[BUG] sunrpc: rpc_pipe_msg left queued on a stack frame (nfsd cld upcall)

[BUG] sunrpc: rpc_pipe_msg left queued on a stack frame (nfsd cld upcall)

[Farhad Alemi]

Hello Chuck Lever, Jeff Layton,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/118-nfsd-cld-stack-rpc_pipe_msg-left-queued/

  ==================================================================
  BUG: KASAN: vmalloc-out-of-bounds in
__list_add_valid_or_report+0x6a/0x130 lib/list_debug.c:32
  Read of size 8 at addr ffffc90007027950 by task syz.0.96/13066
  CPU: 0 UID: 0 PID: 13066 Comm: syz.0.96 Not tainted 7.1.0-rc5 #1 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Call Trace:
  <TASK>
  dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
  print_address_description+0x55/0x1e0 mm/kasan/report.c:378

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] sunrpc: rpc_pipe_msg left queued on a stack frame (nfsd cld upcall)

[Jeff Layton]

On Thu, 2026-08-27 at 16:10 -0700, Farhad Alemi wrote:
> Hello Chuck Lever, Jeff Layton,
> 
> While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> SEFCOM lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/118-nfsd-cld-stack-rpc_pipe_msg-left-queued/
> 
>   ==================================================================
>   BUG: KASAN: vmalloc-out-of-bounds in
> __list_add_valid_or_report+0x6a/0x130 lib/list_debug.c:32
>   Read of size 8 at addr ffffc90007027950 by task syz.0.96/13066
>   CPU: 0 UID: 0 PID: 13066 Comm: syz.0.96 Not tainted 7.1.0-rc5 #1 PREEMPT(full)
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
>   Call Trace:
>   <TASK>
>   dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
>   print_address_description+0x55/0x1e0 mm/kasan/report.c:378
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.
> 
> Regards,

We've had a lot of bugfixes go into the last couple of releases. Can
you test this against a more bleeding-edge kernel and see if it's still
a problem? Testing against Linus' master branch would be good, but if
you can pull down Chuck's nfsd-testing branch, that would be even
better.

Thanks,
-- 
Jeff Layton <jlayton@kernel.org>