syzbot


BUG: unable to handle kernel NULL pointer dereference in qlist_free_all

Status: closed as invalid on 2017/10/18 09:51
Subsystems: fs
[Documentation on labels]
First crash: 2619d, last: 2619d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 1 1689d 1689d 0/1 auto-closed as invalid on 2020/08/18 08:06
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 8 1056d 1293d 0/1 auto-closed as invalid on 2022/05/13 11:55
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (4) mm 8 2508d 2555d 0/28 closed as invalid on 2018/02/12 16:58
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (6) ext4 syz 7 2067d 2165d 0/28 closed as dup on 2018/12/31 07:50
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (7) tomoyo 7 1670d 1730d 0/28 closed as invalid on 2020/07/06 10:57
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) kernel 1 2584d 2584d 0/28 closed as invalid on 2017/11/09 10:06
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (8) kvm 11 1524d 1547d 0/28 auto-closed as invalid on 2021/01/30 15:56
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 2 1659d 1693d 0/1 auto-closed as invalid on 2020/09/17 07:42
upstream BUG: unable to handle kernel paging request in qlist_free_all (7) kernel 20 1097d 1318d 0/28 auto-closed as invalid on 2022/03/03 13:56
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 3 1300d 1324d 0/1 auto-closed as invalid on 2021/09/12 03:17
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (5) fs 19 2414d 2471d 0/28 closed as invalid on 2018/05/26 17:43
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (3) mm 8 2558d 2574d 0/28 closed as invalid on 2017/12/05 10:45

Sample crash report:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000105
IP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'.
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=21293 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=21298 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=21303 comm=syz-executor5
SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=21304 comm=syz-executor5
PGD 0 P4D 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 21282 Comm: modprobe Not tainted 4.14.0-rc1+ #66
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d97ee280 task.stack: ffff8801b4dd8000
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
RSP: 0018:ffff8801b4ddfba8 EFLAGS: 00010246
RAX: ffff8801d8026700 RBX: 0000000000000282 RCX: 0000000000000000
RDX: ffffea0007600980 RSI: ffffea000706251f RDI: 0000000000000282
RBP: ffff8801b4ddfbe0 R08: ffff8801d9e9ca40 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8801d8026700 R15: ffffffff85ac99a0
FS:  00007f9937d77700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000105 CR3: 00000001c3d3e000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:444 [inline]
 slab_alloc mm/slab.c:3397 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3559
 getname_flags+0xcb/0x580 fs/namei.c:137
 user_path_at_empty+0x2d/0x50 fs/namei.c:2598
 user_path_at include/linux/namei.h:56 [inline]
 vfs_statx+0xe9/0x190 fs/stat.c:184
 vfs_stat include/linux/fs.h:3060 [inline]
 SYSC_newstat+0x87/0xf0 fs/stat.c:336
 SyS_newstat+0x1d/0x30 fs/stat.c:332
 entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x7f993768dc65
RSP: 002b:00007ffd60e5ace8 EFLAGS: 00000246 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 00007f9937959481 RCX: 00007f993768dc65
RDX: 00007ffd60e5ade0 RSI: 00007ffd60e5ade0 RDI: 00007f9937959481
RBP: 0000000000000082 R08: 00007f9937944ef8 R09: 00007f99376e1070
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd60e5af13 R14: 00005601ee1fc1b0 R15: 000550e55072ffc0
Code: 55 48 89 e5 41 57 41 56 41 55 41 54 49 c7 c7 a0 99 ac 85 53 49 89 f4 48 83 ec 10 48 89 7d c8 4d 85 e4 4d 89 e5 0f 84 c8 00 00 00 <49> 63 95 04 01 00 00 4c 8b 30 48 29 d0 49 83 3f 00 48 89 c6 0f 
RIP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801b4ddfba8
CR2: 0000000000000105
---[ end trace 582c80162161ee14 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/10/03 08:26 net-next-old 4efac6ff4dc7 c26ea367 .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.