[BUG] sunrpc: rpc_pipe_msg left queued on a stack frame (nfsd cld upcall)

[Farhad Alemi]

Hello Chuck Lever, Jeff Layton,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/118-nfsd-cld-stack-rpc_pipe_msg-left-queued/

  ==================================================================
  BUG: KASAN: vmalloc-out-of-bounds in
__list_add_valid_or_report+0x6a/0x130 lib/list_debug.c:32
  Read of size 8 at addr ffffc90007027950 by task syz.0.96/13066
  CPU: 0 UID: 0 PID: 13066 Comm: syz.0.96 Not tainted 7.1.0-rc5 #1 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Call Trace:
  <TASK>
  dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
  print_address_description+0x55/0x1e0 mm/kasan/report.c:378

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,