| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <000000000000c2d38506201fb72e@google.com> Date: Tue, 20 Aug 2024 09:14:19 -0700 From: syzbot <syzbot+107a9ed6ac26198d4907@...kaller.appspotmail.com> To: linux-kernel@...r.kernel.org, luto@...nel.org, peterz@...radead.org, syzkaller-bugs@...glegroups.com, tglx@...utronix.de Subject: [syzbot] [kernel?] kernel panic: stack is corrupted in __schedule (4) Hello, syzbot found the following issue on: HEAD commit: 2c8159388952 Merge tag 'rust-fixes-6.9' of https://github... git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1301d2f8980000 kernel config: https://syzkaller.appspot.com/x/.config?x=3d46aa9d7a44f40d dashboard link: https://syzkaller.appspot.com/bug?extid=107a9ed6ac26198d4907 compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/c3e1ea802fa3/disk-2c815938.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/08cefa730085/vmlinux-2c815938.xz kernel image: https://storage.googleapis.com/syzbot-assets/8631cb2022d3/bzImage-2c815938.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+107a9ed6ac26198d4907@...kaller.appspotmail.com loop2: detected capacity change from 0 to 4096 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __schedule+0x2482/0x4a00 CPU: 1 PID: 16674 Comm: syz-executor.2 Not tainted 6.9.0-rc5-syzkaller-00355-g2c8159388952 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 panic+0x349/0x860 kernel/panic.c:348 __stack_chk_fail+0x15/0x20 kernel/panic.c:780 __schedule+0x2482/0x4a00 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7068 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:707 RIP: 0010:write_inode_now+0x0/0x260 fs/fs-writeback.c:2801 Code: 96 cd 7f ff e9 9f fe ff ff e8 8c cd 7f ff 90 0f 0b 90 eb a2 e8 71 4c 61 09 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 RSP: 0018:ffffc900110f78a8 EFLAGS: 00000286 RAX: 0000000080000000 RBX: dffffc0000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880603af850 RBP: 0000000000000010 R08: ffff8880603af8db R09: 1ffff1100c075f1b R10: dffffc0000000000 R11: ffffed100c075f1c R12: ffff8880603af928 R13: ffff8880603af850 R14: ffff8880603afa58 R15: ffff8880603af8d8 iput_final fs/inode.c:1728 [inline] iput+0x5d7/0x930 fs/inode.c:1767 ntfs_fill_super+0x3ff0/0x49c0 fs/ntfs3/super.c:1480 get_tree_bdev+0x3f7/0x570 fs/super.c:1614 vfs_get_tree+0x90/0x2a0 fs/super.c:1779 do_new_mount+0x2be/0xb40 fs/namespace.c:3352 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f745fe7f5aa Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f7460babef8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f7460babf80 RCX: 00007f745fe7f5aa RDX: 000000002001f700 RSI: 000000002001f740 RDI: 00007f7460babf40 RBP: 000000002001f700 R08: 00007f7460babf80 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000002001f740 R13: 00007f7460babf40 R14: 000000000001f6cc R15: 000000002001f780 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess), 2 bytes skipped: 0: 7f ff jg 0x1 2: e9 9f fe ff ff jmp 0xfffffea6 7: e8 8c cd 7f ff call 0xff7fcd98 c: 90 nop d: 0f 0b ud2 f: 90 nop 10: eb a2 jmp 0xffffffb4 12: e8 71 4c 61 09 call 0x9614c88 17: 90 nop 18: 90 nop 19: 90 nop 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: 90 nop 25: 90 nop 26: 90 nop 27: 90 nop * 28: f3 0f 1e fa endbr64 <-- trapping instruction 2c: 55 push %rbp 2d: 48 89 e5 mov %rsp,%rbp 30: 41 57 push %r15 32: 41 56 push %r14 34: 41 55 push %r13 36: 41 54 push %r12 38: 53 push %rbx 39: 48 83 e4 e0 and $0xffffffffffffffe0,%rsp 3d: 48 rex.W --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@...glegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
Powered by blists - more mailing lists