linux-kernel - Re: BUG: kernel panic: corrupted stack end in worker

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANikGpcNj6P1jH8v0NjZJeQdn2=FbPr71CJ8W8GE+OeiCMgucA@mail.gmail.com>
Date: Thu, 29 Aug 2024 13:28:55 -0700
From: Juefei Pu <juefei.pu@...il.ucr.edu>
To: Jann Horn <jannh@...gle.com>
Cc: Juefei Pu <juefei.pu@...il.ucr.edu>, James.Bottomley@...senpartnership.com, 
	martin.petersen@...cle.com, linux-scsi@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Yu Hao <yhao016@....edu>
Subject: Re: BUG: kernel panic: corrupted stack end in worker_thread

Hi Jann,

I checked the kernel configuration we used and I found that we did
enable CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK during fuzzing.
I've uploaded the full configuration to
https://gist.github.com/TomAPU/64f5db0fe976a3e94a6dd2b621887cdd

On Thu, Aug 29, 2024 at 1:23 PM Jann Horn <jannh@...gle.com> wrote:
>
> On Wed, Aug 28, 2024 at 1:49 AM Juefei Pu <juefei.pu@...il.ucr.edu> wrote:
> > Hello,
> > We found the following issue using syzkaller on Linux v6.10.
> > The PoC generated by Syzkaller can have the kernel panic.
> > The full report including the Syzkaller reproducer:
> > https://gist.github.com/TomAPU/a96f6ccff8be688eb2870a71ef4d035d
> >
> > The brief report is below:
> >
> > Syzkaller hit 'kernel panic: corrupted stack end in worker_thread' bug.
> >
> > Kernel panic - not syncing: corrupted stack end detected inside scheduler
>
> I assume you're fuzzing without CONFIG_VMAP_STACK? Please make sure to
> set CONFIG_VMAP_STACK=y in your kernel config, that will give much
> better diagnostics when you hit a stack overrun like this, instead of
> causing random corruption and running into the corrupted stack end
> detection.
>
> (Note that if you're using KASAN, you have to enable
> CONFIG_KASAN_VMALLOC in order for CONFIG_VMAP_STACK to work.)