syzbot

 sign-in | mailing list | source | docs
🐞 Open [1667]
≡ Subsystems
🐞 Fixed [6092]
🐞 Invalid [15163]
⬇ Missing Backports [162]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: null-ptr-deref Read in reclaim_high

Status: closed as invalid on 2019/06/23 21:57
Subsystems: mm cgroups
[Documentation on labels]
Reported-by: syzbot+fa11f9da42b46cea3b4a@syzkaller.appspotmail.com
First crash: 2255d, last: 2234d
Cause bisection: introduced by (bisect log) :
commit 29a4b8e275d1f10c51c7891362877ef6cffae9e7
Author: Shakeel Butt <shakeelb@google.com>
Date: Wed Jan 9 22:02:21 2019 +0000

  memcg: schedule high reclaim for remote memcgs on high_work

Crash: KASAN: null-ptr-deref Read in reclaim_high (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
KASAN: null-ptr-deref Read in reclaim_high 14 (15) 2019/03/19 13:52
KASAN: null-ptr-deref Read in reclaim_high 0 (1) 2019/01/10 17:03

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in atomic64_read include/generated/atomic-instrumented.h:836 [inline]
BUG: KASAN: null-ptr-deref in atomic_long_read include/generated/atomic-long.h:28 [inline]
BUG: KASAN: null-ptr-deref in page_counter_read include/linux/page_counter.h:47 [inline]
BUG: KASAN: null-ptr-deref in reclaim_high.constprop.0+0xa6/0x1e0 mm/memcontrol.c:2149
Read of size 8 at addr 0000000000000138 by task syz-executor037/7964

CPU: 1 PID: 7964 Comm: syz-executor037 Not tainted 5.0.0-rc1-next-20190110 #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 kasan_report.cold+0x5/0x40 mm/kasan/report.c:321
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 kasan_check_read+0x11/0x20 mm/kasan/common.c:100
 atomic64_read include/generated/atomic-instrumented.h:836 [inline]
 atomic_long_read include/generated/atomic-long.h:28 [inline]
 page_counter_read include/linux/page_counter.h:47 [inline]
 reclaim_high.constprop.0+0xa6/0x1e0 mm/memcontrol.c:2149
 mem_cgroup_handle_over_high+0xc1/0x180 mm/memcontrol.c:2178
 tracehook_notify_resume include/linux/tracehook.h:190 [inline]
 exit_to_usermode_loop+0x299/0x3b0 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath+0x519/0x5f0 arch/x86/entry/common.c:268
 ret_from_fork+0x15/0x50 arch/x86/entry/entry_64.S:344
RIP: 0033:0x44034a
Code: Bad RIP value.
RSP: 002b:00007ffc31cd3040 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000044034a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffc31cd3060 R08: 0000000000000001 R09: 0000000002027880
R10: 0000000002027b50 R11: 0000000000000246 R12: 0000000000000001
R13: 000000000000cc59 R14: 0000000000000000 R15: 0000000000000000
==================================================================

Crashes (1423):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/01/10 07:44 linux-next 6cab33afc3dd 45c0c1b1 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/01/31 05:49 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/31 05:08 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/31 04:08 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/31 01:09 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/31 00:53 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 23:15 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 22:11 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 21:01 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 20:53 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 19:46 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 18:03 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 16:48 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 15:13 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 13:51 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 12:41 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 12:39 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 11:33 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 10:30 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 10:24 linux-next 02495e76ded5 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 07:01 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 04:53 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 03:34 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 02:17 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/30 00:12 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 23:42 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 22:41 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 21:07 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 19:16 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 17:57 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 16:12 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 13:11 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 11:40 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 10:17 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 09:53 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 08:46 linux-next 39ad1c1b6bb8 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 06:15 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 04:11 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/29 01:56 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/28 23:33 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/28 23:28 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/28 21:54 linux-next 494367cb57c9 aa432daf .config console log report ci-upstream-linux-next-kasan-gce-root
2019/01/10 05:32 linux-next 6cab33afc3dd 45c0c1b1 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.