syzbot


WARNING in kmem_cache_free

Status: auto-closed as invalid on 2019/10/25 08:40
Reported-by: syzbot+e145b7bfb8304bf5f8cb@syzkaller.appspotmail.com
First crash: 2009d, last: 2000d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in kmem_cache_free (2) dccp syz 13 2017d 2315d 0/28 closed as dup on 2018/10/11 08:07
upstream WARNING in kmem_cache_free fs 1 2424d 2424d 5/28 fixed on 2018/05/08 18:30

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
NET: Registered protocol family 30
Failed to register TIPC socket type
cache_from_obj: Wrong slab cache. TIPC but object is from kmalloc-2048
WARNING: CPU: 1 PID: 8747 at mm/slab.h:380 cache_from_obj mm/slab.h:378 [inline]
WARNING: CPU: 1 PID: 8747 at mm/slab.h:380 cache_from_obj mm/slab.h:357 [inline]
WARNING: CPU: 1 PID: 8747 at mm/slab.h:380 kmem_cache_free.cold+0x1c/0x23 mm/slab.c:3757
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8747 Comm: syz-executor.4 Not tainted 4.19.47 #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x263/0x507 kernel/panic.c:185
 __warn.cold+0x20/0x4a kernel/panic.c:540
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:178 [inline]
 fixup_bug arch/x86/kernel/traps.c:173 [inline]
 do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1013
RIP: 0010:cache_from_obj mm/slab.h:380 [inline]
RIP: 0010:cache_from_obj mm/slab.h:357 [inline]
RIP: 0010:kmem_cache_free.cold+0x1c/0x23 mm/slab.c:3757
Code: e8 95 ab 47 05 44 8b 6d c4 e9 74 a5 ff ff 48 8b 48 58 48 c7 c6 c0 44 54 87 48 c7 c7 78 66 38 88 49 8b 54 24 58 e8 44 3d b4 ff <0f> 0b e9 89 df ff ff 49 8b 4f 58 48 c7 c6 c0 44 54 87 48 c7 c7 78
RSP: 0018:ffff8880ae907cf8 EFLAGS: 00010286
RAX: 0000000000000046 RBX: ffff8880a510a0c0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1015d20f91
RBP: ffff8880ae907d18 R08: 0000000000000046 R09: ffffed1015d24fe9
R10: ffffed1015d24fe8 R11: ffff8880ae927f47 R12: ffff888095ea1000
R13: 0000000000000000 R14: ffff888095ea1000 R15: ffff8880a510a3d0
 sk_prot_free net/core/sock.c:1504 [inline]
 __sk_destruct+0x4b4/0x6d0 net/core/sock.c:1588
 sk_destruct+0x7b/0x90 net/core/sock.c:1596
 __sk_free+0xce/0x300 net/core/sock.c:1607
 sk_free+0x42/0x50 net/core/sock.c:1618
 sock_put include/net/sock.h:1702 [inline]
 tipc_sk_callback+0x48/0x60 net/tipc/socket.c:495
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch kernel/rcu/tree.c:2584 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline]
 rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881
 __do_softirq+0x25c/0x921 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x180/0x1d0 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x13b/0x550 arch/x86/kernel/apic/apic.c:1056
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:869
 </IRQ>
RIP: 0010:arch_local_irq_enable arch/x86/include/asm/paravirt.h:799 [inline]
RIP: 0010:flush_tlb_mm_range+0x2dd/0x370 arch/x86/mm/tlb.c:721
Code: 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 84 00 00 00 48 83 3d a4 13 41 07 00 74 40 fb 66 0f 1f 44 00 00 <e9> 31 fe ff ff e8 f2 43 cf ff e9 8c fe ff ff 48 c7 c7 74 77 3b 89
RSP: 0018:ffff888090e4f800 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e46cb RBX: 1ffff110121c9f02 RCX: 1ffff110115a7dd6
RDX: dffffc0000000000 RSI: ffff88808ad3ee90 RDI: ffff88808ad3ee3c
RBP: ffff888090e4f8b8 R08: ffff88808ad3e5c0 R09: ffff88808ad3eeb0
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888090e4f890
R13: 00007ffffffff000 R14: 0000000000000001 R15: ffff8880a109d640
 move_ptes mm/mremap.c:185 [inline]
 move_page_tables+0x118f/0x1ae0 mm/mremap.c:246
 shift_arg_pages+0x1c8/0x490 fs/exec.c:651
 setup_arg_pages+0x668/0x7f0 fs/exec.c:763
 load_elf_binary+0xc34/0x51f0 fs/binfmt_elf.c:887
 search_binary_handler fs/exec.c:1653 [inline]
 search_binary_handler+0x179/0x570 fs/exec.c:1631
 exec_binprm fs/exec.c:1695 [inline]
 __do_execve_file.isra.0+0x1227/0x2150 fs/exec.c:1819
 do_execveat_common fs/exec.c:1866 [inline]
 do_execve fs/exec.c:1883 [inline]
 __do_sys_execve fs/exec.c:1964 [inline]
 __se_sys_execve fs/exec.c:1959 [inline]
 __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x47c58b
Code: Bad RIP value.
RSP: 002b:000000c4202b5568 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 0000000000000022 RCX: 000000000047c58b
RDX: 000000c42000c3b8 RSI: 000000c420214930 RDI: 000000c420096b60
RBP: 000000c4202b5670 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000472766
R13: 0000000000000064 R14: 0000000000000063 R15: 00000000000000aa
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (33):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/06/04 04:38 linux-4.19.y 0df021b2e841 ce07a7ae .config console log report ci2-linux-4-19
2019/06/03 23:10 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 19:27 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 19:08 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 18:29 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 17:58 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 17:45 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 17:41 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 15:45 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 15:37 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 14:37 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 12:52 linux-4.19.y 0df021b2e841 63bf051f .config console log report ci2-linux-4-19
2019/06/03 08:39 linux-4.19.y 0df021b2e841 53c81ea5 .config console log report ci2-linux-4-19
2019/06/03 03:28 linux-4.19.y 0df021b2e841 53c81ea5 .config console log report ci2-linux-4-19
2019/06/02 00:45 linux-4.19.y 0df021b2e841 53c81ea5 .config console log report ci2-linux-4-19
2019/06/01 16:43 linux-4.19.y 0df021b2e841 53c81ea5 .config console log report ci2-linux-4-19
2019/06/01 07:00 linux-4.19.y 0df021b2e841 53c81ea5 .config console log report ci2-linux-4-19
2019/05/31 18:27 linux-4.19.y 0df021b2e841 a8482b78 .config console log report ci2-linux-4-19
2019/05/31 03:10 linux-4.19.y 8b2fc0058255 d9aaf3c2 .config console log report ci2-linux-4-19
2019/05/31 02:05 linux-4.19.y 8b2fc0058255 d9aaf3c2 .config console log report ci2-linux-4-19
2019/05/31 00:52 linux-4.19.y 8b2fc0058255 d9aaf3c2 .config console log report ci2-linux-4-19
2019/05/30 17:15 linux-4.19.y 8b2fc0058255 d9aaf3c2 .config console log report ci2-linux-4-19
2019/05/30 13:51 linux-4.19.y 8b2fc0058255 d9aaf3c2 .config console log report ci2-linux-4-19
2019/05/29 22:25 linux-4.19.y 8b2fc0058255 f5a25d38 .config console log report ci2-linux-4-19
2019/05/29 14:21 linux-4.19.y 8b2fc0058255 f5a25d38 .config console log report ci2-linux-4-19
2019/05/29 05:46 linux-4.19.y 8b2fc0058255 6bd61501 .config console log report ci2-linux-4-19
2019/05/28 17:10 linux-4.19.y 8b2fc0058255 6bd61501 .config console log report ci2-linux-4-19
2019/05/28 03:12 linux-4.19.y 8b2fc0058255 6bd61501 .config console log report ci2-linux-4-19
2019/05/27 10:17 linux-4.19.y 8b2fc0058255 562efd79 .config console log report ci2-linux-4-19
2019/05/27 00:23 linux-4.19.y 8b2fc0058255 85c57315 .config console log report ci2-linux-4-19
2019/05/26 17:06 linux-4.19.y 8b2fc0058255 85c57315 .config console log report ci2-linux-4-19
2019/05/26 13:05 linux-4.19.y 8b2fc0058255 85c57315 .config console log report ci2-linux-4-19
2019/05/26 04:34 linux-4.19.y 8b2fc0058255 85c57315 .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.