* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221211142633.2817-1-hdanton@sina.com>
@ 2022-12-11 14:57 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-11 14:57 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 000000000004057a x7 : ffff80000b229b58 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000d0b42478 x0 : ffff0000d0b41a40
Kernel panic - not syncing: kernel stack overflow
CPU: 0 PID: 3653 Comm: syz-executor.0 Not tainted 6.1.0-rc8-syzkaller-00164-g4cee37b3a4e6-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:907
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:549
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
do_group_exit+0x98/0xcc kernel/exit.c:950
get_signal+0xabc/0xb2c kernel/signal.c:2858
do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1071
do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1124
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,02070084,26017203
Memory Limit: none
Tested on:
commit: 4cee37b3 Merge tag 'mm-hotfixes-stable-2022-12-10-1' o..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=10391967880000
kernel config: https://syzkaller.appspot.com/x/.config?x=f24df90d6ec552dc
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=12366eb7880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221212020158.2902-1-hdanton@sina.com>
@ 2022-12-12 2:43 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-12 2:43 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+09329bd987ebca21bced@syzkaller.appspotmail.com
Tested on:
commit: 830b3c68 Linux 6.1
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=140d36b7880000
kernel config: https://syzkaller.appspot.com/x/.config?x=738c28d3ea17d420
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=153c5f2f880000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221211124724.2716-1-hdanton@sina.com>
@ 2022-12-11 13:06 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-11 13:06 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 0000000000040577 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000d0773eb8 x0 : ffff0000d0773480
Kernel panic - not syncing: kernel stack overflow
CPU: 0 PID: 3688 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00151-ge3cb714fb489-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
__arm64_sys_exit_group+0x0/0x18 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:959
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
Tested on:
commit: e3cb714f Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1684ffdf880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=171536b7880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221211025742.2396-1-hdanton@sina.com>
@ 2022-12-11 10:52 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-11 10:52 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 0000000000040578 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000d005beb8 x0 : ffff0000d005b480
Kernel panic - not syncing: kernel stack overflow
CPU: 0 PID: 3691 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00151-ge3cb714fb489-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1607
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
__arm64_sys_exit_group+0x0/0x18 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:959
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
Tested on:
commit: e3cb714f Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11cb4243880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=13d733db880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221210130803.2147-1-hdanton@sina.com>
@ 2022-12-10 18:36 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-10 18:36 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 0000000000040578 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000c900a478 x0 : ffff0000c9009a40
Kernel panic - not syncing: kernel stack overflow
CPU: 0 PID: 3647 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00151-ge3cb714fb489-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
do_group_exit+0x98/0xcc kernel/exit.c:950
get_signal+0xabc/0xb2c kernel/signal.c:2858
do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1076
do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
Tested on:
commit: e3cb714f Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14acf0cd880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=11916513880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] ` <20221209133214.1934-1-hdanton@sina.com>
@ 2022-12-09 14:19 ` Mark Rutland
0 siblings, 0 replies; 10+ messages in thread
From: Mark Rutland @ 2022-12-09 14:19 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot, john.fastabend, linux-kernel, netdev, syzkaller-bugs,
Robin Murphy
On Fri, Dec 09, 2022 at 09:32:14PM +0800, Hillf Danton wrote:
> On 9 Dec 2022 13:15:39 +0000 Mark Rutland <mark.rutland@arm.com>
> > On Thu, Dec 08, 2022 at 02:05:36AM -0800, syzbot wrote:
> > > Hello,
> > >
> > > syzbot found the following issue on:
> > >
> > > HEAD commit: e3cb714fb489 Merge branch 'for-next/core' into for-kernelci
> >
> > This commit has a known-broken parent where some uaccess copies appeared to
> > result in stack corruption:
> >
> > https://lore.kernel.org/linux-arm-kernel/Y44gVm7IEMXqilef@FVFF77S0Q05N.cambridge.arm.com/
> >
> > ... which has now been dropped from the arm64 for-next/core branch, but
> > anything found on commit e3cb714fb489 will be suspect due to that.
> >
> > This *might* a manifestation of the same issue; I'll have a go at reproducing
> > it locally.
>
> Take a look at the reproducer [1] before kicking off your Harley.
>
> [1] https://lore.kernel.org/lkml/00000000000073b14905ef2e7401@google.com/
Ah, yes; this is clearly not arm64-specific, and therefore has
nothing to do with the uaccess issue.
Sorry for the noise, and thanks for the pointer!
Mark.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
2022-12-08 10:05 syzbot
@ 2022-12-09 13:15 ` Mark Rutland
[not found] ` <20221209133214.1934-1-hdanton@sina.com>
1 sibling, 0 replies; 10+ messages in thread
From: Mark Rutland @ 2022-12-09 13:15 UTC (permalink / raw)
To: syzbot
Cc: bpf, davem, edumazet, jakub, john.fastabend, kuba, linux-kernel,
netdev, pabeni, syzkaller-bugs, Robin Murphy
Hi,
On Thu, Dec 08, 2022 at 02:05:36AM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: e3cb714fb489 Merge branch 'for-next/core' into for-kernelci
This commit has a known-broken parent where some uaccess copies appeared to
result in stack corruption:
https://lore.kernel.org/linux-arm-kernel/Y44gVm7IEMXqilef@FVFF77S0Q05N.cambridge.arm.com/
... which has now been dropped from the arm64 for-next/core branch, but
anything found on commit e3cb714fb489 will be suspect due to that.
This *might* a manifestation of the same issue; I'll have a go at reproducing
it locally.
Thanks,
Mark.
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d5c11d880000
> kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
> dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
> compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: arm64
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145daef3880000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1313d497880000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/832eb1866f2c/disk-e3cb714f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/5fd572b7d96d/vmlinux-e3cb714f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/34c82908beda/Image-e3cb714f.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+09329bd987ebca21bced@syzkaller.appspotmail.com
>
> x8 : 0000000000040574 x7 : ffff80000b22f58c x6 : 0000000000000000
> x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
> x2 : 0000000000000002 x1 : ffff0000c60f3eb8 x0 : ffff0000c60f3480
> Kernel panic - not syncing: kernel stack overflow
> CPU: 1 PID: 3074 Comm: syz-executor169 Not tainted 6.1.0-rc7-syzkaller-33097-ge3cb714fb489 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
> Call trace:
> dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
> show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
> dump_stack+0x1c/0x58 lib/dump_stack.c:113
> panic+0x218/0x508 kernel/panic.c:274
> nmi_panic+0xbc/0xf0 kernel/panic.c:169
> panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
> handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
> __bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
> mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
> lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
> __raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
> _raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
> spin_lock_bh include/linux/spinlock.h:355 [inline]
> lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
> lock_sock include/net/sock.h:1721 [inline]
> sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> sock_map_close+0x400/0x4bc
> inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
> inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
> __sock_release net/socket.c:650 [inline]
> sock_close+0x50/0xf0 net/socket.c:1365
> __fput+0x198/0x3e4 fs/file_table.c:320
> ____fput+0x20/0x30 fs/file_table.c:348
> task_work_run+0x100/0x148 kernel/task_work.c:179
> exit_task_work include/linux/task_work.h:38 [inline]
> do_exit+0x2dc/0xcac kernel/exit.c:820
> do_group_exit+0x98/0xcc kernel/exit.c:950
> get_signal+0xabc/0xb2c kernel/signal.c:2858
> do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1076
> do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1129
> prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
> exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
> el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
> el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
> el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
> SMP: stopping secondary CPUs
> Kernel Offset: disabled
> CPU features: 0x00000,040e0108,4c017203
> Memory Limit: none
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221208124151.8280-1-hdanton@sina.com>
@ 2022-12-08 22:30 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-08 22:30 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 0000000000040579 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000c79158f8 x0 : ffff0000c7914ec0
Kernel panic - not syncing: kernel stack overflow
CPU: 1 PID: 3696 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00151-ge3cb714fb489-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
do_group_exit+0x98/0xcc kernel/exit.c:950
get_signal+0xabc/0xb2c kernel/signal.c:2858
do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1076
do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
Tested on:
commit: e3cb714f Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=173b017d880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=16989433880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] kernel stack overflow in sock_close
[not found] <20221208111054.8178-1-hdanton@sina.com>
@ 2022-12-08 11:40 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2022-12-08 11:40 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel stack overflow in sock_close
x8 : 0000000000040579 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000d07b58f8 x0 : ffff0000d07b4ec0
Kernel panic - not syncing: kernel stack overflow
CPU: 0 PID: 3678 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00151-ge3cb714fb489-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
__arm64_sys_exit_group+0x0/0x18 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__wake_up_parent+0x0/0x40 kernel/exit.c:959
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197
el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
Tested on:
commit: e3cb714f Merge branch 'for-next/core' into for-kernelci
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16e5216b880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=11f86f5b880000
^ permalink raw reply [flat|nested] 10+ messages in thread
* [syzbot] kernel stack overflow in sock_close
@ 2022-12-08 10:05 syzbot
2022-12-09 13:15 ` Mark Rutland
[not found] ` <20221209133214.1934-1-hdanton@sina.com>
0 siblings, 2 replies; 10+ messages in thread
From: syzbot @ 2022-12-08 10:05 UTC (permalink / raw)
To: bpf, davem, edumazet, jakub, john.fastabend, kuba, linux-kernel,
netdev, pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: e3cb714fb489 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13d5c11d880000
kernel config: https://syzkaller.appspot.com/x/.config?x=ec7118319bfb771e
dashboard link: https://syzkaller.appspot.com/bug?extid=09329bd987ebca21bced
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=145daef3880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1313d497880000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/832eb1866f2c/disk-e3cb714f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5fd572b7d96d/vmlinux-e3cb714f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/34c82908beda/Image-e3cb714f.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+09329bd987ebca21bced@syzkaller.appspotmail.com
x8 : 0000000000040574 x7 : ffff80000b22f58c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : ffff0000c60f3eb8 x0 : ffff0000c60f3480
Kernel panic - not syncing: kernel stack overflow
CPU: 1 PID: 3074 Comm: syz-executor169 Not tainted 6.1.0-rc7-syzkaller-33097-ge3cb714fb489 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:156
show_stack+0x2c/0x54 arch/arm64/kernel/stacktrace.c:163
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x104/0x16c lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
panic+0x218/0x508 kernel/panic.c:274
nmi_panic+0xbc/0xf0 kernel/panic.c:169
panic_bad_stack+0x134/0x154 arch/arm64/kernel/traps.c:886
handle_bad_stack+0x34/0x48 arch/arm64/kernel/entry-common.c:849
__bad_stack+0x78/0x7c arch/arm64/kernel/entry.S:552
mark_lock+0x4/0x1b4 kernel/locking/lockdep.c:4595
lock_acquire+0x100/0x1f8 kernel/locking/lockdep.c:5668
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x54/0x6c kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:355 [inline]
lock_sock_nested+0x88/0xd8 net/core/sock.c:3450
lock_sock include/net/sock.h:1721 [inline]
sock_map_close+0x30/0x4bc net/core/sock_map.c:1610
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
sock_map_close+0x400/0x4bc
inet_release+0xc8/0xe4 net/ipv4/af_inet.c:428
inet6_release+0x3c/0x58 net/ipv6/af_inet6.c:488
__sock_release net/socket.c:650 [inline]
sock_close+0x50/0xf0 net/socket.c:1365
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
do_group_exit+0x98/0xcc kernel/exit.c:950
get_signal+0xabc/0xb2c kernel/signal.c:2858
do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1076
do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x150 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x00000,040e0108,4c017203
Memory Limit: none
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2022-12-12 2:43 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20221211142633.2817-1-hdanton@sina.com>
2022-12-11 14:57 ` [syzbot] kernel stack overflow in sock_close syzbot
[not found] <20221212020158.2902-1-hdanton@sina.com>
2022-12-12 2:43 ` syzbot
[not found] <20221211124724.2716-1-hdanton@sina.com>
2022-12-11 13:06 ` syzbot
[not found] <20221211025742.2396-1-hdanton@sina.com>
2022-12-11 10:52 ` syzbot
[not found] <20221210130803.2147-1-hdanton@sina.com>
2022-12-10 18:36 ` syzbot
[not found] <20221208124151.8280-1-hdanton@sina.com>
2022-12-08 22:30 ` syzbot
[not found] <20221208111054.8178-1-hdanton@sina.com>
2022-12-08 11:40 ` syzbot
2022-12-08 10:05 syzbot
2022-12-09 13:15 ` Mark Rutland
[not found] ` <20221209133214.1934-1-hdanton@sina.com>
2022-12-09 14:19 ` Mark Rutland
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).