syzbot


general protection fault in qlist_free_all (4)

Status: auto-closed as invalid on 2019/02/22 10:34
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+ba1d1ac3385a34685c6d@syzkaller.appspotmail.com
First crash: 2227d, last: 2117d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in qlist_free_all mm 1 2404d 2404d 0/26 closed as invalid on 2017/10/18 09:51
upstream general protection fault in qlist_free_all (2) fs 1 2360d 2360d 0/26 closed as invalid on 2017/12/05 10:45

Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2105
 llc_ui_sendmsg+0x380/0x1530 net/llc/af_llc.c:934
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 2709 Comm: udevd Not tainted 4.17.0-rc2+ #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:virt_to_head_page include/linux/mm.h:624 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:127 [inline]
RIP: 0010:qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
RSP: 0018:ffff8801b65afbd0 EFLAGS: 00010207
 ___sys_sendmsg+0x525/0x940 net/socket.c:2117
RAX: dead4ead00000000 RBX: 0000000000000286 RCX: ffffea0000000000
RDX: 037aa11ab4000000 RSI: ffff8801b659ebe0 RDI: 0000000000000286
RBP: ffff8801b65afc08 R08: ffff8801b659ebb8 R09: 0000000000000006
R10: ffff8801b659e380 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: dead4ead00000000 R15: ffffffff88d18ae0
FS:  00007f6ec0bd77a0(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe04236178 CR3: 00000001b6582000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 __sys_sendmmsg+0x240/0x6f0 net/socket.c:2212
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0x99/0xe0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3392 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
 inotify_new_watch fs/notify/inotify/inotify_user.c:561 [inline]
 inotify_update_watch+0x211/0x4e0 fs/notify/inotify/inotify_user.c:608
 __do_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:737 [inline]
 __se_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:687 [inline]
 __x64_sys_inotify_add_watch+0x2d1/0x360 fs/notify/inotify/inotify_user.c:687
 __do_sys_sendmmsg net/socket.c:2241 [inline]
 __se_sys_sendmmsg net/socket.c:2238 [inline]
 __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2238
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RIP: 0033:0x7f6ec02eba07
RSP: 002b:00007f34e7b7dc68 EFLAGS: 00000246
RSP: 002b:00007ffe04235d28 EFLAGS: 00000206 ORIG_RAX: 00000000000000fe
 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000184b250 RCX: 00007f6ec02eba07
RAX: ffffffffffffffda RBX: 00007f34e7b7e6d4 RCX: 0000000000455979
RDX: 0000000000000008 RSI: 000000000185b520 RDI: 0000000000000006
RBP: 0000000001863e80 R08: 00007f6ec0bd77a0 R09: 0000000000000001
RDX: 0000000000000002 RSI: 0000000020000880 RDI: 0000000000000014
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000000000001
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000013
R13: 000000000191bcb0 R14: 000000000184b250 R15: 000000000000000b
Code: 
R13: 00000000000004d0 R14: 00000000006fa420 R15: 0000000000000001
00 00 00 80 48 01 c2 72 43 48 b9 00 00 00 80 ff 77 00 00 48 01 ca 48 b9 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 ca <48> 8b 4a 20 48 8d 71 ff 83 e1 01 48 0f 45 d6 4c 8b 6a 30 e9 f4 
RIP: virt_to_head_page include/linux/mm.h:624 [inline] RSP: ffff8801b65afbd0
RIP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] RSP: ffff8801b65afbd0
RIP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801b65afbd0
---[ end trace a02bc5138dd61ad8 ]---

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/04/27 18:07 upstream 0644f186fc9d 7785e404 .config console log report ci-upstream-kasan-gce-root
2018/03/30 13:32 upstream c2a9838452a4 d47f0ed6 .config console log report ci-upstream-kasan-gce
2018/03/30 06:46 upstream c2a9838452a4 d47f0ed6 .config console log report ci-upstream-kasan-gce-root
2018/03/29 12:44 upstream 0b412605ef5f d47f0ed6 .config console log report ci-upstream-kasan-gce-root
2018/04/27 04:23 upstream 0644f186fc9d 73417389 .config console log report ci-upstream-kasan-gce-386
2018/03/31 13:02 upstream b5dbc28762fd 8fbce0e4 .config console log report ci-upstream-kasan-gce-386
2018/03/31 05:47 upstream 9dd2326890d8 8fbce0e4 .config console log report ci-upstream-kasan-gce-386
2018/03/30 10:49 upstream c2a9838452a4 d47f0ed6 .config console log report ci-upstream-kasan-gce-386
2018/03/29 17:30 upstream 0b412605ef5f d47f0ed6 .config console log report ci-upstream-kasan-gce-386
2018/07/17 12:39 bpf-next 301f935be9e0 13761366 .config console log report ci-upstream-bpf-next-kasan-gce
2018/04/13 08:58 net-next-old 5d1365940a68 0a0c5db6 .config console log report ci-upstream-net-kasan-gce
2018/04/09 20:28 net-next-old 17dec0a94915 b9f65507 .config console log report ci-upstream-net-kasan-gce
2018/04/05 11:06 net-next-old 17dec0a94915 5e1ccffc .config console log report ci-upstream-net-kasan-gce
2018/03/30 10:28 net-next-old 18845557fd6f d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/03/29 13:28 net-next-old 5d22d47b9ed9 d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/03/29 13:21 net-next-old 5d22d47b9ed9 d47f0ed6 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.