Hi, We found a bug in Linux 6.10 using syzkaller. It is possibly a corrupted stack bug. The reprodcuer is https://gist.github.com/freexxxyyy/9025a217d3002b14deca0b14768c6f97 The bug report is: Syzkaller hit 'kernel panic: corrupted stack end in sg_ioctl' bug. Kernel panic - not syncing: corrupted stack end detected inside scheduler CPU: 0 PID: 8135 Comm: syz-executor302 Not tainted 6.10.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x23d/0x360 lib/dump_stack.c:114 panic+0x331/0x850 kernel/panic.c:347 schedule_debug+0x2a8/0x3f0 kernel/sched/core.c:5964 __schedule+0x12b/0x15e0 kernel/sched/core.c:6630 __schedule_loop kernel/sched/core.c:6825 [inline] schedule+0x143/0x310 kernel/sched/core.c:6840 schedule_timeout+0x1b9/0x300 kernel/time/timer.c:2581 io_schedule_timeout+0x96/0x120 kernel/sched/core.c:9034 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common_io+0x31c/0x620 kernel/sched/completion.c:133 blk_wait_io block/blk.h:82 [inline] blk_execute_rq+0x369/0x4a0 block/blk-mq.c:1408 sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:593 [inline] scsi_ioctl+0x20fc/0x2c70 drivers/scsi/scsi_ioctl.c:901 sg_ioctl_common drivers/scsi/sg.c:1109 [inline] sg_ioctl+0x16c3/0x2d50 drivers/scsi/sg.c:1163 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x7e/0x150 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f63634e0e0d Code: c3 e8 37 25 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f636347c1a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f636357d088 RCX: 00007f63634e0e0d RDX: 0000000020000080 RSI: 0000000000000001 RDI: 0000000000000003 RBP: 00007f636357d080 R08: 00007f636347c640 R09: 00007f636347c640 R10: 00007f636347c640 R11: 0000000000000246 R12: 00007f636357d08c R13: 00007f63635412b4 R14: 2367732f7665642f R15: 00007f636345c000 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. -- Yours sincerely, Xingyu
