syzbot

 sign-in | mailing list | source | docs
🐞 Open [712] 🐞 Fixed [297] 🐞 Invalid [838] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue

Status: fixed on 2019/12/14 05:59
Reported-by: syzbot+4db7e3c9c2dcb71040a6@syzkaller.appspotmail.com
Fix commit: 9f0f39c92e4f nbd: fix max number of supported devs
First crash: 1817d, last: 1632d
Fix bisection: fixed by (bisect log) :
commit 9f0f39c92e4f50189155dfb13bb5524372e40eba
Author: Mike Christie <mchristi@redhat.com>
Date: Sun Aug 4 19:10:06 2019 +0000

  nbd: fix max number of supported devs

  
▶ ▼ Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue C done 20 1584d 1822d 1/1 fixed on 2019/12/16 09:09
upstream BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue block C 8 2009d 2029d 11/26 fixed on 2018/11/12 21:25
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue (2) C error 20 521d 1584d 0/1 upstream: reported C repro on 2019/12/15 04:28
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in blk_mq_map_swqueue (2) C 13 418d 1539d 0/1 upstream: reported C repro on 2020/01/29 04:42

Sample crash report:
RAX: ffffffffffffffda RBX: 00007fffcbd05880 RCX: 00000000004453b9
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000005
RBP: 0000000000000007 R08: 0000000000000001 R09: 0000000001d00032
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402720
R13: 00000000004027b0 R14: 0000000000000000 R15: 0000000000000000
BUG: unable to handle kernel NULL pointer dereference at 0000000000000118
PGD 9f964067 P4D 9f964067 PUD 8e173067 PMD 0 
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7862 Comm: syz-executor755 Not tainted 4.19.36 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:set_bit arch/x86/include/asm/bitops.h:76 [inline]
RIP: 0010:cpumask_set_cpu include/linux/cpumask.h:311 [inline]
RIP: 0010:blk_mq_map_swqueue+0x29e/0xa60 block/blk-mq.c:2345
Code: 80 3c 18 00 0f 85 ef 06 00 00 44 89 e6 bf 3f 00 00 00 4d 8b 6d 00 e8 31 96 57 fe 41 83 fc 3f 0f 87 11 05 00 00 e8 a2 94 57 fe <f0> 4d 0f ab b5 18 01 00 00 49 8d bd 74 01 00 00 48 89 fa 48 c1 ea
RSP: 0018:ffff88808aa178c0 EFLAGS: 00010293
RAX: ffff8880a08d2600 RBX: dffffc0000000000 RCX: ffffffff8313b05f
RDX: 0000000000000000 RSI: ffffffff8313b06e RDI: 0000000000000005
RBP: ffff88808aa17930 R08: ffff8880a08d2600 R09: 0000000000000000
R10: ffffed1014861ff0 R11: ffff8880a430ff83 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880a41c70c0
FS:  0000000001d0a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 000000008f898000 CR4: 00000000001406f0
Call Trace:
 blk_mq_queue_reinit block/blk-mq.c:2684 [inline]
 __blk_mq_update_nr_hw_queues block/blk-mq.c:3003 [inline]
 blk_mq_update_nr_hw_queues+0x5ab/0xb70 block/blk-mq.c:3017
 nbd_start_device+0x15e/0xbb0 drivers/block/nbd.c:1155
 nbd_start_device_ioctl drivers/block/nbd.c:1196 [inline]
 __nbd_ioctl drivers/block/nbd.c:1267 [inline]
 nbd_ioctl+0x413/0xc60 drivers/block/nbd.c:1307
 __blkdev_driver_ioctl block/ioctl.c:303 [inline]
 blkdev_ioctl+0xc4b/0x1ae0 block/ioctl.c:601
 block_ioctl+0xee/0x130 fs/block_dev.c:1891
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:501 [inline]
 do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:688
 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
 __do_sys_ioctl fs/ioctl.c:712 [inline]
 __se_sys_ioctl fs/ioctl.c:710 [inline]
 __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4453b9
Code: e8 cc ac 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db ce fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffcbd05878 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffcbd05880 RCX: 00000000004453b9
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000005
RBP: 0000000000000007 R08: 0000000000000001 R09: 0000000001d00032
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402720
R13: 00000000004027b0 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000118
---[ end trace e40a45507439d051 ]---
RIP: 0010:set_bit arch/x86/include/asm/bitops.h:76 [inline]
RIP: 0010:cpumask_set_cpu include/linux/cpumask.h:311 [inline]
RIP: 0010:blk_mq_map_swqueue+0x29e/0xa60 block/blk-mq.c:2345
Code: 80 3c 18 00 0f 85 ef 06 00 00 44 89 e6 bf 3f 00 00 00 4d 8b 6d 00 e8 31 96 57 fe 41 83 fc 3f 0f 87 11 05 00 00 e8 a2 94 57 fe <f0> 4d 0f ab b5 18 01 00 00 49 8d bd 74 01 00 00 48 89 fa 48 c1 ea
RSP: 0018:ffff88808aa178c0 EFLAGS: 00010293
RAX: ffff8880a08d2600 RBX: dffffc0000000000 RCX: ffffffff8313b05f
RDX: 0000000000000000 RSI: ffffffff8313b06e RDI: 0000000000000005
RBP: ffff88808aa17930 R08: ffff8880a08d2600 R09: 0000000000000000
R10: ffffed1014861ff0 R11: ffff8880a430ff83 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880a41c70c0
FS:  0000000001d0a940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000118 CR3: 000000008f898000 CR4: 00000000001406f0

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/04/26 21:13 linux-4.19.y c98875d930e9 b617407b .config console log report syz C ci2-linux-4-19
2019/10/28 14:47 linux-4.19.y c3038e718a19 25bb509e .config console log report ci2-linux-4-19
2019/10/11 12:53 linux-4.19.y 58fce2064530 1a3bad90 .config console log report ci2-linux-4-19
2019/09/26 05:50 linux-4.19.y d573e8a79f70 24d405a3 .config console log report ci2-linux-4-19
2019/09/21 08:00 linux-4.19.y d573e8a79f70 d96e88f3 .config console log report ci2-linux-4-19
2019/09/17 00:20 linux-4.19.y db2d0b7c1dde 51ca0454 .config console log report ci2-linux-4-19
2019/09/01 11:36 linux-4.19.y 97ab07e11fbf bad3cce2 .config console log report ci2-linux-4-19
2019/08/24 11:32 linux-4.19.y a5aa80588fcd 78ded196 .config console log report ci2-linux-4-19
2019/08/06 06:28 linux-4.19.y b3060a1a313f 6affd8e8 .config console log report ci2-linux-4-19
2019/07/21 22:47 linux-4.19.y be9b6782a9eb 1656845f .config console log report ci2-linux-4-19
2019/06/20 12:25 linux-4.19.y 9f31eb60d7a2 34bf9440 .config console log report ci2-linux-4-19
2019/04/26 20:51 linux-4.19.y c98875d930e9 b617407b .config console log report ci2-linux-4-19
* Struck through repros no longer work on HEAD.