BUG: unable to handle kernel paging request in ___cache_free
10 views
Skip to first unread message
syzbot
Jan 9, 2019, 10:51:05 AM1/9/19
to syzkaller-upst...@googlegroups.com
Hello,
syzbot found the following crash on:
HEAD commit: b71acb0e3721 Merge branch 'linus' of git://git.kernel.org/..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17d9d3d7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=b03c5892bb940c76
dashboard link: https://syzkaller.appspot.com/bug?extid=7bbbb47ac9dad8e04c83
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ak...@linux-foundation.org ebie...@xmission.com
gu...@fb.com kees...@chromium.org linux-...@vger.kernel.org
lu...@amacapital.net marcos.s...@gmail.com mho...@suse.com
ri...@surriel.com w...@chromium.org net...@vger.kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7bbbb4...@syzkaller.appspotmail.com
netlink: 20 bytes leftover after parsing attributes in process
`syz-executor2'.
BUG: unable to handle kernel paging request at ffffe902f205fb38
kobject: 'loop1' (00000000e30a17a7): kobject_uevent_env
#PF error: [WRITE]
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 26400 Comm: modprobe Not tainted 4.20.0+ #3
kobject: 'loop1' (00000000e30a17a7): fill_kobj_path: path
= '/devices/virtual/block/loop1'
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:___cache_free+0x60/0x380 mm/slab.c:3539
Code: 55 89 83 3d 45 70 96 08 01 0f 8f e7 00 00 00 41 8b 47 04 41 39 07 0f
83 97 01 00 00 0f 1f 44 00 00 41 8b 07 8d 50 01 41 89 17 <4d> 89 6c c7 10
48 8b 45 d0 65 48 33 04 25 28 00 00 00 0f 85 f4 02
RSP: 0018:ffff888092b3f718 EFLAGS: 00010003
RAX: 000000005e485e00 RBX: 0000000000000282 RCX: ffffffff8139c48a
kobject: 'loop2' (00000000b3ffc920): kobject_uevent_env
RDX: 000000005e485e01 RSI: ffffffff8139c494 RDI: ffffea0002a5c300
RBP: ffff888092b3f778 R08: ffff8880628a4300 R09: ffff8880628a4ba0
R10: ffff8880628a4300 R11: 0000000000000000 R12: ffff8882167dbd80
R13: ffff8880a970ccc0 R14: ffff888092b3f7c8 R15: ffffe8ffffc30b28
kobject: 'loop2' (00000000b3ffc920): fill_kobj_path: path
= '/devices/virtual/block/loop2'
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe902f205fb38 CR3: 000000006a626000 CR4: 00000000001406f0
kobject: 'loop1' (00000000e30a17a7): kobject_uevent_env
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'loop1' (00000000e30a17a7): fill_kobj_path: path
= '/devices/virtual/block/loop1'
qlink_free mm/kasan/quarantine.c:147 [inline]
qlist_free_all+0x85/0x150 mm/kasan/quarantine.c:166
quarantine_reduce+0x169/0x1a0 mm/kasan/quarantine.c:259
kasan_kmalloc+0xa0/0xf0 mm/kasan/kasan.c:538
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x700 mm/slab.c:3552
vm_area_alloc+0x7a/0x1d0 kernel/fork.c:336
__install_special_mapping+0x32/0x460 mm/mmap.c:3407
_install_special_mapping+0x3c/0x50 mm/mmap.c:3457
map_vdso+0x8e/0x130 arch/x86/entry/vdso/vma.c:168
map_vdso_randomized+0x74/0xb0 arch/x86/entry/vdso/vma.c:249
arch_setup_additional_pages+0x1d/0x20 arch/x86/entry/vdso/vma.c:294
load_elf_binary+0x25f8/0x53c0 fs/binfmt_elf.c:1123
search_binary_handler fs/exec.c:1653 [inline]
search_binary_handler+0x17f/0x570 fs/exec.c:1631
exec_binprm fs/exec.c:1695 [inline]
__do_execve_file.isra.0+0x147f/0x2540 fs/exec.c:1819
do_execveat_common fs/exec.c:1866 [inline]
do_execve+0x33/0x40 fs/exec.c:1883
call_usermodehelper_exec_async+0x6be/0xa50 kernel/umh.c:107
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffe902f205fb38
---[ end trace 9eb21b32799431e8 ]---
RIP: 0010:___cache_free+0x60/0x380 mm/slab.c:3539
Code: 55 89 83 3d 45 70 96 08 01 0f 8f e7 00 00 00 41 8b 47 04 41 39 07 0f
83 97 01 00 00 0f 1f 44 00 00 41 8b 07 8d 50 01 41 89 17 <4d> 89 6c c7 10
48 8b 45 d0 65 48 33 04 25 28 00 00 00 0f 85 f4 02
RSP: 0018:ffff888092b3f718 EFLAGS: 00010003
RAX: 000000005e485e00 RBX: 0000000000000282 RCX: ffffffff8139c48a
RDX: 000000005e485e01 RSI: ffffffff8139c494 RDI: ffffea0002a5c300
RBP: ffff888092b3f778 R08: ffff8880628a4300 R09: ffff8880628a4ba0
R10: ffff8880628a4300 R11: 0000000000000000 R12: ffff8882167dbd80
R13: ffff8880a970ccc0 R14: ffff888092b3f7c8 R15: ffffe8ffffc30b28
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe902f205fb38 CR3: 000000006a626000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
syzbot found the following crash on:
HEAD commit: b71acb0e3721 Merge branch 'linus' of git://git.kernel.org/..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17d9d3d7400000
kernel config: https://syzkaller.appspot.com/x/.config?x=b03c5892bb940c76
dashboard link: https://syzkaller.appspot.com/bug?extid=7bbbb47ac9dad8e04c83
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ak...@linux-foundation.org ebie...@xmission.com
gu...@fb.com kees...@chromium.org linux-...@vger.kernel.org
lu...@amacapital.net marcos.s...@gmail.com mho...@suse.com
ri...@surriel.com w...@chromium.org net...@vger.kernel.org]
Unfortunately, I don't have any reproducer for this crash yet.
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+7bbbb4...@syzkaller.appspotmail.com
netlink: 20 bytes leftover after parsing attributes in process
`syz-executor2'.
BUG: unable to handle kernel paging request at ffffe902f205fb38
kobject: 'loop1' (00000000e30a17a7): kobject_uevent_env
#PF error: [WRITE]
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 26400 Comm: modprobe Not tainted 4.20.0+ #3
kobject: 'loop1' (00000000e30a17a7): fill_kobj_path: path
= '/devices/virtual/block/loop1'
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:___cache_free+0x60/0x380 mm/slab.c:3539
Code: 55 89 83 3d 45 70 96 08 01 0f 8f e7 00 00 00 41 8b 47 04 41 39 07 0f
83 97 01 00 00 0f 1f 44 00 00 41 8b 07 8d 50 01 41 89 17 <4d> 89 6c c7 10
48 8b 45 d0 65 48 33 04 25 28 00 00 00 0f 85 f4 02
RSP: 0018:ffff888092b3f718 EFLAGS: 00010003
RAX: 000000005e485e00 RBX: 0000000000000282 RCX: ffffffff8139c48a
kobject: 'loop2' (00000000b3ffc920): kobject_uevent_env
RDX: 000000005e485e01 RSI: ffffffff8139c494 RDI: ffffea0002a5c300
RBP: ffff888092b3f778 R08: ffff8880628a4300 R09: ffff8880628a4ba0
R10: ffff8880628a4300 R11: 0000000000000000 R12: ffff8882167dbd80
R13: ffff8880a970ccc0 R14: ffff888092b3f7c8 R15: ffffe8ffffc30b28
kobject: 'loop2' (00000000b3ffc920): fill_kobj_path: path
= '/devices/virtual/block/loop2'
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe902f205fb38 CR3: 000000006a626000 CR4: 00000000001406f0
kobject: 'loop1' (00000000e30a17a7): kobject_uevent_env
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'loop1' (00000000e30a17a7): fill_kobj_path: path
= '/devices/virtual/block/loop1'
qlink_free mm/kasan/quarantine.c:147 [inline]
qlist_free_all+0x85/0x150 mm/kasan/quarantine.c:166
quarantine_reduce+0x169/0x1a0 mm/kasan/quarantine.c:259
kasan_kmalloc+0xa0/0xf0 mm/kasan/kasan.c:538
kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x700 mm/slab.c:3552
vm_area_alloc+0x7a/0x1d0 kernel/fork.c:336
__install_special_mapping+0x32/0x460 mm/mmap.c:3407
_install_special_mapping+0x3c/0x50 mm/mmap.c:3457
map_vdso+0x8e/0x130 arch/x86/entry/vdso/vma.c:168
map_vdso_randomized+0x74/0xb0 arch/x86/entry/vdso/vma.c:249
arch_setup_additional_pages+0x1d/0x20 arch/x86/entry/vdso/vma.c:294
load_elf_binary+0x25f8/0x53c0 fs/binfmt_elf.c:1123
search_binary_handler fs/exec.c:1653 [inline]
search_binary_handler+0x17f/0x570 fs/exec.c:1631
exec_binprm fs/exec.c:1695 [inline]
__do_execve_file.isra.0+0x147f/0x2540 fs/exec.c:1819
do_execveat_common fs/exec.c:1866 [inline]
do_execve+0x33/0x40 fs/exec.c:1883
call_usermodehelper_exec_async+0x6be/0xa50 kernel/umh.c:107
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: ffffe902f205fb38
---[ end trace 9eb21b32799431e8 ]---
RIP: 0010:___cache_free+0x60/0x380 mm/slab.c:3539
Code: 55 89 83 3d 45 70 96 08 01 0f 8f e7 00 00 00 41 8b 47 04 41 39 07 0f
83 97 01 00 00 0f 1f 44 00 00 41 8b 07 8d 50 01 41 89 17 <4d> 89 6c c7 10
48 8b 45 d0 65 48 33 04 25 28 00 00 00 0f 85 f4 02
RSP: 0018:ffff888092b3f718 EFLAGS: 00010003
RAX: 000000005e485e00 RBX: 0000000000000282 RCX: ffffffff8139c48a
RDX: 000000005e485e01 RSI: ffffffff8139c494 RDI: ffffea0002a5c300
RBP: ffff888092b3f778 R08: ffff8880628a4300 R09: ffff8880628a4ba0
R10: ffff8880628a4300 R11: 0000000000000000 R12: ffff8882167dbd80
R13: ffff8880a970ccc0 R14: ffff888092b3f7c8 R15: ffffe8ffffc30b28
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffe902f205fb38 CR3: 000000006a626000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with
syzbot.
Dmitry Vyukov
Jan 9, 2019, 11:06:41 AM1/9/19
to syzbot, 'Dmitry Vyukov' via syzkaller-upstream-moderation
May be the UDP stack overflow memory corruption.
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000e9c365057f086d03%40google.com.
> For more options, visit https://groups.google.com/d/optout.
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/000000000000e9c365057f086d03%40google.com.
> For more options, visit https://groups.google.com/d/optout.
syzbot
Jul 7, 2019, 7:00:04 PM7/7/19
to dvy...@google.com, syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages