BUG: unable to handle kernel NULL pointer dereference in qlist_free

BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (3)
Status: closed as invalid on 2017/12/05 10:45
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 1355d, last: 1338d

similar bugs (11):
Kernel	Title	Repro	Count	Last	Reported	Patched	Status
linux-4.19	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all		1	470d	470d	0/1	auto-closed as invalid on 2020/08/18 08:06
linux-4.19	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2)		4	10d	74d	0/1	upstream: reported on 2021/05/21 12:23
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (4)		8	1289d	1336d	0/22	closed as invalid on 2018/02/12 16:58
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (6)	syz	7	848d	946d	0/22	closed as dup on 2018/12/31 07:50
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (7)		7	451d	511d	0/22	closed as invalid on 2020/07/06 10:57
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2)		1	1365d	1365d	0/22	closed as invalid on 2017/11/09 10:06
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (8)		11	305d	327d	0/22	auto-closed as invalid on 2021/01/30 15:56
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all		1	1400d	1400d	0/22	closed as invalid on 2017/10/18 09:51
linux-4.14	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all		2	440d	474d	0/1	auto-closed as invalid on 2020/09/17 07:42
linux-4.14	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (2)		3	81d	105d	0/1	upstream: reported on 2021/04/20 08:21
upstream	BUG: unable to handle kernel NULL pointer dereference in qlist_free_all (5)		19	1195d	1252d	0/22	closed as invalid on 2018/05/26 17:43

Sample crash report:

IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
netlink: 2 bytes leftover after parsing attributes in process `syz-executor5'.
IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
BUG: unable to handle kernel NULL pointer dereference at 0000000000000105
IP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
PGD 1b79db067 P4D 1b79db067 PUD 1ca090067 PMD 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3336 Comm: syz-executor5 Not tainted 4.14.0+ #195
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801c5f023c0 task.stack: ffff8801ca7f0000
RIP: 0010:qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163
RSP: 0018:ffff8801ca7f7a68 EFLAGS: 00010246
RAX: ffff8801c40e0500 RBX: 0000000000000286 RCX: 0000000000000000
RDX: ffffea0007103800 RSI: ffffea000767661f RDI: 0000000000000286
RBP: ffff8801ca7f7aa0 R08: 1ffff100394fef1b R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000001 R14: ffff8801c40e0500 R15: ffffffff85ecb400
FS:  0000000000bc5940(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000105 CR3: 00000001ca101000 CR4: 00000000001426e0
Call Trace:
 quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
 kasan_kmalloc+0xca/0xe0 mm/kasan/kasan.c:536
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc mm/slab.c:3385 [inline]
 kmem_cache_alloc+0x11b/0x760 mm/slab.c:3545
 shmem_alloc_inode+0x1b/0x40 mm/shmem.c:3836
 alloc_inode+0x65/0x180 fs/inode.c:208
 new_inode_pseudo+0x69/0x190 fs/inode.c:890
 new_inode+0x1c/0x40 fs/inode.c:919
 shmem_get_inode+0xe1/0x920 mm/shmem.c:2157
 shmem_mknod+0x5a/0x1b0 mm/shmem.c:2990
 shmem_mkdir+0x29/0x50 mm/shmem.c:3041
 vfs_mkdir+0x390/0x600 fs/namei.c:3809
 SYSC_mkdirat fs/namei.c:3832 [inline]
 SyS_mkdirat fs/namei.c:3816 [inline]
 SYSC_mkdir fs/namei.c:3843 [inline]
 SyS_mkdir+0x220/0x2a0 fs/namei.c:3841
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x451d37
RSP: 002b:0000000000a6fa28 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000451d37
RDX: 0000000000a6fa56 RSI: 00000000000001ff RDI: 0000000000a6fa50
RBP: 0000000000a6fa50 R08: 0000000000000000 R09: 0000000000000006
R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000bc7ca0
R13: 0000000000000000 R14: 00000000000435d2 R15: 0000000000000010
Code: 55 48 89 e5 41 57 41 56 41 55 41 54 49 c7 c7 00 b4 ec 85 53 49 89 f4 48 83 ec 10 48 89 7d c8 4d 85 e4 4d 89 e5 0f 84 c8 00 00 00 <49> 63 95 04 01 00 00 4c 8b 30 48 29 d0 49 83 3f 00 48 89 c6 0f 
RIP: qlist_free_all+0x37/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801ca7f7a68
CR2: 0000000000000105
---[ end trace 462986f363108048 ]---

Crashes (8):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report
ci-upstream-kasan-gce	2017/11/27 00:18	upstream	bbecb1cfcca5	4bd70f88	.config	log	report
ci-upstream-kasan-gce	2017/11/24 13:13	net-next	1d3b78bbc6e9	deb5f6ae	.config	log	report
ci-upstream-kasan-gce-386	2017/12/04 03:56	upstream	ae64f9bd1d36	48359b97	.config	log	report
ci-upstream-kasan-gce-386	2017/12/03 00:11	upstream	2db767d9889c	48359b97	.config	log	report
ci-upstream-kasan-gce-386	2017/12/02 09:12	upstream	a0651c7fa2c0	48359b97	.config	log	report
ci-upstream-kasan-gce-386	2017/11/25 19:38	upstream	844056fd74eb	4bd70f88	.config	log	report
ci-upstream-net-kasan-gce	2017/11/17 13:25	net-next	6363b3f3ac5b	bf820689	.config	log	report
ci-upstream-mmots-kasan-gce	2017/11/22 14:23	mmots	1ea8d039f9ed	deb5f6ae	.config	log	report