lkml.org 
[lkml]   [2020]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: BUG: stack guard page was hit in deref_stack_reg
On Sat, Mar 14, 2020 at 03:28:11AM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: 34a568a2 net: sgi: ioc3-eth: Remove phy workaround
> git tree: net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=103e69fde00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=598678fc6e800071
> dashboard link: https://syzkaller.appspot.com/bug?extid=2a3c14db0e17fe4c7409
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+2a3c14db0e17fe4c7409@syzkaller.appspotmail.com

This is a stack overflow caused by a recursive loop in the networking
code. This chain repeats until it runs out of stack:

> bond_compute_features.isra.0+0x521/0xa40 drivers/net/bonding/bond_main.c:1188
> bond_slave_netdev_event drivers/net/bonding/bond_main.c:3237 [inline]
> bond_netdev_event+0x6ee/0x930 drivers/net/bonding/bond_main.c:3277
> notifier_call_chain+0xc0/0x230 kernel/notifier.c:83
> call_netdevice_notifiers_info net/core/dev.c:1948 [inline]
> call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1933
> call_netdevice_notifiers_extack net/core/dev.c:1960 [inline]
> call_netdevice_notifiers net/core/dev.c:1974 [inline]
> netdev_features_change net/core/dev.c:1364 [inline]
> netdev_update_features net/core/dev.c:9082 [inline]
> netdev_update_features+0xc4/0xd0 net/core/dev.c:9079
> netdev_sync_lower_features net/core/dev.c:8891 [inline]
> __netdev_update_features+0x821/0x12f0 net/core/dev.c:9026
> netdev_change_features+0x61/0xb0 net/core/dev.c:9098
> bond_compute_features.isra.0+0x521/0xa40 drivers/net/bonding/bond_main.c:1188

--
Josh

\
 
 \ /
  Last update: 2020-03-15 15:50    [W:0.037 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site