WARNING in kmalloc_slab (3)

Status: fixed on 2018/02/26 20:04
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+2797c18fc195e3e240c3c3e7837a14130e157fb0@syzkaller.appspotmail.com
Fix commit: 88913bd8ea2a kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
First crash: 3179d, last: 3073d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in kmalloc_slab net -1 C 22353 3197d 3269d 3/29 fixed on 2017/10/24 06:54
upstream WARNING in kmalloc_slab (4) net -1 1 3058d 3057d 4/29 fixed on 2018/03/23 18:14
upstream WARNING in kmalloc_slab (5) bfs -1 2 3035d 3036d 0/29 closed as invalid on 2018/04/09 12:26
upstream WARNING in kmalloc_slab (2) block trace -1 C 2478 3179d 3197d 3/29 fixed on 2017/11/11 01:37

Sample crash report:
WARNING: CPU: 0 PID: 3667 at mm/slab_common.c:971 kmalloc_slab+0x5d/0x70 mm/slab_common.c:971
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 3667 Comm: syzkaller454330 Not tainted 4.15.0-rc9+ #281
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 panic+0x1e4/0x41c kernel/panic.c:183
 __warn+0x1dc/0x200 kernel/panic.c:547
 report_bug+0x211/0x2d0 lib/bug.c:184
 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178
 fixup_bug arch/x86/kernel/traps.c:247 [inline]
 do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315
 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1096
RIP: 0010:kmalloc_slab+0x5d/0x70 mm/slab_common.c:971
RSP: 0018:ffff8801bbf86940 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000007fffffff8 RCX: ffffffff83b2f03f
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000007fffffff8
RBP: ffff8801bbf86940 R08: 1ffff100377f0c9b R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: 00000000014080c0 R15: ffff8801d4edae40
 __do_kmalloc mm/slab.c:3703 [inline]
 __kmalloc+0x25/0x760 mm/slab.c:3717
 kmalloc_array include/linux/slab.h:618 [inline]
 kcalloc include/linux/slab.h:629 [inline]
 __ptr_ring_init_queue_alloc include/linux/ptr_ring.h:456 [inline]
 ptr_ring_resize_multiple include/linux/ptr_ring.h:614 [inline]
 skb_array_resize_multiple include/linux/skb_array.h:200 [inline]
 tun_queue_resize drivers/net/tun.c:3027 [inline]
 tun_device_event+0x3d3/0xcb0 drivers/net/tun.c:3045
 notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
 call_netdevice_notifiers_info+0x32/0x60 net/core/dev.c:1691
 call_netdevice_notifiers+0xac/0x100 net/core/dev.c:1709
 do_setlink+0xc10/0x3b30 net/core/rtnetlink.c:2211
 rtnl_newlink+0xf5a/0x1ab0 net/core/rtnetlink.c:2747
 rtnetlink_rcv_msg+0x733/0x1020 net/core/rtnetlink.c:4411
 netlink_rcv_skb+0x14b/0x380 net/netlink/af_netlink.c:2409
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4423
 netlink_unicast_kernel net/netlink/af_netlink.c:1275 [inline]
 netlink_unicast+0x4ee/0x700 net/netlink/af_netlink.c:1301
 netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1864
 sock_sendmsg_nosec net/socket.c:638 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:648
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2028
 __sys_sendmsg+0xe5/0x210 net/socket.c:2062
 SYSC_sendmsg net/socket.c:2073 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2069
 entry_SYSCALL_64_fastpath+0x29/0xa0
RIP: 0033:0x4451a9
RSP: 002b:00007fff741d77d8 EFLAGS: 00000207 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 00000000004451a9
RDX: 0000000000000004 RSI: 0000000020504000 RDI: 0000000000000004
RBP: 00007fff741d7918 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000207 R12: 00007fff741d7918
R13: 0000000000402670 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (1901):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/01/26 13:09 upstream 993ca2068b04 1d18b112 .config console log report syz C ci-upstream-kasan-gce
2018/01/25 11:31 upstream 5b7d27967dab 6b2a715e .config console log report syz C ci-upstream-kasan-gce
2018/01/24 23:54 upstream 5132ede0fe80 866f1102 .config console log report syz C ci-upstream-kasan-gce
2018/01/24 13:57 upstream 1f07476ec143 a5b7566c .config console log report syz C ci-upstream-kasan-gce
2018/01/09 03:38 upstream d32da5841b0f 11dc42f6 .config console log report syz C ci-upstream-kasan-gce
2017/12/19 17:40 upstream ace52288edf0 af9163c7 .config console log report syz C ci-upstream-kasan-gce
2017/12/03 01:58 upstream 2db767d9889c 48359b97 .config console log report syz C ci-upstream-kasan-gce
2018/01/26 13:09 upstream 993ca2068b04 1d18b112 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/25 09:13 upstream 5b7d27967dab 6b2a715e .config console log report syz C ci-upstream-kasan-gce-386
2018/01/24 23:53 upstream 5132ede0fe80 866f1102 .config console log report syz C ci-upstream-kasan-gce-386
2018/01/24 13:56 upstream 1f07476ec143 a5b7566c .config console log report syz C ci-upstream-kasan-gce-386
2018/01/09 03:37 net-next-old 0c3b34d80494 11dc42f6 .config console log report syz C ci-upstream-net-kasan-gce
2018/01/09 03:37 mmots 69eed2290e1d 11dc42f6 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/01/09 03:37 linux-next 895c0dde3985 11dc42f6 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/21 03:16 linux-next 7dc9f647127d 90a46995 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/20 12:40 mmots 82bcf1def3b5 2d836b1d .config console log report syz C ci-upstream-mmots-kasan-gce
2017/12/03 17:13 linux-next fb20eb9d798d 16668351 .config console log report syz C ci-upstream-next-kasan-gce
2017/12/03 05:27 mmots 4131d5166185 29b0fd90 .config console log report syz C ci-upstream-mmots-kasan-gce
2018/02/06 06:49 upstream 2deb41b24532 a1bc9d40 .config console log report ci-upstream-kasan-gce
2018/02/05 21:55 upstream 2deb41b24532 a1bc9d40 .config console log report ci-upstream-kasan-gce
2018/02/05 20:53 upstream 35277995e179 a1bc9d40 .config console log report ci-upstream-kasan-gce
2018/02/05 04:20 upstream 35277995e179 a1bc9d40 .config console log report ci-upstream-kasan-gce
2018/02/04 13:30 upstream 617aebe6a97e a1bc9d40 .config console log report ci-upstream-kasan-gce
2018/02/03 04:13 upstream 03f51d4efa22 632a8c2c .config console log report ci-upstream-kasan-gce
2018/02/02 15:50 upstream 4bf772b14675 826b35d6 .config console log report ci-upstream-kasan-gce
2018/02/01 16:55 upstream 255442c93843 67bd3383 .config console log report ci-upstream-kasan-gce
2018/01/31 02:58 upstream 72906f38934a 02553e22 .config console log report ci-upstream-kasan-gce
2018/01/30 20:46 upstream 6304672b7f0a a899be78 .config console log report ci-upstream-kasan-gce
2018/01/30 18:21 upstream 6304672b7f0a a899be78 .config console log report ci-upstream-kasan-gce
2018/01/29 14:11 upstream d8a5b80568a9 08d47756 .config console log report ci-upstream-kasan-gce
2018/01/28 14:02 upstream c4e0ca7fa241 08d47756 .config console log report ci-upstream-kasan-gce
2018/01/28 08:12 upstream c4e0ca7fa241 08146b1a .config console log report ci-upstream-kasan-gce
2018/01/28 03:05 upstream c4e0ca7fa241 08146b1a .config console log report ci-upstream-kasan-gce
2018/01/27 14:58 upstream c4e0ca7fa241 1d18b112 .config console log report ci-upstream-kasan-gce
2018/01/27 02:20 upstream c4e0ca7fa241 1d18b112 .config console log report ci-upstream-kasan-gce
2018/01/26 21:38 upstream 993ca2068b04 1d18b112 .config console log report ci-upstream-kasan-gce
2018/01/26 09:48 upstream 6e20630e3004 1d18b112 .config console log report ci-upstream-kasan-gce
2018/01/26 08:36 upstream 6e20630e3004 1d18b112 .config console log report ci-upstream-kasan-gce
2018/01/25 18:50 upstream 5b7d27967dab 6b2a715e .config console log report ci-upstream-kasan-gce
2018/01/25 15:43 upstream 5b7d27967dab 6b2a715e .config console log report ci-upstream-kasan-gce
2018/01/24 22:18 upstream 5132ede0fe80 866f1102 .config console log report ci-upstream-kasan-gce
2018/01/24 17:41 upstream 1f07476ec143 a5b7566c .config console log report ci-upstream-kasan-gce
2018/01/24 01:20 upstream 1995266727fa a5b7566c .config console log report ci-upstream-kasan-gce
2018/01/22 09:35 upstream 5515114211c5 fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/21 14:08 upstream d517bb79f499 fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/21 05:25 upstream 24b61240471a fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/21 03:32 upstream 24b61240471a fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/21 02:26 upstream 24b61240471a fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/20 17:33 upstream 8dd903d2cf7b fbbdcd92 .config console log report ci-upstream-kasan-gce
2018/01/19 19:35 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/19 12:33 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/19 05:14 upstream dda3e15231b3 161c1d64 .config console log report ci-upstream-kasan-gce
2018/01/18 07:45 upstream 88dc7fca1800 b8970f31 .config console log report ci-upstream-kasan-gce
2018/01/17 01:26 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/16 21:19 upstream 41aa5e5d712b a46e5318 .config console log report ci-upstream-kasan-gce
2018/01/15 22:38 upstream a8750ddca918 e17f4a5d .config console log report ci-upstream-kasan-gce
2018/01/15 13:37 upstream a8750ddca918 66d492a6 .config console log report ci-upstream-kasan-gce
2018/01/15 03:06 upstream 9443c168505d 66d492a6 .config console log report ci-upstream-kasan-gce
* Struck through repros no longer work on HEAD.