From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 033E7C433DB for ; Tue, 16 Mar 2021 10:18:00 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6129365023 for ; Tue, 16 Mar 2021 10:17:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6129365023 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D454D6B006E; Tue, 16 Mar 2021 06:17:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CF4E16B0070; Tue, 16 Mar 2021 06:17:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BBC716B0071; Tue, 16 Mar 2021 06:17:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0132.hostedemail.com [216.40.44.132]) by kanga.kvack.org (Postfix) with ESMTP id A11536B006E for ; Tue, 16 Mar 2021 06:17:58 -0400 (EDT) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 690A18249980 for ; Tue, 16 Mar 2021 10:17:58 +0000 (UTC) X-FDA: 77925336636.21.304B8EA Received: from mail-qt1-f173.google.com (mail-qt1-f173.google.com [209.85.160.173]) by imf20.hostedemail.com (Postfix) with ESMTP id EA1BCD7 for ; Tue, 16 Mar 2021 10:17:57 +0000 (UTC) Received: by mail-qt1-f173.google.com with SMTP id x9so11208135qto.8 for ; Tue, 16 Mar 2021 03:17:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=eFQPVLUfS53IJIXq7EsY2KvnwcOJrlsdzLKjZq2BXDY=; b=fUXspIhe4anHCXrLL7/6HWBV51o5i52Sepbas3YvuBJJQqOxGi1Q6dIpdMoFteNiAc Hf2jwwtlEcoBAEMTMq4HF2rCF5qlnYbca9Jo8WPWi0ufHJt+JcsFezmBEZ+/4AvvtYT0 aoSnMKmomgxVY+COSxxGoOc6gxx0NlnsafuaCXjXVZG9cI3Y4NPkt4tfevqcd8i0uCCB HtSyEVSXqZSsID+nVqqYIwXvNzrARebAcSiXxg9DOMWcwa2X0OWBq+wSAXISRGAMA0r1 Uh1nir4VmWooaNbvXAS+fraTgXXrpvkurwFNjCRIUgFsSJ31Ta6Ve4NecUBo9LUwsmTp /DKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=eFQPVLUfS53IJIXq7EsY2KvnwcOJrlsdzLKjZq2BXDY=; b=SlQQV3WoX7HPeVmjJsdWHHCw2LtX4XUk3Y2pC5YISKKLcr4rMpp12Bds2uNPKAaVU1 tmTku/kIdgIww3+b/EimHOx/XSL7s7XxNjvUgAlEXao3sIxnC6nrqz8mIOPkKwpO8u71 5Jl3f2F2XRXgrpvzJUkChD/FmDpjlFl44FJW0B129Uli/wGtWZ6+ATmjkq8AeZkgkkXC IfHFjPhstNgGavlaHsMd9dihND03NWFGb7wlqjtXPYuStltsJEn/iLRolQxeHk0KpBky d+w+h06qwVVa5f0WuJXt/tytQsY4I2yQNOwjWbmG5PHF4jAhQ3IPbTiOZrjltxDNM7jo +bbA== X-Gm-Message-State: AOAM5302y4Ah0ZKL7xar8QJc7IRnaO0HKmHVWXcr5SqGredH9o9r4ZPr obQPfjr1pxU+4hW6EZlKjUba5WRloJS3Atpm0vglqA== X-Google-Smtp-Source: ABdhPJyrXdmYgwLW+yfTnxygbHdMoq3RO7SC7RN94L7krldLOgF8gr2zvcrbMSKWZX9r1msisPxjBQrY95SB8Ipcf3I= X-Received: by 2002:aed:2c61:: with SMTP id f88mr26277893qtd.337.1615889877043; Tue, 16 Mar 2021 03:17:57 -0700 (PDT) MIME-Version: 1.0 References: <00000000000069802205bda22b7f@google.com> In-Reply-To: From: Dmitry Vyukov Date: Tue, 16 Mar 2021 11:17:45 +0100 Message-ID: Subject: Re: [syzbot] kernel panic: corrupted stack end in openat To: Arnd Bergmann Cc: syzbot , Russell King - ARM Linux , Linus Walleij , Linux ARM , Andrew Morton , LKML , Linux-MM , syzkaller-bugs Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: u1i3sw1h4ftnmdnyysr8qj9cssm8xycc X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: EA1BCD7 Received-SPF: none (google.com>: No applicable sender policy available) receiver=imf20; identity=mailfrom; envelope-from=""; helo=mail-qt1-f173.google.com; client-ip=209.85.160.173 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1615889877-367386 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Mar 16, 2021 at 11:02 AM Arnd Bergmann wrote: > > On Tue, Mar 16, 2021 at 8:18 AM syzbot > > wrote: > > > > > > Hello, > > > > > > syzbot found the following issue on: > > > > > > HEAD commit: 1e28eed1 Linux 5.12-rc3 > > > git tree: upstream > > > console output: https://syzkaller.appspot.com/x/log.txt?x=167535e6d00000 > > > kernel config: https://syzkaller.appspot.com/x/.config?x=e0cee1f53de33ca3 > > > dashboard link: https://syzkaller.appspot.com/bug?extid=0b06ef9b44d00d600183 > > > userspace arch: arm > > > > > > Unfortunately, I don't have any reproducer for this issue yet. > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > Reported-by: syzbot+0b06ef9b44d00d600183@syzkaller.appspotmail.com > > > > +arm32 maintainer > > I think this is a real stack overflow on arm32, the stack is indeed deep. > > Nice find. I see there was already a second report, so it seems to be > reproducible as well. > If you are able to trigger this reliably, you could try printing the frame > pointer while unwinding to see what is actually going on: > > --- a/arch/arm/kernel/traps.c > +++ b/arch/arm/kernel/traps.c > @@ -68,8 +68,8 @@ void dump_backtrace_entry(unsigned long where, > unsigned long from, > unsigned long end = frame + 4 + sizeof(struct pt_regs); > > #ifdef CONFIG_KALLSYMS > - printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", > - loglvl, where, (void *)where, from, (void *)from); > + printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS), frame %08lx\n", > + loglvl, where, (void *)where, from, (void *)from, frame); > #else > printk("%sFunction entered at [<%08lx>] from [<%08lx>]\n", > loglvl, where, from); > > If that doesn't help, I could have a look at the binary to see which > functions in the call chain take a lot of stack space, if any. > > Which exact compiler version do you use for building these > kernels? I can try doing a build with the same commit and config. > > This one function is one that I have seen before when looking at build > warnings with KASAN: > > > > [<8073772c>] (integrity_kernel_read) from [<8073a904>] (ima_calc_file_hash_tfm+0x178/0x228 security/integrity/ima/ima_crypto.c:484) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]) > > > [<8073a78c>] (ima_calc_file_hash_tfm) from [<8073ae2c>] (ima_calc_file_hash+0x124/0x8b8 security/integrity/ima/ima_crypto.c:572) > > ima_calc_file_hash_tfm() has a SHASH_DESC_ON_STACK(), which by itself can > use up 512 bytes, but KASAN sometimes triples this number. However, I see > you do not actually have KASAN enabled, so there is probably more to it. The compiler is gcc version 10.2.1 20210110 (Debian 10.2.1-6) It's available in gcr.io/syzkaller/syzbot container. (syzbot should have been provided the compiler version, something broke, I've filed https://github.com/google/syzkaller/issues/2498 for this) Yes, KASAN is not enabled on arm32 for now. Re printing FP, syzbot does not use custom patches: http://bit.do/syzbot#no-custom-patches But this does not seem to be syzbot-specific. It seems that any arm32 stack overflow report will be unactionable, so I think it would be useful to include this into the mainline kernel to make overflow reports useful for everybody (and for syzbot as a side effect).