syzbot


BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2)

Status: closed as invalid on 2017/11/09 10:06
Subsystems: kernel
[Documentation on labels]
First crash: 2584d, last: 2584d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 1 1689d 1689d 0/1 auto-closed as invalid on 2020/08/18 08:06
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 8 1056d 1293d 0/1 auto-closed as invalid on 2022/05/13 11:55
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (4) mm 8 2508d 2555d 0/28 closed as invalid on 2018/02/12 16:58
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (6) ext4 syz 7 2067d 2165d 0/28 closed as dup on 2018/12/31 07:50
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (7) tomoyo 7 1670d 1730d 0/28 closed as invalid on 2020/07/06 10:57
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (8) kvm 11 1524d 1547d 0/28 auto-closed as invalid on 2021/01/30 15:56
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all fs 1 2619d 2619d 0/28 closed as invalid on 2017/10/18 09:51
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 2 1659d 1693d 0/1 auto-closed as invalid on 2020/09/17 07:42
upstream BUG: unable to handle kernel paging request in qlist_free_all (7) kernel 20 1097d 1318d 0/28 auto-closed as invalid on 2022/03/03 13:56
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 3 1300d 1324d 0/1 auto-closed as invalid on 2021/09/12 03:17
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (5) fs 19 2414d 2471d 0/28 closed as invalid on 2018/05/26 17:43
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (3) mm 8 2558d 2574d 0/28 closed as invalid on 2017/12/05 10:45

Sample crash report:
QAT: Invalid ioctl
BUG: unable to handle kernel NULL pointer dereference at 0000000000000105
IP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
PGD 1c14f7067 P4D 1c14f7067 PUD 1d3d36067 PMD 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 11544 Comm: syz-executor7 Not tainted 4.14.0-rc7-next-20171103+ #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d7a72000 task.stack: ffff88019fea8000
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
RSP: 0018:ffff88019feaf578 EFLAGS: 00010246
RAX: ffff8801d7438340 RBX: 0000000000000286 RCX: 0000000000000000
RDX: ffffea00075d0e00 RSI: ffffea000763a69f RDI: 0000000000000286
RBP: ffff88019feaf5b0 R08: 0000000000000286 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8801d7438340 R15: ffffffff85ecb380
FS:  0000000000eb6940(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000105 CR3: 00000001d91ba000 CR4: 00000000001426e0
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:446 [inline]
 slab_alloc mm/slab.c:3387 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3547
 ptlock_alloc+0x24/0x70 mm/memory.c:4687
 ptlock_init include/linux/mm.h:1773 [inline]
 pgtable_page_ctor include/linux/mm.h:1807 [inline]
 pte_alloc_one+0x59/0x100 arch/x86/mm/pgtable.c:32
 __do_huge_pmd_anonymous_page mm/huge_memory.c:564 [inline]
 do_huge_pmd_anonymous_page+0x554/0x1b00 mm/huge_memory.c:728
 create_huge_pmd mm/memory.c:3828 [inline]
 __handle_mm_fault+0x1827/0x39c0 mm/memory.c:4031
 handle_mm_fault+0x334/0x8d0 mm/memory.c:4097
 __do_page_fault+0x5c9/0xc90 arch/x86/mm/fault.c:1449
 do_page_fault+0xee/0x720 arch/x86/mm/fault.c:1524
 page_fault+0x22/0x30 arch/x86/entry/entry_64.S:1067
RIP: 0033:0x405676
RSP: 002b:0000000000a6f910 EFLAGS: 00010246
RAX: 000000002001d000 RBX: 0000000000000002 RCX: 0000000000000002
RDX: c41597d77179e2b7 RSI: 0000000000000000 RDI: 0000000000eb6848
RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000006c
R10: 0000000000a6f9b0 R11: 0000000000000246 R12: fffffffffffffffe
R13: 000000002001d000 R14: 000000000001a6f1 R15: 0000000000000016
Code: 55 48 89 e5 41 57 41 56 41 55 41 54 49 c7 c7 80 b3 ec 85 53 49 89 f4 48 83 ec 10 48 89 7d c8 4d 85 e4 4d 89 e5 0f 84 c8 00 00 00 <49> 63 95 04 01 00 00 4c 8b 30 48 29 d0 49 83 3f 00 48 89 c6 0f 
RIP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163 RSP: ffff88019feaf578
CR2: 0000000000000105
---[ end trace 5ea59deafd35c438 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/11/07 09:52 linux-next 5a3517e009e9 e0a2b195 .config console log report ci-upstream-next-kasan-gce
* Struck through repros no longer work on HEAD.