From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 391A4C433DB for ; Tue, 16 Mar 2021 10:40:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EE08965023 for ; Tue, 16 Mar 2021 10:40:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236716AbhCPKjH (ORCPT ); Tue, 16 Mar 2021 06:39:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:39344 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236696AbhCPKhl (ORCPT ); Tue, 16 Mar 2021 06:37:41 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id ADCB36502E for ; Tue, 16 Mar 2021 10:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1615891060; bh=8vg3j4KbPfPGCtaZq86t7nyqRbHFTsK5OFjgTIYKfE0=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=d+Qjn9VAZhU8320HlfH2CF0EbAoM7HkH3DWSmpdhX16QM3iC/iWgU3NrykWSeIqI5 6PwLg9/I7L/rXuiwbV+B7CPS2qWTZEW9he9zJBT/s1ENhdiwqX/cOER+oWPAEirl57 L/C3bXCfxio2noARTJbjXLxLPN794rCyy+oEqfUGTeiTCF+/hNrcfUlP7zd05wuHDU NCbstAr9gGzL9CTPQhIGHfpYU923DO/qYj8QVaVaiaeDVVq64YfT2WTAIdnhex62s9 FvpdoeXGZzfEbZCFIzEmUtI/EepUF0A4sB+9TR2DbUOS3Lr8D4R8V7rX2/53dTszGw EtxPP3KLOUh2Q== Received: by mail-ot1-f48.google.com with SMTP id w21-20020a9d63950000b02901ce7b8c45b4so6578003otk.5 for ; Tue, 16 Mar 2021 03:37:40 -0700 (PDT) X-Gm-Message-State: AOAM530ST5W4xycyV21S/zSfPJukSU7zSFqv+dfw2rLnXDd52LnH+sVe NsXNFINiQt3Uxe/jypjHzN+Q5kVLbvIu2FSFsQw= X-Google-Smtp-Source: ABdhPJzBZsC6BebipGpd9qkQLkv5f4JpjNvG8vPxGY97HQYtsk7jXKK3lV51bWXjlBbggbKWr0LEZj3gGa0q79LDMx0= X-Received: by 2002:a9d:7512:: with SMTP id r18mr3234126otk.90.1615891059931; Tue, 16 Mar 2021 03:37:39 -0700 (PDT) MIME-Version: 1.0 References: <00000000000069802205bda22b7f@google.com> In-Reply-To: From: Ard Biesheuvel Date: Tue, 16 Mar 2021 11:37:28 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [syzbot] kernel panic: corrupted stack end in openat To: Arnd Bergmann Cc: Dmitry Vyukov , syzbot , Russell King - ARM Linux , Linus Walleij , Linux ARM , Andrew Morton , LKML , Linux-MM , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 16 Mar 2021 at 11:04, Arnd Bergmann wrote: > > On Tue, Mar 16, 2021 at 8:59 AM Dmitry Vyukov wrote: > > > > On Tue, Mar 16, 2021 at 8:18 AM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD commit: 1e28eed1 Linux 5.12-rc3 > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=167535e6d00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e0cee1f53de33ca3 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0b06ef9b44d00d600183 > > > userspace arch: arm > > > > > > Unfortunately, I don't have any reproducer for this issue yet. > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+0b06ef9b44d00d600183@syzkaller.appspotmail.com > > > > +arm32 maintainer > > I think this is a real stack overflow on arm32, the stack is indeed deep. > > Nice find. I see there was already a second report, so it seems to be > reproducible as well. > If you are able to trigger this reliably, you could try printing the frame > pointer while unwinding to see what is actually going on: > > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -68,8 +68,8 @@ void dump_backtrace_entry(unsigned long where, > unsigned long from, > unsigned long end = frame + 4 + sizeof(struct pt_regs); > > #ifdef CONFIG_KALLSYMS > - printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", > - loglvl, where, (void *)where, from, (void *)from); > + printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS), frame %08lx\n", > + loglvl, where, (void *)where, from, (void *)from, frame); > #else > printk("%sFunction entered at [<%08lx>] from [<%08lx>]\n", > loglvl, where, from); > > If that doesn't help, I could have a look at the binary to see which > functions in the call chain take a lot of stack space, if any. > > Which exact compiler version do you use for building these > kernels? I can try doing a build with the same commit and config. > > This one function is one that I have seen before when looking at build > warnings with KASAN: > > > > [<8073772c>] (integrity_kernel_read) from [<8073a904>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572) > > ima_calc_file_hash_tfm() has a SHASH_DESC_ON_STACK(), which by itself can > use up 512 bytes, but KASAN sometimes triples this number. However, I see > you do not actually have KASAN enabled, so there is probably more to it. > FYI, as an aside, the SHASH_DESC_ON_STACK() issue was fixed in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=660d2062190db131d2feaf19914e90f868fe285c (note that the size of SHASH_DESC_ON_STACK() accounts for two struct shash_desc instances) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F663C433E0 for ; Tue, 16 Mar 2021 10:37:44 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9C68864FD1 for ; Tue, 16 Mar 2021 10:37:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9C68864FD1 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 00CF76B006C; Tue, 16 Mar 2021 06:37:43 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EFF126B006E; Tue, 16 Mar 2021 06:37:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D9FE76B0070; Tue, 16 Mar 2021 06:37:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0242.hostedemail.com [216.40.44.242]) by kanga.kvack.org (Postfix) with ESMTP id BB6E56B006C for ; Tue, 16 Mar 2021 06:37:42 -0400 (EDT) Received: from smtpin03.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 72A3552C1 for ; Tue, 16 Mar 2021 10:37:42 +0000 (UTC) X-FDA: 77925386364.03.E6FD3EF Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf16.hostedemail.com (Postfix) with ESMTP id D8B028019146 for ; Tue, 16 Mar 2021 10:37:41 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id B181A6502F for ; Tue, 16 Mar 2021 10:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1615891060; bh=8vg3j4KbPfPGCtaZq86t7nyqRbHFTsK5OFjgTIYKfE0=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=d+Qjn9VAZhU8320HlfH2CF0EbAoM7HkH3DWSmpdhX16QM3iC/iWgU3NrykWSeIqI5 6PwLg9/I7L/rXuiwbV+B7CPS2qWTZEW9he9zJBT/s1ENhdiwqX/cOER+oWPAEirl57 L/C3bXCfxio2noARTJbjXLxLPN794rCyy+oEqfUGTeiTCF+/hNrcfUlP7zd05wuHDU NCbstAr9gGzL9CTPQhIGHfpYU923DO/qYj8QVaVaiaeDVVq64YfT2WTAIdnhex62s9 FvpdoeXGZzfEbZCFIzEmUtI/EepUF0A4sB+9TR2DbUOS3Lr8D4R8V7rX2/53dTszGw EtxPP3KLOUh2Q== Received: by mail-ot1-f44.google.com with SMTP id j8so8374137otc.0 for ; Tue, 16 Mar 2021 03:37:40 -0700 (PDT) X-Gm-Message-State: AOAM533kNskiT1i1VvnC7GZuBhD0oYPJv+/NcFwJGt2SUDq24vW9i8Km A7mcuV9HnEMds+0l8VS5P6TdhhknbwaKkemS3a0= X-Google-Smtp-Source: ABdhPJzBZsC6BebipGpd9qkQLkv5f4JpjNvG8vPxGY97HQYtsk7jXKK3lV51bWXjlBbggbKWr0LEZj3gGa0q79LDMx0= X-Received: by 2002:a9d:7512:: with SMTP id r18mr3234126otk.90.1615891059931; Tue, 16 Mar 2021 03:37:39 -0700 (PDT) MIME-Version: 1.0 References: <00000000000069802205bda22b7f@google.com> In-Reply-To: From: Ard Biesheuvel Date: Tue, 16 Mar 2021 11:37:28 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [syzbot] kernel panic: corrupted stack end in openat To: Arnd Bergmann Cc: Dmitry Vyukov , syzbot , Russell King - ARM Linux , Linus Walleij , Linux ARM , Andrew Morton , LKML , Linux-MM , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: D8B028019146 X-Stat-Signature: fjzpdc1uo1u3wzrqjth8notgtid113bc Received-SPF: none (kernel.org>: No applicable sender policy available) receiver=imf16; identity=mailfrom; envelope-from=""; helo=mail.kernel.org; client-ip=198.145.29.99 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1615891061-337236 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, 16 Mar 2021 at 11:04, Arnd Bergmann wrote: > > On Tue, Mar 16, 2021 at 8:59 AM Dmitry Vyukov wrote: > > > > On Tue, Mar 16, 2021 at 8:18 AM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD commit: 1e28eed1 Linux 5.12-rc3 > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=167535e6d00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e0cee1f53de33ca3 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0b06ef9b44d00d600183 > > > userspace arch: arm > > > > > > Unfortunately, I don't have any reproducer for this issue yet. > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+0b06ef9b44d00d600183@syzkaller.appspotmail.com > > > > +arm32 maintainer > > I think this is a real stack overflow on arm32, the stack is indeed deep. > > Nice find. I see there was already a second report, so it seems to be > reproducible as well. > If you are able to trigger this reliably, you could try printing the frame > pointer while unwinding to see what is actually going on: > > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -68,8 +68,8 @@ void dump_backtrace_entry(unsigned long where, > unsigned long from, > unsigned long end = frame + 4 + sizeof(struct pt_regs); > > #ifdef CONFIG_KALLSYMS > - printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", > - loglvl, where, (void *)where, from, (void *)from); > + printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS), frame %08lx\n", > + loglvl, where, (void *)where, from, (void *)from, frame); > #else > printk("%sFunction entered at [<%08lx>] from [<%08lx>]\n", > loglvl, where, from); > > If that doesn't help, I could have a look at the binary to see which > functions in the call chain take a lot of stack space, if any. > > Which exact compiler version do you use for building these > kernels? I can try doing a build with the same commit and config. > > This one function is one that I have seen before when looking at build > warnings with KASAN: > > > > [<8073772c>] (integrity_kernel_read) from [<8073a904>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572) > > ima_calc_file_hash_tfm() has a SHASH_DESC_ON_STACK(), which by itself can > use up 512 bytes, but KASAN sometimes triples this number. However, I see > you do not actually have KASAN enabled, so there is probably more to it. > FYI, as an aside, the SHASH_DESC_ON_STACK() issue was fixed in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=660d2062190db131d2feaf19914e90f868fe285c (note that the size of SHASH_DESC_ON_STACK() accounts for two struct shash_desc instances) From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37407C433DB for ; Tue, 16 Mar 2021 10:39:07 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C03B764F7F for ; Tue, 16 Mar 2021 10:39:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C03B764F7F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From:In-Reply-To: References:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=IrhzMMPf786sP5mhKrFEzTGlDeSUvEdAY6MYhWDEUkA=; b=cZvO+9auvy2H7bq3n6K5OQToY KZcZtLGVSX2qHuERB9KOXOdazikrUgMc9BsncUJSi4AvoW8FLO/Ryxn85s2RJcZXxoP18Eyo4H8SU czNnIHwSLj3f6INY4UuabSt6wEkRTFBKagIyC5/vBh4zBfM9zSyp+b6uZxOkCusVwTmCSLlneWXoE sTK2INg5MZ6z4H+/e5qf//KFaa/x4YRxBlVEmU9tmzgaMoWrAwQqXo4zhhgyw6UNkgJo55fPluymE Rqx6snX+XeyDKdTPVfKyIwF5Kq6U9rk2x+Nmr7l5FH731Eppm/EWSM4lsqCw1wo02FHi36l3CFYPs uYUeppVcw==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lM75J-000Q8j-VY; Tue, 16 Mar 2021 10:37:58 +0000 Received: from mail.kernel.org ([198.145.29.99]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lM756-000Q6i-69 for linux-arm-kernel@lists.infradead.org; Tue, 16 Mar 2021 10:37:48 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id A60CD6502C for ; Tue, 16 Mar 2021 10:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1615891060; bh=8vg3j4KbPfPGCtaZq86t7nyqRbHFTsK5OFjgTIYKfE0=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=d+Qjn9VAZhU8320HlfH2CF0EbAoM7HkH3DWSmpdhX16QM3iC/iWgU3NrykWSeIqI5 6PwLg9/I7L/rXuiwbV+B7CPS2qWTZEW9he9zJBT/s1ENhdiwqX/cOER+oWPAEirl57 L/C3bXCfxio2noARTJbjXLxLPN794rCyy+oEqfUGTeiTCF+/hNrcfUlP7zd05wuHDU NCbstAr9gGzL9CTPQhIGHfpYU923DO/qYj8QVaVaiaeDVVq64YfT2WTAIdnhex62s9 FvpdoeXGZzfEbZCFIzEmUtI/EepUF0A4sB+9TR2DbUOS3Lr8D4R8V7rX2/53dTszGw EtxPP3KLOUh2Q== Received: by mail-ot1-f45.google.com with SMTP id 68-20020a9d0f4a0000b02901b663e6258dso6580884ott.13 for ; Tue, 16 Mar 2021 03:37:40 -0700 (PDT) X-Gm-Message-State: AOAM532azKISvOdbsMam7YS3klVkaX+z7WJBUBhjs3uY6T89FbpXYorH zRnRQuoPLKAfzkFi0Ya2CqRezlYFNxj+5Mlw6Zo= X-Google-Smtp-Source: ABdhPJzBZsC6BebipGpd9qkQLkv5f4JpjNvG8vPxGY97HQYtsk7jXKK3lV51bWXjlBbggbKWr0LEZj3gGa0q79LDMx0= X-Received: by 2002:a9d:7512:: with SMTP id r18mr3234126otk.90.1615891059931; Tue, 16 Mar 2021 03:37:39 -0700 (PDT) MIME-Version: 1.0 References: <00000000000069802205bda22b7f@google.com> In-Reply-To: From: Ard Biesheuvel Date: Tue, 16 Mar 2021 11:37:28 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [syzbot] kernel panic: corrupted stack end in openat To: Arnd Bergmann Cc: Dmitry Vyukov , syzbot , Russell King - ARM Linux , Linus Walleij , Linux ARM , Andrew Morton , LKML , Linux-MM , syzkaller-bugs X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210316_103744_566241_5EFB4163 X-CRM114-Status: GOOD ( 30.98 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, 16 Mar 2021 at 11:04, Arnd Bergmann wrote: > > On Tue, Mar 16, 2021 at 8:59 AM Dmitry Vyukov wrote: > > > > On Tue, Mar 16, 2021 at 8:18 AM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD commit: 1e28eed1 Linux 5.12-rc3 > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=167535e6d00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e0cee1f53de33ca3 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0b06ef9b44d00d600183 > > > userspace arch: arm > > > > > > Unfortunately, I don't have any reproducer for this issue yet. > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+0b06ef9b44d00d600183@syzkaller.appspotmail.com > > > > +arm32 maintainer > > I think this is a real stack overflow on arm32, the stack is indeed deep. > > Nice find. I see there was already a second report, so it seems to be > reproducible as well. > If you are able to trigger this reliably, you could try printing the frame > pointer while unwinding to see what is actually going on: > > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -68,8 +68,8 @@ void dump_backtrace_entry(unsigned long where, > unsigned long from, > unsigned long end = frame + 4 + sizeof(struct pt_regs); > > #ifdef CONFIG_KALLSYMS > - printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", > - loglvl, where, (void *)where, from, (void *)from); > + printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS), frame %08lx\n", > + loglvl, where, (void *)where, from, (void *)from, frame); > #else > printk("%sFunction entered at [<%08lx>] from [<%08lx>]\n", > loglvl, where, from); > > If that doesn't help, I could have a look at the binary to see which > functions in the call chain take a lot of stack space, if any. > > Which exact compiler version do you use for building these > kernels? I can try doing a build with the same commit and config. > > This one function is one that I have seen before when looking at build > warnings with KASAN: > > > > [<8073772c>] (integrity_kernel_read) from [<8073a904>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572) > > ima_calc_file_hash_tfm() has a SHASH_DESC_ON_STACK(), which by itself can > use up 512 bytes, but KASAN sometimes triples this number. However, I see > you do not actually have KASAN enabled, so there is probably more to it. > FYI, as an aside, the SHASH_DESC_ON_STACK() issue was fixed in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=660d2062190db131d2feaf19914e90f868fe285c (note that the size of SHASH_DESC_ON_STACK() accounts for two struct shash_desc instances) _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel