46e8f95e93 Merge tag 'pm-6.12-rc1-2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15518d9f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=425d661bd3c2e364
dashboard link: https://syzkaller.appspot.com/bug?extid=cd16b153811e057524f3
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: i386
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org linu...@kvack.org]
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-ad46e8f9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/05ab0ab32ade/vmlinux-ad46e8f9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3d67cd7ca135/bzImage-ad46e8f9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cd16b1...@syzkaller.appspotmail.com
BUG: TASK stack guard page was hit at ffffc90003e6ff38 (stack is ffffc90003e70000..ffffc90003e78000)
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 15168 Comm: syz.3.1925 Not tainted 6.11.0-syzkaller-11728-gad46e8f95e93 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57
RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082
RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080
RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440
RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388
R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002
R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440
FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<#DF>
</#DF>
<TASK>
mark_usage kernel/locking/lockdep.c:4631 [inline]
__lock_acquire+0x8a3/0x3ce0 kernel/locking/lockdep.c:5153
lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5822
__raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
_raw_spin_trylock+0x63/0x80 kernel/locking/spinlock.c:138
spin_trylock include/linux/spinlock.h:361 [inline]
rmqueue_pcplist mm/page_alloc.c:3012 [inline]
rmqueue mm/page_alloc.c:3056 [inline]
get_page_from_freelist+0x371/0x3070 mm/page_alloc.c:3454
__alloc_pages_noprof+0x223/0x25c0 mm/page_alloc.c:4733
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265
alloc_slab_page mm/slub.c:2413 [inline]
allocate_slab mm/slub.c:2579 [inline]
new_slab+0x2ba/0x3f0 mm/slub.c:2632
___slab_alloc+0xd1d/0x16f0 mm/slub.c:3819
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__do_kmalloc_node mm/slub.c:4264 [inline]
__kmalloc_noprof+0x379/0x410 mm/slub.c:4277
kmalloc_noprof include/linux/slab.h:882 [inline]
p9_fcall_init+0x97/0x260 net/9p/client.c:233
p9_tag_alloc+0x21c/0x870 net/9p/client.c:300
p9_client_prepare_req+0x19f/0x4d0 net/9p/client.c:644
p9_client_zc_rpc.constprop.0+0x105/0x880 net/9p/client.c:793
p9_client_read_once+0x443/0x820 net/9p/client.c:1560
p9_client_read+0x13f/0x1b0 net/9p/client.c:1524
v9fs_issue_read+0x115/0x310 fs/9p/vfs_addr.c:74
netfs_retry_read_subrequests fs/netfs/read_retry.c:60 [inline]
netfs_retry_reads+0x153a/0x1d00 fs/netfs/read_retry.c:232
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_retry_reads+0x155e/0x1d00 fs/netfs/read_retry.c:235
netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:369
netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:405
netfs_dispatch_unbuffered_reads fs/netfs/direct_read.c:103 [inline]
netfs_unbuffered_read fs/netfs/direct_read.c:127 [inline]
netfs_unbuffered_read_iter_locked+0x12f6/0x19b0 fs/netfs/direct_read.c:221
netfs_unbuffered_read_iter+0xc5/0x100 fs/netfs/direct_read.c:256
v9fs_file_read_iter+0xbf/0x100 fs/9p/vfs_file.c:361
copy_splice_read+0x620/0xb90 fs/splice.c:365
v9fs_file_splice_read+0xc8/0xe0 fs/9p/vfs_file.c:385
do_splice_read fs/splice.c:985 [inline]
do_splice_read+0x282/0x370 fs/splice.c:959
splice_direct_to_actor+0x2a4/0xa40 fs/splice.c:1089
do_splice_direct_actor fs/splice.c:1207 [inline]
do_splice_direct+0x178/0x250 fs/splice.c:1233
do_sendfile+0xb0c/0xe40 fs/read_write.c:1388
__do_compat_sys_sendfile fs/read_write.c:1470 [inline]
__se_compat_sys_sendfile fs/read_write.c:1459 [inline]
__ia32_compat_sys_sendfile+0x163/0x230 fs/read_write.c:1459
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0x73/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x32/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7fa6579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f572656c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000003
RDX: 00000000200000c0 RSI: 0000000000000fff RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4683
Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 d0 42 57
RSP: 0018:ffffc90003e6ff40 EFLAGS: 00010082
RAX: 0000000000000004 RBX: ffff888020d4af6a RCX: 0000000000000080
RDX: dffffc0000000000 RSI: ffff888020d4af48 RDI: ffff888020d4a440
RBP: ffffc90003e70080 R08: 0000000000000000 R09: fffffbfff2d31388
R10: ffffffff96989c47 R11: 0000000000000000 R12: 0000000000000002
R13: ffff888020d4af48 R14: 0000000000000002 R15: ffff888020d4a440
FS: 0000000000000000(0000) GS:ffff88802b600000(0063) knlGS:00000000f5726b40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffc90003e6ff38 CR3: 0000000066efe000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 55 push %rbp
6: 48 89 e5 mov %rsp,%rbp
9: 41 57 push %r15
b: 41 56 push %r14
d: 41 89 d6 mov %edx,%r14d
10: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
17: fc ff df
1a: 41 55 push %r13
1c: 41 54 push %r12
1e: 53 push %rbx
1f: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
23: 48 81 ec 10 01 00 00 sub $0x110,%rsp
* 2a: 48 c7 44 24 30 b3 8a movq $0x41b58ab3,0x30(%rsp) <-- trapping instruction
31: b5 41
33: 48 8d 44 24 30 lea 0x30(%rsp),%rax
38: 48 rex.W
39: c7 .byte 0xc7
3a: 44 24 38 rex.R and $0x38,%al
3d: d0 42 57 rolb 0x57(%rdx)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages