BUG: unable to handle kernel paging request in quarantine_reduce
17 views
Skip to first unread message
syzbot
Mar 13, 2020, 1:47:10 AM3/13/20
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: 378fee2e Merge tag 'char-misc-5.6-rc5' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c4c191e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7aef917d2e37d731
dashboard link: https://syzkaller.appspot.com/bug?extid=fd4d34132dbb09ce044f
compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
CC: [b...@alien8.de dave....@linux.intel.com h...@zytor.com linux-...@vger.kernel.org lu...@kernel.org mi...@redhat.com pet...@infradead.org tg...@linutronix.de x...@kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fd4d34...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffea01303318c8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12fff8067 P4D 12fff8067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 14303 Comm: blkid Not tainted 5.6.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:723 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:128 [inline]
RIP: 0010:qlist_free_all mm/kasan/quarantine.c:164 [inline]
RIP: 0010:quarantine_reduce+0x138/0x1c0 mm/kasan/quarantine.c:260
Code: 00 00 0f 45 d1 89 15 57 2f 83 09 48 c7 c7 58 a5 10 89 48 89 c6 e8 b8 48 49 06 48 89 ef e8 a0 3a 84 ff 48 c1 e8 06 48 83 e0 c0 <49> 8b 4c 07 08 f6 c1 01 75 1d 4c 01 f8 48 8b 70 18 48 8b 5d 00 48
RSP: 0000:ffffc90016f3f968 EFLAGS: 00010206
RAX: 00000001303318c0 RBX: ffff88cc0cc636c6 RCX: ffff888039e2e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88cc0cc636c6 R08: ffffffff813529cc R09: fffffbfff15db91b
R10: fffffbfff15db91b R11: 0000000000000000 R12: ffff8880aa412a80
R13: 0000000000000038 R14: 0000000000000001 R15: ffffea0000000000
FS: 00007f1f98f03740(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea01303318c8 CR3: 000000003f874000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__kasan_kmalloc+0x43/0x1c0 mm/kasan/common.c:496
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc mm/slab.c:3320 [inline]
kmem_cache_alloc+0x1f5/0x2d0 mm/slab.c:3484
ptlock_alloc+0x1c/0x70 mm/memory.c:4846
ptlock_init include/linux/mm.h:1916 [inline]
pgtable_pte_page_ctor include/linux/mm.h:1943 [inline]
__pte_alloc_one include/asm-generic/pgalloc.h:66 [inline]
pte_alloc_one+0x6a/0x180 arch/x86/mm/pgtable.c:26
__pte_alloc+0x1d/0x2a0 mm/memory.c:426
do_anonymous_page+0x130c/0x17f0 mm/memory.c:3175
handle_pte_fault mm/memory.c:4050 [inline]
__handle_mm_fault mm/memory.c:4182 [inline]
handle_mm_fault+0x1b3d/0x27f0 mm/memory.c:4219
do_user_addr_fault+0x51b/0xa90 arch/x86/mm/fault.c:1442
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0033:0x7f1f987b21e5
Code: 8b 05 97 dc 30 00 48 8b 00 48 85 c0 74 02 ff d0 48 89 d8 48 8b 4c 24 20 49 8d 1c 1f 48 29 cb 48 89 0d b7 fc 30 00 48 83 cb 01 <48> 89 59 08 48 01 05 c0 04 31 00 80 7c 24 3c 00 0f 84 d8 fb ff ff
RSP: 002b:00007ffe28e322e0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000021001 RCX: 0000000001ac7000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000
RBP: 00007f1f98ac1e40 R08: 00007f1f98ac1e40 R09: 00007f1f9873cc60
R10: 0000000000091a20 R11: 0000000000000206 R12: 00007f1f98ac1e98
R13: 0000000000000000 R14: 00007f1f98ac0da0 R15: 0000000001ae8000
Modules linked in:
CR2: ffffea01303318c8
---[ end trace c3561212ba8bb542 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:723 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:128 [inline]
RIP: 0010:qlist_free_all mm/kasan/quarantine.c:164 [inline]
RIP: 0010:quarantine_reduce+0x138/0x1c0 mm/kasan/quarantine.c:260
Code: 00 00 0f 45 d1 89 15 57 2f 83 09 48 c7 c7 58 a5 10 89 48 89 c6 e8 b8 48 49 06 48 89 ef e8 a0 3a 84 ff 48 c1 e8 06 48 83 e0 c0 <49> 8b 4c 07 08 f6 c1 01 75 1d 4c 01 f8 48 8b 70 18 48 8b 5d 00 48
RSP: 0000:ffffc90016f3f968 EFLAGS: 00010206
RAX: 00000001303318c0 RBX: ffff88cc0cc636c6 RCX: ffff888039e2e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88cc0cc636c6 R08: ffffffff813529cc R09: fffffbfff15db91b
R10: fffffbfff15db91b R11: 0000000000000000 R12: ffff8880aa412a80
R13: 0000000000000038 R14: 0000000000000001 R15: ffffea0000000000
FS: 00007f1f98f03740(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea01303318c8 CR3: 000000003f874000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following crash on:
HEAD commit: 378fee2e Merge tag 'char-misc-5.6-rc5' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c4c191e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=7aef917d2e37d731
dashboard link: https://syzkaller.appspot.com/bug?extid=fd4d34132dbb09ce044f
compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)
CC: [b...@alien8.de dave....@linux.intel.com h...@zytor.com linux-...@vger.kernel.org lu...@kernel.org mi...@redhat.com pet...@infradead.org tg...@linutronix.de x...@kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fd4d34...@syzkaller.appspotmail.com
BUG: unable to handle page fault for address: ffffea01303318c8
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 12fff8067 P4D 12fff8067 PUD 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 14303 Comm: blkid Not tainted 5.6.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:723 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:128 [inline]
RIP: 0010:qlist_free_all mm/kasan/quarantine.c:164 [inline]
RIP: 0010:quarantine_reduce+0x138/0x1c0 mm/kasan/quarantine.c:260
Code: 00 00 0f 45 d1 89 15 57 2f 83 09 48 c7 c7 58 a5 10 89 48 89 c6 e8 b8 48 49 06 48 89 ef e8 a0 3a 84 ff 48 c1 e8 06 48 83 e0 c0 <49> 8b 4c 07 08 f6 c1 01 75 1d 4c 01 f8 48 8b 70 18 48 8b 5d 00 48
RSP: 0000:ffffc90016f3f968 EFLAGS: 00010206
RAX: 00000001303318c0 RBX: ffff88cc0cc636c6 RCX: ffff888039e2e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88cc0cc636c6 R08: ffffffff813529cc R09: fffffbfff15db91b
R10: fffffbfff15db91b R11: 0000000000000000 R12: ffff8880aa412a80
R13: 0000000000000038 R14: 0000000000000001 R15: ffffea0000000000
FS: 00007f1f98f03740(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea01303318c8 CR3: 000000003f874000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__kasan_kmalloc+0x43/0x1c0 mm/kasan/common.c:496
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc mm/slab.c:3320 [inline]
kmem_cache_alloc+0x1f5/0x2d0 mm/slab.c:3484
ptlock_alloc+0x1c/0x70 mm/memory.c:4846
ptlock_init include/linux/mm.h:1916 [inline]
pgtable_pte_page_ctor include/linux/mm.h:1943 [inline]
__pte_alloc_one include/asm-generic/pgalloc.h:66 [inline]
pte_alloc_one+0x6a/0x180 arch/x86/mm/pgtable.c:26
__pte_alloc+0x1d/0x2a0 mm/memory.c:426
do_anonymous_page+0x130c/0x17f0 mm/memory.c:3175
handle_pte_fault mm/memory.c:4050 [inline]
__handle_mm_fault mm/memory.c:4182 [inline]
handle_mm_fault+0x1b3d/0x27f0 mm/memory.c:4219
do_user_addr_fault+0x51b/0xa90 arch/x86/mm/fault.c:1442
page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1203
RIP: 0033:0x7f1f987b21e5
Code: 8b 05 97 dc 30 00 48 8b 00 48 85 c0 74 02 ff d0 48 89 d8 48 8b 4c 24 20 49 8d 1c 1f 48 29 cb 48 89 0d b7 fc 30 00 48 83 cb 01 <48> 89 59 08 48 01 05 c0 04 31 00 80 7c 24 3c 00 0f 84 d8 fb ff ff
RSP: 002b:00007ffe28e322e0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000021001 RCX: 0000000001ac7000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000
RBP: 00007f1f98ac1e40 R08: 00007f1f98ac1e40 R09: 00007f1f9873cc60
R10: 0000000000091a20 R11: 0000000000000206 R12: 00007f1f98ac1e98
R13: 0000000000000000 R14: 00007f1f98ac0da0 R15: 0000000001ae8000
Modules linked in:
CR2: ffffea01303318c8
---[ end trace c3561212ba8bb542 ]---
RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline]
RIP: 0010:compound_head include/linux/page-flags.h:174 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:723 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:128 [inline]
RIP: 0010:qlist_free_all mm/kasan/quarantine.c:164 [inline]
RIP: 0010:quarantine_reduce+0x138/0x1c0 mm/kasan/quarantine.c:260
Code: 00 00 0f 45 d1 89 15 57 2f 83 09 48 c7 c7 58 a5 10 89 48 89 c6 e8 b8 48 49 06 48 89 ef e8 a0 3a 84 ff 48 c1 e8 06 48 83 e0 c0 <49> 8b 4c 07 08 f6 c1 01 75 1d 4c 01 f8 48 8b 70 18 48 8b 5d 00 48
RSP: 0000:ffffc90016f3f968 EFLAGS: 00010206
RAX: 00000001303318c0 RBX: ffff88cc0cc636c6 RCX: ffff888039e2e000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88cc0cc636c6 R08: ffffffff813529cc R09: fffffbfff15db91b
R10: fffffbfff15db91b R11: 0000000000000000 R12: ffff8880aa412a80
R13: 0000000000000038 R14: 0000000000000001 R15: ffffea0000000000
FS: 00007f1f98f03740(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffea01303318c8 CR3: 000000003f874000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Jun 7, 2020, 1:45:09 AM6/7/20
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages