syzbot

 sign-in | mailing list | source | docs
🐞 Open [977] ≡ Subsystems 🐞 Fixed [5235] 🐞 Invalid [12490] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (3)

Status: closed as invalid on 2017/12/05 10:45
Subsystems: mm
[Documentation on labels]
First crash: 2348d, last: 2332d
▶ ▼ Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 1 1463d 1463d 0/1 auto-closed as invalid on 2020/08/18 08:06
linux-4.19 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 8 830d 1067d 0/1 auto-closed as invalid on 2022/05/13 11:55
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (4) mm 8 2282d 2329d 0/26 closed as invalid on 2018/02/12 16:58
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (6) ext4 syz 7 1841d 1940d 0/26 closed as dup on 2018/12/31 07:50
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (7) tomoyo 7 1444d 1504d 0/26 closed as invalid on 2020/07/06 10:57
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) kernel 1 2358d 2358d 0/26 closed as invalid on 2017/11/09 10:06
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (8) kvm 11 1298d 1321d 0/26 auto-closed as invalid on 2021/01/30 15:56
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all fs 1 2393d 2393d 0/26 closed as invalid on 2017/10/18 09:51
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all 2 1434d 1467d 0/1 auto-closed as invalid on 2020/09/17 07:42
upstream BUG: unable to handle kernel paging request in qlist_free_all (7) kernel 20 871d 1092d 0/26 auto-closed as invalid on 2022/03/03 13:56
linux-4.14 BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2) 3 1074d 1098d 0/1 auto-closed as invalid on 2021/09/12 03:17
upstream BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (5) fs 19 2188d 2245d 0/26 closed as invalid on 2018/05/26 17:43

Sample crash report:
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'.
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
BUG: unable to handle kernel NULL pointer dereference at 0000000000000105
IP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
PGD 1b79db067 P4D 1b79db067 PUD 1ca090067 PMD 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3336 Comm: syz-executor5 Not tainted 4.14.0+ #195
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801c5f023c0 task.stack: ffff8801ca7f0000
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
RSP: 0018:ffff8801ca7f7a68 EFLAGS: 00010246
RAX: ffff8801c40e0500 RBX: 0000000000000286 RCX: 0000000000000000
RDX: ffffea0007103800 RSI: ffffea000767661f RDI: 0000000000000286
RBP: ffff8801ca7f7aa0 R08: 1ffff100394fef1b R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8801c40e0500 R15: ffffffff85ecb400
FS:  0000000000bc5940(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000105 CR3: 00000001ca101000 CR4: 00000000001426e0
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3385 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3545
 shmem_alloc_inode+0x1b/0x40 mm/shmem.c:3836
 alloc_inode+0x65/0x180 fs/inode.c:208
 new_inode_pseudo+0x69/0x190 fs/inode.c:890
 new_inode+0x1c/0x40 fs/inode.c:919
 shmem_get_inode+0xe1/0x920 mm/shmem.c:2157
 shmem_mknod+0x5a/0x1b0 mm/shmem.c:2990
 shmem_mkdir+0x29/0x50 mm/shmem.c:3041
 vfs_mkdir+0x390/0x600 fs/namei.c:3809
 SYSC_mkdirat fs/namei.c:3832 [inline]
 SyS_mkdirat fs/namei.c:3816 [inline]
 SYSC_mkdir fs/namei.c:3843 [inline]
 SyS_mkdir+0x220/0x2a0 fs/namei.c:3841
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x451d37
RSP: 002b:0000000000a6fa28 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000451d37
RDX: 0000000000a6fa56 RSI: 00000000000001ff RDI: 0000000000a6fa50
RBP: 0000000000a6fa50 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000bc7ca0
R13: 0000000000000000 R14: 00000000000435d2 R15: 0000000000000010
Code: 55 48 89 e5 41 57 41 56 41 55 41 54 49 c7 c7 00 b4 ec 85 53 49 89 f4 48 83 ec 10 48 89 7d c8 4d 85 e4 4d 89 e5 0f 84 c8 00 00 00 <49> 63 95 04 01 00 00 4c 8b 30 48 29 d0 49 83 3f 00 48 89 c6 0f 
RIP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801ca7f7a68
CR2: 0000000000000105
---[ end trace 462986f363108048 ]---

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2017/11/27 00:18 upstream bbecb1cfcca5 4bd70f88 .config console log report ci-upstream-kasan-gce
2017/11/24 13:13 net-next-old 1d3b78bbc6e9 deb5f6ae .config console log report ci-upstream-kasan-gce
2017/12/04 03:56 upstream ae64f9bd1d36 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/12/03 00:11 upstream 2db767d9889c 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/12/02 09:12 upstream a0651c7fa2c0 48359b97 .config console log report ci-upstream-kasan-gce-386
2017/11/25 19:38 upstream 844056fd74eb 4bd70f88 .config console log report ci-upstream-kasan-gce-386
2017/11/17 13:25 net-next-old 6363b3f3ac5b bf820689 .config console log report ci-upstream-net-kasan-gce
2017/11/22 14:23 mmots 1ea8d039f9ed deb5f6ae .config console log report ci-upstream-mmots-kasan-gce
* Struck through repros no longer work on HEAD.