Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.117.160 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C
Message-ID: <1d8a8b32-920c-2c25-a530-c316c05adaea@nvidia.com>
Date:   Thu, 2 Feb 2023 15:10:10 -0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.1
Subject: Re: [syzbot] general protection fault in skb_dequeue (3)
Content-Language: en-US
To:     David Howells <dhowells@redhat.com>,
        David Hildenbrand <david@redhat.com>
CC:     syzbot <syzbot+a440341a59e3b7142895@syzkaller.appspotmail.com>,
        <davem@davemloft.net>, <edumazet@google.com>, <hch@lst.de>,
        <johannes@sipsolutions.net>, <kuba@kernel.org>,
        <linux-kernel@vger.kernel.org>, <linux-wireless@vger.kernel.org>,
        <netdev@vger.kernel.org>, <pabeni@redhat.com>,
        <syzkaller-bugs@googlegroups.com>
References: <000000000000b0b3c005f3a09383@google.com>
 <822863.1675327935@warthog.procyon.org.uk>
From:   John Hubbard <jhubbard@nvidia.com>
In-Reply-To: <822863.1675327935@warthog.procyon.org.uk>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Feb 2023 23:10:22.3959
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d2c596f6-8bbd-454b-e1fd-08db0572a926
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT094.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR12MB6822
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

On 2/2/23 00:52, David Howells wrote:
> Hi John, David,
> 
> Could you have a look at this?

Sure. So far, I have reproduced a crash using your simplified test
program (it required three simulaneous running copies), and will look
deeper now.

In case it illuminates anything, the crash looked like this (below), and
was obtained *without* setting KASAN. Also a minor point: this is from a
git branch of the last commit in the series (commit fd20d0c1852e "block:
convert bio_map_user_iov to use iov_iter_extract_pages"), rather than
from top of linux-next.

Kernel panic - not syncing: corrupted stack end detected inside scheduler
CPU: 2 PID: 27177 Comm: syzbot_howells Not tainted 6.2.0-rc5-hubbard-github+ #3
Hardware name: ASUS X299-A/PRIME X299-A, BIOS 1503 08/03/2018
Call Trace:
  <TASK>
  dump_stack_lvl+0x4c/0x63
  panic+0x113/0x2c4
  ? folio_wait_bit_common+0xf6/0x360
  __schedule+0xd1b/0xd20
  schedule+0x5d/0xe0
  io_schedule+0x42/0x70
  folio_wait_bit_common+0x123/0x360
  ? __pfx_wake_page_function+0x10/0x10
  folio_wait_writeback+0x24/0x100
  __filemap_fdatawait_range+0x7a/0x120
  ? filemap_fdatawrite_wbc+0x69/0x80
  ? __filemap_fdatawrite_range+0x58/0x80
  filemap_write_and_wait_range+0x84/0xb0
  __iomap_dio_rw+0x183/0x830
  ? __lock_acquire+0x3b4/0x2620
  iomap_dio_rw+0xe/0x40
  ext4_file_read_iter+0x141/0x1c0
  generic_file_splice_read+0x90/0x160
  splice_direct_to_actor+0xb1/0x210
  ? __pfx_direct_splice_actor+0x10/0x10
  do_splice_direct+0x8c/0xd0
  do_sendfile+0x352/0x600
  do_syscall_64+0x37/0x90
  entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f322d5116be
Code: c3 0f 1f 00 4c 89 d2 4c 89 c6 e9 fd fd ff ff 0f 1f 44 00 00 31 c0 c3 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 28 00 00 00 0f 05 <48> 3d 01 f0 ff ff8
RSP: 002b:00007ffd8c914538 EFLAGS: 00000202 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007ffd8c914678 RCX: 00007f322d5116be
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 0000000000000003 R08: 0000000000000001 R09: 00007f322d7f6740
R10: 000000000001dd00 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffd8c914690 R14: 0000558a11e29d78 R15: 00007f322d843020
  </TASK>

thanks,
-- 
John Hubbard
NVIDIA