unbounded recursion through bond_netdev_event notifier? [was: BUG: stack guard page was hit in update_stack_state]

[Jann Horn]

On Tue, Feb 4, 2020 at 5:43 AM syzbot
<syzbot+c2fb6f9ddcea95ba49b5@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit:    b3a60822 Merge branch 'for-v5.6' of git://git.kernel.org:/..
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=147ae5f1e00000

In the console output, you can see that this seems to be an unbounded
recursion bug. The stack trace is unreliable, but it looks like the
actual recursion might be something like the following, where a netdev
change triggers the bond_netdev_event notifier, which in turn causes
another netdev change, and so on:

[  734.548523][T28658]  ? netdev_lower_get_next_private+0x85/0xb0
[  734.554632][T28658]  ? bond_compute_features.isra.0+0x56a/0xa80
[inlined bond_slave_netdev_event ?]
[  734.572769][T28658]  ? bond_netdev_event+0x71a/0x950
[  734.577901][T28658]  ? notifier_call_chain+0xc2/0x230
[  734.583113][T28658]  ? raw_notifier_call_chain+0x2e/0x40
[  734.588589][T28658]  ? call_netdevice_notifiers_info+0xba/0x130
[  734.594765][T28658]  ? netdev_update_features+0xc7/0xd0
[  734.600142][T28658]  ? __netdev_update_features+0x13e0/0x13e0
[...]
[  734.617522][T28658]  ? netdev_upper_get_next_dev_rcu+0xac/0x110
[  734.623605][T28658]  ? __netdev_update_features+0x8af/0x13e0
[...]
[  734.649988][T28658]  ? netdev_change_features+0x64/0xb0
[...]


> kernel config:  https://syzkaller.appspot.com/x/.config?x=614e56d86457f3a7

says CONFIG_UNWINDER_FRAME_POINTER=y. Unfortunately, the x86 frame
pointer unwinder apparently can't unwind out of a double fault...
maybe it'd be better to use ORC for syzkaller?

> dashboard link: https://syzkaller.appspot.com/bug?extid=c2fb6f9ddcea95ba49b5
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
>
> Unfortunately, I don't have any reproducer for this crash yet.
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+c2fb6f9ddcea95ba49b5@xxxxxxxxxxxxxxxxxxxxxxxxx