[Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

[Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

[John]

Dear Linux Kernel Maintainers,

I hope this message finds you well.

I am writing to report a potential vulnerability I encountered during
testing of the Linux Kernel version v6.15-rc5.

Git Commit: 92a09c47464d040866cf2b4cd052bc60555185fb (tag: v6.15-rc5)

Bug Location: unwind_get_return_address+0x59/0xa0
arch/x86/kernel/unwind_orc.c:364

Bug report: https://hastebin.com/share/epuwikajob.bash

Complete log: https://hastebin.com/share/sumefafijo.perl

Entire kernel config:  https://hastebin.com/share/padecilimo.ini

Root Cause Analysis:
A soft lockup occurred on CPU0 due to a recursion or deadlock
involving __sanitizer_cov_trace_pc() during KCOV instrumentation.
The traced path includes slab deallocation (kmem_cache_free), task
exit handling (exit_task_work), and stack unwinding
(unwind_next_frame), which eventually leads to a GPF caused by
dereferencing current in a stale task context (FS=0).
This can be triggered repeatedly by malformed multicast socket setups
causing repeated IGMP autojoin failures and entering
trace-instrumented paths.

At present, I have not yet obtained a minimal reproducer for this
issue. However, I am actively working on reproducing it, and I will
promptly share any additional findings or a working reproducer as soon
as it becomes available.

Thank you very much for your time and attention to this matter. I
truly appreciate the efforts of the Linux kernel community.

Best regards,
John

Re: [Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

[Dave Hansen]

On 5/22/25 08:09, John wrote:
> I am writing to report a potential vulnerability I encountered during
> testing of the Linux Kernel version v6.15-rc5.

Hi John,

Could you tell us a little more about the overall environment here? It
seems like you're running syzkaller and just reporting whenever you see
a splat. Is that about right? Could you tell us a little more about why
you are doing this? What is your goal?

I think Steve's advice he gave you yesterday applies to this one as well:

> https://lore.kernel.org/all/20250521133137.1b2f2cac@gandalf.local.home/

Feel free to _run_ with KASAN enabled, but please don't report issues
unless you can reproduce without KASAN. Unless it's an actual KASAN
error report, of course.

But, in general syzkaller produces a ton of noise. Unless you have a
reproducer or a _clear_ bug, I'm not sure it's very worth sending these
reports. There's honestly not much we can do with them.

Re: [Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

[John]

Hello Dave,

Thank you very much for your prompt reply and kind support. Based on
your analysis, I will disable KASAN and attempt to reproduce the crash
accordingly.

I will keep you updated with any progress. I truly appreciate your
time and assistance.

Best regards,
John

On Thu, May 22, 2025 at 11:29 PM Dave Hansen <dave.hansen@intel.com> wrote:
>
> On 5/22/25 08:09, John wrote:
> > I am writing to report a potential vulnerability I encountered during
> > testing of the Linux Kernel version v6.15-rc5.
>
> Hi John,
>
> Could you tell us a little more about the overall environment here? It
> seems like you're running syzkaller and just reporting whenever you see
> a splat. Is that about right? Could you tell us a little more about why
> you are doing this? What is your goal?
>
> I think Steve's advice he gave you yesterday applies to this one as well:
>
> > https://lore.kernel.org/all/20250521133137.1b2f2cac@gandalf.local.home/
>
> Feel free to _run_ with KASAN enabled, but please don't report issues
> unless you can reproduce without KASAN. Unless it's an actual KASAN
> error report, of course.
>
> But, in general syzkaller produces a ton of noise. Unless you have a
> reproducer or a _clear_ bug, I'm not sure it's very worth sending these
> reports. There's honestly not much we can do with them.

Re: [Bug] "BUG: soft lockup in unwind_get_return_address" in Linux kernel v6.15-rc5

[Dave Hansen]

On 5/22/25 08:30, John wrote:
> Thank you very much for your prompt reply and kind support. Based on
> your analysis, I will disable KASAN and attempt to reproduce the crash
> accordingly.
> 
> I will keep you updated with any progress. I truly appreciate your
> time and assistance.

Hi John,

We also tend not to top-post our replies on this mailing list. It's just
one of out conventions. One way to show appreciation is to do your best
to follow those conventions.

Also I asked a few more questions:

> Could you tell us a little more about the overall environment here? It
> seems like you're running syzkaller and just reporting whenever you see
> a splat. Is that about right? Could you tell us a little more about why
> you are doing this? What is your goal?

I'd really appreciate if you could speak to some of that as well.