BUG: unable to handle kernel NULL pointer dereference in depot_save_stack

Hello,

syzbot found the following crash on:

HEAD commit:    b72f711a4efa Merge branch 'spectre' of git://git.armlinux...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11eef243400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b9cc5a440391cbfd
dashboard link: https://syzkaller.appspot.com/bug?extid=ed56d5a9b979d862fb67
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)

CC: [[email protected] [email protected]
[email protected]]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by [email protected]

IPVS: ftp: loaded support on port[0] = 21

BUG: unable to handle kernel NULL pointer dereference at 0000000000000009
PGD 1b3eee067 P4D 1b3eee067 PUD 1b3eef067 PMD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 20236 Comm: syz-executor1 Not tainted 4.20.0-rc5+ #366
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 20 0a 2e 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff
49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08
75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff888180156d08 EFLAGS: 00010202
RAX: 0000000047977639 RBX: 00000000fef8ec23 RCX: ffff888180156d68
RDX: 000000001e65b1bd RSI: 00000000006080c0 RDI: 0000000000000018
RBP: ffff888180156d40 R08: 00000000000000b8 R09: 00000000dc2cc839
R10: 00000000fafaa4f6 R11: ffff8881dae2dafb R12: 0000000000000001
R13: ffff888180156d50 R14: 000000000008ec23 R15: ffff8881bba6641f
FS:  0000000000d33940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000009 CR3: 00000001b3ecd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  save_stack+0xa9/0xd0 mm/kasan/kasan.c:454
  set_track mm/kasan/kasan.c:460 [inline]
  kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
  kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
  slab_post_alloc_hook mm/slab.h:444 [inline]
  slab_alloc mm/slab.c:3392 [inline]
  kmem_cache_alloc+0x11b/0x730 mm/slab.c:3552
  kmem_cache_zalloc include/linux/slab.h:731 [inline]
  __kernfs_new_node+0x127/0x8d0 fs/kernfs/dir.c:634
  kernfs_new_node+0x95/0x120 fs/kernfs/dir.c:695
  __kernfs_create_file+0x5a/0x340 fs/kernfs/file.c:992
  sysfs_add_file_mode_ns+0x222/0x530 fs/sysfs/file.c:306
  sysfs_create_file_ns+0x1a3/0x270 fs/sysfs/file.c:331
  sysfs_create_file include/linux/sysfs.h:513 [inline]
  device_create_file+0xf4/0x1e0 drivers/base/core.c:1381
  device_add+0x48c/0x18e0 drivers/base/core.c:1889
  netdev_register_kobject+0x187/0x3f0 net/core/net-sysfs.c:1751
  register_netdevice+0x99a/0x11d0 net/core/dev.c:8536
  register_netdev+0x30/0x50 net/core/dev.c:8651
  loopback_net_init+0x78/0x160 drivers/net/loopback.c:212
  ops_init+0x101/0x560 net/core/net_namespace.c:129
  setup_net+0x362/0x8d0 net/core/net_namespace.c:314
  copy_net_ns+0x2b1/0x4a0 net/core/net_namespace.c:437
  create_new_namespaces+0x6ad/0x900 kernel/nsproxy.c:107
  unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:206
  ksys_unshare+0x79c/0x10b0 kernel/fork.c:2539
  __do_sys_unshare kernel/fork.c:2607 [inline]
  __se_sys_unshare kernel/fork.c:2605 [inline]
  __x64_sys_unshare+0x31/0x40 kernel/fork.c:2605
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45a057
Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 fd 88 fb ff c3

66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 dd 88 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:0000000000a3ff78 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f2516b77000 RCX: 000000000045a057
RDX: 0000000000000006 RSI: 0000000000a3fa90 RDI: 0000000040000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000064 R11: 0000000000000202 R12: 0000000000000010
R13: 0000000000412e50 R14: 0000000000000000 R15: 0000000000000000

Modules linked in:
CR2: 0000000000000009
---[ end trace 8ed3c6a41fc89e09 ]---
RIP: 0010:find_stack lib/stackdepot.c:188 [inline]
RIP: 0010:depot_save_stack+0x121/0x470 lib/stackdepot.c:238
Code: 0f 00 4e 8b 24 f5 20 0a 2e 8b 4d 85 e4 0f 84 d4 00 00 00 44 8d 47 ff
49 c1 e0 03 eb 0d 4d 8b 24 24 4d 85 e4 0f 84 bd 00 00 00 <41> 39 5c 24 08
75 ec 41 3b 7c 24 0c 75 e5 48 8b 01 49 39 44 24 18
RSP: 0018:ffff888180156d08 EFLAGS: 00010202
RAX: 0000000047977639 RBX: 00000000fef8ec23 RCX: ffff888180156d68
RDX: 000000001e65b1bd RSI: 00000000006080c0 RDI: 0000000000000018
RBP: ffff888180156d40 R08: 00000000000000b8 R09: 00000000dc2cc839
R10: 00000000fafaa4f6 R11: ffff8881dae2dafb R12: 0000000000000001
R13: ffff888180156d50 R14: 000000000008ec23 R15: ffff8881bba6641f
FS:  0000000000d33940(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000009 CR3: 00000001b3ecd000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

---
This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at [email protected].

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.

--
You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/0000000000004fa95e057ca3b6c3%40google.com.
For more options, visit https://groups.google.com/d/optout.