syzbot


WARNING in __vmalloc_node_range

Status: auto-closed as invalid on 2020/03/14 05:15
Reported-by: syzbot+cebe92a31c7f65b22a55@syzkaller.appspotmail.com
First crash: 1743d, last: 1624d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __vmalloc_node_range media usb C 7 1084d 1086d 20/26 fixed on 2021/11/10 00:50
android-44 WARNING in __vmalloc_node_range 9 1622d 1783d 0/2 auto-closed as invalid on 2020/03/15 17:57
linux-4.19 WARNING in __vmalloc_node_range 1 1637d 1637d 0/1 auto-closed as invalid on 2020/02/29 17:15
linux-4.14 WARNING in __vmalloc_node_range 1 1551d 1551d 0/1 auto-closed as invalid on 2020/05/26 06:50

Sample crash report:
syz-executor.5: vmalloc: allocation failure: 17112764420 bytes[  253.905139] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
, mode:0x24000c2(GFP_KERNEL|__GFP_HIGHMEM)
CPU: 1 PID: 8128 Comm: syz-executor.5 Not tainted 4.9.141+ #1
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8139 at mm/page_alloc.c:3556 __alloc_pages_slowpath mm/page_alloc.c:3556 [inline]
WARNING: CPU: 0 PID: 8139 at mm/page_alloc.c:3556 __alloc_pages_nodemask+0x13a0/0x1bd0 mm/page_alloc.c:3862
Kernel panic - not syncing: panic_on_warn set ...

 ffff8801cb107818 ffffffff81b42e79 1ffff10039620f05 ffff8801863adf00
 ffffffff82aa8c00 0000000000000001 0000000000400000 ffff8801cb107960
 ffffffff814fc7c8 0000000041b58ab3 ffffffff82e37a10 ffffffff81427db0
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814fc7c8>] warn_alloc.cold.31+0x7f/0x9c mm/page_alloc.c:3068
 [<ffffffff814c9f8e>] __vmalloc_node_range+0x35e/0x600 mm/vmalloc.c:1723
 [<ffffffff814ca71b>] __vmalloc_node mm/vmalloc.c:1745 [inline]
 [<ffffffff814ca71b>] __vmalloc_node_flags mm/vmalloc.c:1759 [inline]
 [<ffffffff814ca71b>] vmalloc+0x5b/0x70 mm/vmalloc.c:1774
 [<ffffffff82450e91>] xt_alloc_entry_offsets+0x41/0x60 net/netfilter/x_tables.c:758
 [<ffffffff82610ad5>] translate_table+0x215/0x1600 net/ipv4/netfilter/ip_tables.c:705
 [<ffffffff826140be>] do_replace net/ipv4/netfilter/ip_tables.c:1157 [inline]
 [<ffffffff826140be>] do_ipt_set_ctl+0x2ce/0x460 net/ipv4/netfilter/ip_tables.c:1693
 [<ffffffff823e290d>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff823e290d>] nf_setsockopt+0x6d/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff824c1178>] ip_setsockopt+0x88/0xa0 net/ipv4/ip_sockglue.c:1249
 [<ffffffff8256ce5a>] udp_setsockopt+0x4a/0x90 net/ipv4/udp.c:2110
 [<ffffffff826f543a>] ipv6_setsockopt+0x10a/0x130 net/ipv6/ipv6_sockglue.c:912
 [<ffffffff824deaa8>] tcp_setsockopt+0x88/0xe0 net/ipv4/tcp.c:2758
 [<ffffffff822a747a>] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2706
 [<ffffffff822a4d76>] SYSC_setsockopt net/socket.c:1785 [inline]
 [<ffffffff822a4d76>] SyS_setsockopt+0x166/0x260 net/socket.c:1764
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
CPU: 0 PID: 8139 Comm: syz-executor.1 Not tainted 4.9.141+ #1
Mem-Info:
active_anon:166521 inactive_anon:17497 isolated_anon:0
 active_file:4632 inactive_file:30967 isolated_file:0
 unevictable:0 dirty:243 writeback:0 unstable:0
 slab_reclaimable:6787 slab_unreclaimable:61371
 mapped:59322 shmem:17466 pagetables:3431 bounce:0
 free:1292568 free_pcp:368 free_cma:0
Node 0 active_anon:666084kB inactive_anon:69988kB active_file:18528kB inactive_file:123868kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:237288kB dirty:972kB writeback:0kB shmem:69864kB writeback_tmp:0kB unstable:0kB pages_scanned:0 all_unreclaimable? no
DMA32 free:3019464kB min:4696kB low:7712kB high:10728kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3145324kB managed:3020132kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:668kB local_pcp:636kB free_cma:0kB
Normal free:2150808kB min:5580kB low:9168kB high:12756kB active_anon:666084kB inactive_anon:69988kB active_file:18528kB inactive_file:123868kB unevictable:0kB writepending:972kB present:4718592kB managed:3589312kB mlocked:0kB slab_reclaimable:27148kB slab_unreclaimable:245484kB kernel_stack:7776kB pagetables:13724kB bounce:0kB free_pcp:804kB local_pcp:440kB free_cma:0kB
DMA32: 2*4kB (UM) 2*8kB (M) 1*16kB (M) 3*32kB (UM) 5*64kB (UM) 4*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 2*2048kB (UM) 735*4096kB (M) = 3019464kB
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313618 pages reserved
 ffff8801ca746f70 ffffffff81b42e79 ffffffff82a38ce0 00000000ffffffff
 ffffffff82a96600 0000000000000000 0000000000000009 ffff8801ca747030
 ffffffff813f7125 0000000041b58ab3 ffffffff82e2b62b ffffffff813f6f66
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff813f7125>] panic+0x1bf/0x39f kernel/panic.c:179
 [<ffffffff813f7362>] __warn.cold.8+0x2f/0x2f kernel/panic.c:542
 [<ffffffff810dc02c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
 [<ffffffff81429420>] __alloc_pages_slowpath mm/page_alloc.c:3556 [inline]
 [<ffffffff81429420>] __alloc_pages_nodemask+0x13a0/0x1bd0 mm/page_alloc.c:3862
 [<ffffffff8147936a>] __alloc_pages include/linux/gfp.h:433 [inline]
 [<ffffffff8147936a>] __alloc_pages_node include/linux/gfp.h:446 [inline]
 [<ffffffff8147936a>] alloc_pages_node include/linux/gfp.h:460 [inline]
 [<ffffffff8147936a>] kmalloc_order+0x2a/0x70 mm/slab_common.c:1043
 [<ffffffff814793cf>] kmalloc_order_trace+0x1f/0x190 mm/slab_common.c:1054
 [<ffffffff814ee36e>] kmalloc_large include/linux/slab.h:422 [inline]
 [<ffffffff814ee36e>] __kmalloc+0x1ae/0x310 mm/slub.c:3730
 [<ffffffff81a20c19>] kmalloc include/linux/slab.h:495 [inline]
 [<ffffffff81a20c19>] str_read+0x39/0x150 security/selinux/ss/policydb.c:1100
 [<ffffffff81a266d3>] class_read+0x2c3/0x940 security/selinux/ss/policydb.c:1344
 [<ffffffff81a2b1ea>] policydb_read+0xdba/0x2390 security/selinux/ss/policydb.c:2367
 [<ffffffff81a3ba84>] security_load_policy+0x264/0x9b0 security/selinux/ss/services.c:2067
 [<ffffffff81a1233b>] sel_write_load+0x19b/0xfa0 security/selinux/selinuxfs.c:522
 [<ffffffff81508085>] __vfs_write+0x115/0x580 fs/read_write.c:507
 [<ffffffff8150ab97>] vfs_write+0x187/0x520 fs/read_write.c:557
 [<ffffffff8150e9c9>] SYSC_write fs/read_write.c:604 [inline]
 [<ffffffff8150e9c9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/15 05:14 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 a24fe792 .config console log report ci-android-49-kasan-gce
2019/07/19 07:40 https://android.googlesource.com/kernel/common android-4.9 8fe428403e30 7bb222f7 .config console log report ci-android-49-kasan-gce
* Struck through repros no longer work on HEAD.