syzbot


BUG: unable to handle kernel NULL pointer dereference in deactivate_slab

Status: upstream: reported on 2024/05/27 08:04
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+79388700e25aa19555b9@syzkaller.appspotmail.com
First crash: 35d, last: 1d17h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [kernel?] BUG: unable to handle kernel NULL pointer dereference in deactivate_slab 1 (2) 2024/05/27 08:59
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KMSAN: kernel-infoleak in v4l2_compat_put_array_args media 8 576d 880d 22/27 fixed on 2023/02/24 13:50

Sample crash report:
BUG: kernel NULL pointer dereference, address: 0000000000000003
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 26cc8067 P4D 26cc8067 PUD 123db067 PMD 0 
Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 PID: 5576 Comm: kworker/2:3 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: slub_flushwq flush_cpu_slab
RIP: 0010:PagePoisoned include/linux/page-flags.h:296 [inline]
RIP: 0010:page_to_nid include/linux/mm.h:1664 [inline]
RIP: 0010:folio_nid include/linux/mm.h:1670 [inline]
RIP: 0010:slab_nid mm/slab.h:194 [inline]
RIP: 0010:deactivate_slab+0x1b/0x4a0 mm/slub.c:2881
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 89 f6 41 55 41 54 53 48 83 e4 f0 48 81 ec b0 00 00 00 <48> 8b 06 48 89 54 24 08 48 83 f8 ff 0f 84 c3 03 00 00 48 8b 06 48
RSP: 0018:ffffc900037cfbb0 EFLAGS: 00010282
RAX: 0000000000000002 RBX: ffffe8ffad26cbf0 RCX: 1ffffffff2841bf8
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff888025c83680
RBP: ffffc900037cfc88 R08: 0000000000000001 R09: fffffbfff283f45e
R10: ffffffff941fa2f7 R11: ffffffff81e17f8a R12: 0000000000000200
R13: 0000000000000003 R14: 0000000000000003 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88802c200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000003 CR3: 0000000012898000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 flush_slab mm/slub.c:3101 [inline]
 flush_cpu_slab+0x141/0x410 mm/slub.c:3147
 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
CR2: 0000000000000003
---[ end trace 0000000000000000 ]---
RIP: 0010:PagePoisoned include/linux/page-flags.h:296 [inline]
RIP: 0010:page_to_nid include/linux/mm.h:1664 [inline]
RIP: 0010:folio_nid include/linux/mm.h:1670 [inline]
RIP: 0010:slab_nid mm/slab.h:194 [inline]
RIP: 0010:deactivate_slab+0x1b/0x4a0 mm/slub.c:2881
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 89 f6 41 55 41 54 53 48 83 e4 f0 48 81 ec b0 00 00 00 <48> 8b 06 48 89 54 24 08 48 83 f8 ff 0f 84 c3 03 00 00 48 8b 06 48
RSP: 0018:ffffc900037cfbb0 EFLAGS: 00010282
RAX: 0000000000000002 RBX: ffffe8ffad26cbf0 RCX: 1ffffffff2841bf8
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff888025c83680
RBP: ffffc900037cfc88 R08: 0000000000000001 R09: fffffbfff283f45e
R10: ffffffff941fa2f7 R11: ffffffff81e17f8a R12: 0000000000000200
R13: 0000000000000003 R14: 0000000000000003 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88802c200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000003 CR3: 0000000012898000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	55                   	push   %rbp
  10:	48 89 e5             	mov    %rsp,%rbp
  13:	41 57                	push   %r15
  15:	41 56                	push   %r14
  17:	49 89 f6             	mov    %rsi,%r14
  1a:	41 55                	push   %r13
  1c:	41 54                	push   %r12
  1e:	53                   	push   %rbx
  1f:	48 83 e4 f0          	and    $0xfffffffffffffff0,%rsp
  23:	48 81 ec b0 00 00 00 	sub    $0xb0,%rsp
* 2a:	48 8b 06             	mov    (%rsi),%rax <-- trapping instruction
  2d:	48 89 54 24 08       	mov    %rdx,0x8(%rsp)
  32:	48 83 f8 ff          	cmp    $0xffffffffffffffff,%rax
  36:	0f 84 c3 03 00 00    	je     0x3ff
  3c:	48 8b 06             	mov    (%rsi),%rax
  3f:	48                   	rex.W

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/16 01:35 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/06/15 22:09 upstream 2ccbdf43d5e7 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/06/11 10:13 upstream 83a7eefedc9b c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/06/11 02:59 upstream 83a7eefedc9b c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/30 00:03 upstream 4a4be1ad3a6e c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/27 08:03 upstream 1613e604df0c c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/24 14:08 upstream 6d69b6c12fce c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/22 22:08 upstream 29c73fc794c8 c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/20 11:21 upstream eb6a9339efeb c2e07261 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
2024/05/13 08:20 upstream a38297e3fb01 9026e142 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 BUG: unable to handle kernel NULL pointer dereference in deactivate_slab
* Struck through repros no longer work on HEAD.