kernel panic: corrupted stack end in wb_workfn

Status: fixed on 2019/04/10 16:37
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+ec1b7575afef85a0e5ca@syzkaller.appspotmail.com
Fix commit: ef82bcfa671b sctp: use memdup_user instead of vmemdup_user
First crash: 2775d, last: 2775d
Cause bisection: introduced by (bisect log) :
commit c981f254cc82f50f8cb864ce6432097b23195b9c
Author: Al Viro <viro@zeniv.linux.org.uk>
Date: Sun Jan 7 18:19:09 2018 +0000

  sctp: use vmemdup_user() rather than badly open-coding memdup_user()

Crash: kernel panic: Out of memory and no killable processes... (log)
Repro: C syz .config
  
▶ ▼ Duplicate bugs (6)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (6) ext4 10 syz 7 2677d 2775d 0/29 closed as dup on 2018/12/31 07:50
BUG: unable to handle kernel NULL pointer dereference in unlink_file_vma mm 10 1 2857d 2775d 0/29 closed as dup on 2018/12/31 07:49
KASAN: stack-out-of-bounds Read in __schedule (2) kernel 17 syz, C 1 2800d 2799d 0/29 closed as dup on 2018/12/31 06:38
BUG: unable to handle kernel NULL pointer dereference in depot_save_stack kernfs 10 1 2799d 2796d 0/29 closed as dup on 2018/12/31 07:06
BUG: unable to handle kernel NULL pointer dereference in kmem_cache_free (2) mm 10 4 2725d 2775d 0/29 closed as dup on 2018/12/31 07:32
general protection fault in rb_next (2) kernel 2 2 2768d 2775d 0/29 closed as dup on 2018/12/31 07:15
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH 5.0 000/146] 5.0.6-stable review 155 (155) 2019/04/03 08:56
[PATCH 4.19 000/134] 4.19.33-stable review 140 (140) 2019/04/02 23:34
kernel panic: corrupted stack end in wb_workfn 15 (17) 2019/03/21 11:41
[PATCH net] sctp: use memdup_user instead of vmemdup_user 3 (3) 2019/03/20 18:10

Sample crash report:
pde_opener                13KB         19KB
seq_file                 410KB       1295KB
sigqueue                 212KB        283KB
kernfs_node_cache       9257KB       9264KB
mnt_cache                 91KB         96KB
Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 4.20.0+ #175
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d3/0x2c6 lib/dump_stack.c:113
 panic+0x2ad/0x55f kernel/panic.c:189
 schedule_debug kernel/sched/core.c:3285 [inline]
 __schedule+0x1ec6/0x1ed0 kernel/sched/core.c:3394
filp                    8489KB       8808KB
 preempt_schedule_notrace+0x70/0x140 kernel/sched/core.c:3670
 ___preempt_schedule_notrace+0x16/0x31
 rcu_is_watching+0x23/0x30 kernel/rcu/tree.c:933
 rcu_read_lock+0x43/0x70 include/linux/rcupdate.h:608
 mem_cgroup_iter+0x208/0x1160 mm/memcontrol.c:934
 shrink_node+0x35e/0x17f0 mm/vmscan.c:2721
names_cache           101473KB     101515KB
iint_cache                66KB         67KB
 shrink_zones mm/vmscan.c:2987 [inline]
 do_try_to_free_pages+0x3df/0x12a0 mm/vmscan.c:3049
 try_to_free_pages+0x4d0/0xb90 mm/vmscan.c:3265
 __perform_reclaim mm/page_alloc.c:3920 [inline]
 __alloc_pages_direct_reclaim mm/page_alloc.c:3942 [inline]
 __alloc_pages_slowpath+0xa5a/0x2db0 mm/page_alloc.c:4335
inode_smack             5398KB       6378KB
key_jar                    3KB          7KB
 __alloc_pages_nodemask+0xa89/0xde0 mm/page_alloc.c:4549
 alloc_pages_current+0x10c/0x210 mm/mempolicy.c:2106
 alloc_pages include/linux/gfp.h:509 [inline]
 __page_cache_alloc+0x38c/0x5b0 mm/filemap.c:924
 pagecache_get_page+0x396/0xf00 mm/filemap.c:1615
uts_namespace              3KB          7KB
nsproxy                    3KB          3KB
 find_or_create_page include/linux/pagemap.h:322 [inline]
 grow_dev_page fs/buffer.c:947 [inline]
 grow_buffers fs/buffer.c:1016 [inline]
 __getblk_slow fs/buffer.c:1043 [inline]
 __getblk_gfp+0x3aa/0xd50 fs/buffer.c:1320
 sb_getblk include/linux/buffer_head.h:325 [inline]
 ext4_read_block_bitmap_nowait+0x314/0x1f50 fs/ext4/balloc.c:427
vm_area_struct         19806KB      20395KB
mm_struct               5695KB       6656KB
 ext4_read_block_bitmap+0x1f/0x90 fs/ext4/balloc.c:527
 ext4_mb_mark_diskspace_used+0x19e/0x10d0 fs/ext4/mballoc.c:2938
 ext4_mb_new_blocks+0xea5/0x4840 fs/ext4/mballoc.c:4555
fs_cache                 511KB        680KB
 ext4_ext_map_blocks+0x2eef/0x6180 fs/ext4/extents.c:4404
files_cache             1926KB       2343KB
signal_cache            3245KB       3910KB
sighand_cache            455KB        492KB
 ext4_map_blocks+0x8f7/0x1b60 fs/ext4/inode.c:636
 mpage_map_one_extent fs/ext4/inode.c:2480 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2533 [inline]
 ext4_writepages+0x2564/0x4170 fs/ext4/inode.c:2884
 do_writepages+0x9a/0x1a0 mm/page-writeback.c:2335
task_struct            13470KB      13525KB
 __writeback_single_inode+0x20a/0x1660 fs/fs-writeback.c:1316
cred_jar                2570KB       2816KB
 writeback_sb_inodes+0x71f/0x1210 fs/fs-writeback.c:1580
 __writeback_inodes_wb+0x1b9/0x340 fs/fs-writeback.c:1649
 wb_writeback+0xa73/0xfc0 fs/fs-writeback.c:1758
anon_vma_chain         10285KB      11588KB
anon_vma                 132KB        523KB
 wb_check_start_all fs/fs-writeback.c:1882 [inline]
 wb_do_writeback fs/fs-writeback.c:1908 [inline]
 wb_workfn+0xee9/0x1790 fs/fs-writeback.c:1942
 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153
pid                      277KB        368KB
 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
Acpi-Operand             155KB        194KB
Acpi-ParseExt              8KB         11KB
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/30 22:29 upstream 195303136f19 9942de5f .config console log report syz C ci-upstream-kasan-gce-smack-root
2018/12/30 22:26 upstream 195303136f19 9942de5f .config console log report syz C ci-upstream-kasan-gce-selinux-root
2018/12/30 22:24 upstream 195303136f19 9942de5f .config console log report syz C ci-upstream-kasan-gce-root
2018/12/30 22:01 upstream 195303136f19 9942de5f .config console log report syz C ci-upstream-kasan-gce
2018/12/30 22:28 net-next-old b71acb0e3721 9942de5f .config console log report syz C ci-upstream-net-kasan-gce
2018/12/30 22:59 linux-next 6a1d293238c1 9942de5f .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2018/12/31 07:17 upstream 195303136f19 2b42fdc8 .config console log report ci-upstream-kasan-gce-root
2018/12/31 05:26 upstream 195303136f19 2b42fdc8 .config console log report ci-upstream-kasan-gce-selinux-root
2018/12/31 05:25 upstream 195303136f19 2b42fdc8 .config console log report ci-upstream-kasan-gce-smack-root
2018/12/30 21:25 upstream 195303136f19 9942de5f .config console log report ci-upstream-kasan-gce
2018/12/30 21:29 upstream 195303136f19 9942de5f .config console log report ci-upstream-kasan-gce-386
2018/12/31 05:49 linux-next 6a1d293238c1 2b42fdc8 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/12/30 23:18 linux-next 6a1d293238c1 9942de5f .config console log report ci-upstream-linux-next-kasan-gce-root
2018/12/30 23:17 linux-next 6a1d293238c1 9942de5f .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.