syzbot

 sign-in | mailing list | source | docs
🐞 Open [990] ≡ Subsystems 🐞 Fixed [5238] 🐞 Invalid [12509] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

general protection fault in list_lru_add

Status: fixed on 2023/02/24 13:51
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com
Fix commit: ae085d7f9365 mm: kfence: fix missing objcg housekeeping for SLAB
First crash: 765d, last: 476d
Cause bisection: introduced by (bisect log) :
commit 5abc1e37afa0335c52608d640fd30910b2eeda21
Author: Muchun Song <songmuchun@bytedance.com>
Date: Tue Mar 22 21:41:19 2022 +0000

  mm: list_lru: allocate list_lru_one only when needed

Crash: general protection fault in list_lru_add (log)
Repro: C syz .config
  
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 5.16 0000/1017] 5.16.19-rc1 review 1034 (1035) 2022/04/07 08:34
[PATCH 5.15 000/913] 5.15.33-rc1 review 932 (933) 2022/04/06 15:36
[PATCH 5.17 0000/1126] 5.17.2-rc1 review 1143 (1144) 2022/04/06 14:06
[PATCH 1/2] mm: kfence: fix missing objcg housekeeping for SLAB 10 (10) 2022/03/28 07:01
[syzbot] general protection fault in list_lru_add 16 (20) 2022/03/27 05:27
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: Dentry still in use in unmount C done 1184 792d 805d 2/2 fixed on 2022/02/25 03:20
upstream BUG: unable to handle kernel paging request in list_lru_add mm syz 48 34d 234d 0/26 upstream: reported syz repro on 2023/09/04 16:00
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2022/08/31 15:27 24m retest repro upstream OK log
2022/08/31 14:27 23m retest repro upstream OK log
2022/03/25 01:44 3m songmuchun@bytedance.com patch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 5abc1e37afa0335c52608d640fd30910b2eeda21 error OK
2022/03/24 16:39 3m songmuchun@bytedance.com patch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git 5abc1e37afa0335c52608d640fd30910b2eeda21 error OK
2022/03/24 16:13 11m songmuchun@bytedance.com patch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git master OK

Sample crash report:
blk_print_req_error: 16 callbacks suppressed
I/O error, dev loop1, sector 16128 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 3655 Comm: udevd Tainted: G        W         5.17.0-syzkaller-11138-gf022814633e1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:list_add_tail include/linux/list.h:102 [inline]
RIP: 0010:list_lru_add+0x277/0x510 mm/list_lru.c:129
Code: 04 64 4d 8d 7c c7 10 4c 89 3c 24 e8 a3 a6 ca ff 49 8d 47 08 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 4d 02 00 00 4d 8b 77 08 48 89 df 48 8b 14 24 4c
RSP: 0018:ffffc9000319f9d0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88823bd8a0f8 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff81ad8bad RDI: ffffffff8db5fd10
RBP: ffff888019c0c7f0 R08: 0000000000000000 R09: ffffffff8db5fd17
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff888024752c80 R14: 0000000000000080 R15: 0000000000000000
FS:  00007fd051579840(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde4512f98 CR3: 0000000020c5c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 d_lru_add fs/dcache.c:431 [inline]
 retain_dentry fs/dcache.c:685 [inline]
 dput+0x7a7/0xdb0 fs/dcache.c:908
 handle_mounts fs/namei.c:1552 [inline]
 step_into+0xcb3/0x1d80 fs/namei.c:1850
 walk_component+0x171/0x6a0 fs/namei.c:2026
 lookup_last fs/namei.c:2475 [inline]
 path_lookupat+0x1bb/0x860 fs/namei.c:2499
 filename_lookup+0x1c6/0x590 fs/namei.c:2528
 user_path_at_empty+0x42/0x60 fs/namei.c:2851
 user_path_at include/linux/namei.h:57 [inline]
 do_faccessat+0x127/0x850 fs/open.c:422
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fd051125bcd
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 55 41 89 ca 41 89 cd b8 b7 01 00 00 41 54 41 89 d4 55 53 48 81 ec 98 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 27 01 00 00 41 89 c0 85 c0 0f 84 f4 00 00
RSP: 002b:00007ffccc50fc50 EFLAGS: 00000206 ORIG_RAX: 00000000000001b7
RAX: ffffffffffffffda RBX: 00007ffccc510de0 RCX: 00007fd051125bcd
RDX: 0000000000000000 RSI: 00007fd051671970 RDI: 000000000000000b
RBP: 0000564d46a4cd90 R08: 0000564d46a361d0 R09: 0000564d46a0a010
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:list_add_tail include/linux/list.h:102 [inline]
RIP: 0010:list_lru_add+0x277/0x510 mm/list_lru.c:129
Code: 04 64 4d 8d 7c c7 10 4c 89 3c 24 e8 a3 a6 ca ff 49 8d 47 08 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 4d 02 00 00 4d 8b 77 08 48 89 df 48 8b 14 24 4c
RSP: 0018:ffffc9000319f9d0 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff88823bd8a0f8 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff81ad8bad RDI: ffffffff8db5fd10
RBP: ffff888019c0c7f0 R08: 0000000000000000 R09: ffffffff8db5fd17
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffff888024752c80 R14: 0000000000000080 R15: 0000000000000000
FS:  00007fd051579840(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde4512f98 CR3: 0000000020c5c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	04 64                	add    $0x64,%al
   2:	4d 8d 7c c7 10       	lea    0x10(%r15,%rax,8),%r15
   7:	4c 89 3c 24          	mov    %r15,(%rsp)
   b:	e8 a3 a6 ca ff       	callq  0xffcaa6b3
  10:	49 8d 47 08          	lea    0x8(%r15),%rax
  14:	48 89 c2             	mov    %rax,%rdx
  17:	48 89 44 24 10       	mov    %rax,0x10(%rsp)
  1c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  23:	fc ff df
  26:	48 c1 ea 03          	shr    $0x3,%rdx
* 2a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1) <-- trapping instruction
  2e:	0f 85 4d 02 00 00    	jne    0x281
  34:	4d 8b 77 08          	mov    0x8(%r15),%r14
  38:	48 89 df             	mov    %rbx,%rdi
  3b:	48 8b 14 24          	mov    (%rsp),%rdx
  3f:	4c                   	rex.WR

Crashes (1125):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/03/27 23:16 upstream f022814633e1 89bc8608 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 18:31 upstream f022814633e1 89bc8608 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/26 13:48 upstream 52d543b5497c 89bc8608 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/23 20:00 upstream 6b1f86f8e9c7 5ff41e94 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/23 12:08 upstream 6b1f86f8e9c7 5ff41e94 .config console log report syz C ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2023/01/06 06:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 247f34f7b803 1dac8c7a .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in list_lru_add
2022/12/27 05:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci a5541c0811a0 9da18ae8 .config console log report syz C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in list_lru_add
2022/03/27 16:17 upstream f022814633e1 89bc8608 .config console log report syz C ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 00:32 upstream 52d543b5497c 89bc8608 .config console log report syz ci-qemu-upstream general protection fault in list_lru_add
2022/03/28 09:46 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 09:36 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 08:35 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 07:22 upstream 7001052160d1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/28 06:23 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 05:12 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 04:27 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 03:20 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 02:14 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/28 00:56 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 23:56 upstream f82da161ea75 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 22:09 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 21:09 upstream 7001052160d1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 20:06 upstream 7001052160d1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 19:39 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 18:35 upstream 7001052160d1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 18:04 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 17:00 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 16:06 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 14:57 upstream f022814633e1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 14:56 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 13:55 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 12:40 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 11:30 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 11:19 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 10:13 upstream f022814633e1 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 09:50 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 08:42 upstream f022814633e1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 08:35 upstream f022814633e1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 07:20 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 06:52 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 05:52 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 05:39 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 04:39 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 03:37 upstream f022814633e1 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/27 03:20 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 02:20 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/27 01:13 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/26 23:45 upstream 52d543b5497c 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/26 22:31 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/26 21:39 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/26 20:33 upstream bddac7c1e02b 89bc8608 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
2022/03/26 19:45 upstream 52d543b5497c 89bc8608 .config console log report info ci-qemu-upstream general protection fault in list_lru_add
2022/03/23 03:59 upstream 6b1f86f8e9c7 5ff41e94 .config console log report info ci-upstream-kasan-gce-selinux-root general protection fault in list_lru_add
* Struck through repros no longer work on HEAD.