syzbot


BUG: unable to handle kernel paging request in qlist_free_all (2)

Status: closed as invalid on 2017/12/05 10:45
Subsystems: mm
[Documentation on labels]
First crash: 2701d, last: 2696d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 8 1194d 1431d 0/1 auto-closed as invalid on 2022/05/13 11:55
upstream BUG: unable to handle kernel paging request in qlist_free_all (5) fs 2 2216d 2217d 0/28 auto-closed as invalid on 2019/09/24 08:20
upstream BUG: unable to handle kernel paging request in qlist_free_all mm 1 2730d 2730d 0/28 closed as invalid on 2017/10/30 13:35
upstream BUG: unable to handle kernel paging request in qlist_free_all (7) kernel 20 1235d 1455d 0/28 auto-closed as invalid on 2022/03/03 13:56
upstream BUG: unable to handle kernel paging request in qlist_free_all (4) kernel syz 17 2479d 2599d 0/28 closed as dup on 2018/07/08 14:57
upstream BUG: unable to handle kernel paging request in qlist_free_all (6) kernfs 1 1659d 1655d 0/28 auto-closed as invalid on 2021/01/03 14:25

Sample crash report:
binder: 22840 RLIMIT_NICE not set
binder: 22820:22850 BC_DEAD_BINDER_DONE 0000000000000000 not found
binder: 22820:22850 Release 1 refcount change on invalid ref 0 ret -22
binder: 22820:22850 got reply transaction with no transaction stack
binder: 22820:22850 transaction failed 29201/-71, size 0-16 line 2670
BUG: unable to handle kernel paging request at 000000008e8bf404
IP: virt_to_head_page include/linux/mm.h:615 [inline]
IP: qlink_to_cache mm/kasan/quarantine.c:127 [inline]
IP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163
PGD 0 P4D 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 22860 Comm: syz-executor4 Not tainted 4.15.0-rc1+ #115
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: 00000000c15b5cf9 task.stack: 00000000bc1c2d8e
RIP: 0010:virt_to_head_page include/linux/mm.h:615 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:127 [inline]
RIP: 0010:qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163
RSP: 0018:ffff8801ca1a79f8 EFLAGS: 00010286
RAX: 0000000100000001 RBX: 0000000000000286 RCX: ffffea0000000000
RDX: ffffebe004000000 RSI: ffff8801cfc54d38 RDI: 0000000000000286
RBP: ffff8801ca1a7a30 R08: 1ffff10039434f0d R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000100000001 R15: ffffffff85ecb440
FS:  0000000000000000(0000) GS:ffff8801db500000(0063) knlGS:000000000a137900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffffebe004000020 CR3: 00000001cc04f000 CR4: 00000000001426e0
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3385 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3545
 __split_vma+0x10b/0x7b0 mm/mmap.c:2564
 split_vma+0x8f/0xc0 mm/mmap.c:2627
 mprotect_fixup+0x3f5/0x640 mm/mprotect.c:352
 do_mprotect_pkey+0x57d/0x900 mm/mprotect.c:490
 SYSC_mprotect mm/mprotect.c:515 [inline]
 SyS_mprotect+0x2a/0x40 mm/mprotect.c:512
 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline]
 do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:125
RIP: 0023:0xf7f2ac79
RSP: 002b:000000000847f7c8 EFLAGS: 00000212 ORIG_RAX: 000000000000007d
RAX: ffffffffffffffda RBX: 00000000f7706000 RCX: 0000000000001000
RDX: 0000000000000000 RSI: 00000000f7726ba0 RDI: 0000000000021000
RBP: 000000000847f868 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Code: 00 00 00 80 48 01 c2 72 44 48 b9 00 00 00 80 ff 77 00 00 48 01 ca 48 b9 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 ca <48> 8b 4a 20 48 8d 71 ff 83 e1 01 48 0f 45 d6 4c 8b 6a 30 e9 f4 
RIP: virt_to_head_page include/linux/mm.h:615 [inline] RSP: ffff8801ca1a79f8
RIP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] RSP: ffff8801ca1a79f8
RIP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801ca1a79f8
CR2: ffffebe004000020
---[ end trace 7ea2069b02b32015 ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/12/03 08:12 upstream 2db767d9889c 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/12/02 16:18 upstream 2db767d9889c 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/12/02 13:13 net-next-old 4c94cc2d3d57 2fa91450 .config console log report ci-upstream-net-kasan-gce
2017/11/28 02:23 mmots 1ea8d039f9ed afba0b55 .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.