Messages in this thread |  | | From | Jann Horn <> | Date | Tue, 4 Feb 2020 14:02:58 +0100 | Subject | unbounded recursion through bond_netdev_event notifier? [was: BUG: stack guard page was hit in update_stack_state] |
| |
On Tue, Feb 4, 2020 at 5:43 AM syzbot <syzbot+c2fb6f9ddcea95ba49b5@syzkaller.appspotmail.com> wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: b3a60822 Merge branch 'for-v5.6' of git://git.kernel.org:/.. > git tree: net-next > console output: https://syzkaller.appspot.com/x/log.txt?x=147ae5f1e00000
In the console output, you can see that this seems to be an unbounded recursion bug. The stack trace is unreliable, but it looks like the actual recursion might be something like the following, where a netdev change triggers the bond_netdev_event notifier, which in turn causes another netdev change, and so on:
[ 734.548523][T28658] ? netdev_lower_get_next_private+0x85/0xb0 [ 734.554632][T28658] ? bond_compute_features.isra.0+0x56a/0xa80 [inlined bond_slave_netdev_event ?] [ 734.572769][T28658] ? bond_netdev_event+0x71a/0x950 [ 734.577901][T28658] ? notifier_call_chain+0xc2/0x230 [ 734.583113][T28658] ? raw_notifier_call_chain+0x2e/0x40 [ 734.588589][T28658] ? call_netdevice_notifiers_info+0xba/0x130 [ 734.594765][T28658] ? netdev_update_features+0xc7/0xd0 [ 734.600142][T28658] ? __netdev_update_features+0x13e0/0x13e0 [...] [ 734.617522][T28658] ? netdev_upper_get_next_dev_rcu+0xac/0x110 [ 734.623605][T28658] ? __netdev_update_features+0x8af/0x13e0 [...] [ 734.649988][T28658] ? netdev_change_features+0x64/0xb0 [...]
> kernel config: https://syzkaller.appspot.com/x/.config?x=614e56d86457f3a7
says CONFIG_UNWINDER_FRAME_POINTER=y. Unfortunately, the x86 frame pointer unwinder apparently can't unwind out of a double fault... maybe it'd be better to use ORC for syzkaller?
> dashboard link: https://syzkaller.appspot.com/bug?extid=c2fb6f9ddcea95ba49b5 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > > Unfortunately, I don't have any reproducer for this crash yet. > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+c2fb6f9ddcea95ba49b5@syzkaller.appspotmail.com
|  |