BUG: unable to handle kernel paging request in free

BUG: unable to handle kernel paging request in free_block (3)
Status: closed as invalid on 2018/09/05 11:23
Reported-by: syzbot+a438b986a3ad4641a320@syzkaller.appspotmail.com
First crash: 1066d, last: 1037d

similar bugs (4):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	BUG: unable to handle kernel paging request in free_block				1	221d	221d	0/1	auto-closed as invalid on 2020/11/18 03:09
upstream	BUG: unable to handle kernel paging request in free_block (4)				2	745d	775d	0/21	closed as dup on 2019/01/14 17:27
upstream	BUG: unable to handle kernel paging request in free_block (2)				1	1074d	1074d	0/21	closed as invalid on 2018/03/21 12:59
upstream	BUG: unable to handle kernel paging request in free_block (5)	syz	done	done	3	282d	681d	0/21	upstream: reported syz repro on 2019/04/18 05:08

Sample crash report:

bond0 (unregistering): Released all slaves
IPVS: ftp: loaded support on port[0] = 21
IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
BUG: unable to handle kernel paging request at ffff8802bc061a6f
PGD af0d067 P4D af0d067 PUD 0 
Oops: 0002 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 2772 Comm: sh Not tainted 4.16.0+ #14
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:slab_put_obj mm/slab.c:2625 [inline]
RIP: 0010:free_block+0x155/0x280 mm/slab.c:3418
RSP: 0018:ffff8801b639f998 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffffe8ffffd071d8 RCX: 00000000ffffffff
RDX: ffff8801bc061a70 RSI: ffff8801bc061a70 RDI: 0000000000000000
RBP: ffff8801b639f9e0 R08: 0000000006f01840 R09: ffff8801d9f97958
R10: ffffed003b3f2f20 R11: ffff8801d9f97903 R12: ffffea0006f01820
R13: ffff8801d9f91c80 R14: ffff8801d9f97900 R15: ffffea0006f01800
FS:  00007f1bd84e6700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8802bc061a6f CR3: 00000001d0bc7000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 cache_flusharray mm/slab.c:3469 [inline]
 ___cache_free+0x20a/0x2f0 mm/slab.c:3527
 qlink_free mm/kasan/quarantine.c:147 [inline]
 qlist_free_all+0x8c/0x160 mm/kasan/quarantine.c:166
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0x99/0xe0 mm/kasan/kasan.c:538
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3392 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
 getname_flags+0xd0/0x5a0 fs/namei.c:140
 user_path_at_empty+0x2d/0x50 fs/namei.c:2565
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0x121/0x1f0 fs/stat.c:185
 vfs_stat include/linux/fs.h:3072 [inline]
 SYSC_newstat+0x87/0xf0 fs/stat.c:337
 SyS_newstat+0x1d/0x30 fs/stat.c:333
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x7f1bd8013c65
RSP: 002b:00007ffd83707e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00007ffd83707fc0 RCX: 00007f1bd8013c65
RDX: 00007ffd83707e80 RSI: 00007ffd83707e80 RDI: 0000000001c67220
RBP: 000000000061c3c0 R08: 000000000061c3c0 R09: 00007f1bd8067a00
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: f1 41 0f b6 4d 1c 48 c1 ee 20 29 f0 d3 e8 41 0f b6 4d 1d 01 f0 49 8b 77 10 d3 e8 8d 4f ff 41 89 4f 18 48 85 f6 0f 84 05 01 00 00 <88> 04 0e 41 8b 47 18 85 c0 0f 84 e3 fe ff ff 49 8b 4e 40 4d 8d 
RIP: slab_put_obj mm/slab.c:2625 [inline] RSP: ffff8801b639f998
RIP: free_block+0x155/0x280 mm/slab.c:3418 RSP: ffff8801b639f998
CR2: ffff8802bc061a6f
---[ end trace 915bd9d0ba33f203 ]---

Crashes (11):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report
ci-upstream-kasan-gce-root	2018/04/10 08:17	upstream	fd40ffc7	b9f65507	.config	log	report
ci-upstream-kasan-gce-root	2018/03/30 04:32	upstream	0b412605	d47f0ed6	.config	log	report
ci-upstream-kasan-gce-386	2018/04/27 19:09	upstream	d8a33273	7785e404	.config	log	report
ci-upstream-kasan-gce-386	2018/03/31 03:06	upstream	9dd23268	8fbce0e4	.config	log	report
ci-upstream-net-kasan-gce	2018/04/16 18:41	net-next	9a00b697	802ac912	.config	log	report
ci-upstream-net-kasan-gce	2018/04/13 07:18	net-next	5d136594	eb2295de	.config	log	report
ci-upstream-net-kasan-gce	2018/03/31 13:00	net-next	c0b6edef	8fbce0e4	.config	log	report
ci-upstream-net-kasan-gce	2018/03/31 04:04	net-next	6f14f49c	8fbce0e4	.config	log	report
ci-upstream-net-kasan-gce	2018/03/31 03:21	net-next	6f14f49c	8fbce0e4	.config	log	report
ci-upstream-net-kasan-gce	2018/03/30 05:35	net-next	18845557	d47f0ed6	.config	log	report
ci-upstream-net-kasan-gce	2018/03/29 11:35	net-next	5d22d47b	d47f0ed6	.config	log	report