syzbot
general protection fault in qlist_free_all (4)
Status:
auto-closed as invalid on 2019/02/22 10:34
Subsystems:
net
[Documentation on labels]
Reported-by: syzbot+ba1d1ac3385a34685c6d@syzkaller.appspotmail.com
First crash: 3059d, last: 2949d
Sample crash report:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2105
llc_ui_sendmsg+0x380/0x1530 net/llc/af_llc.c:934
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 2709 Comm: udevd Not tainted 4.17.0-rc2+ #19
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:virt_to_head_page include/linux/mm.h:624 [inline]
RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:127 [inline]
RIP: 0010:qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xd5/0x120 net/socket.c:639
RSP: 0018:ffff8801b65afbd0 EFLAGS: 00010207
___sys_sendmsg+0x525/0x940 net/socket.c:2117
RAX: dead4ead00000000 RBX: 0000000000000286 RCX: ffffea0000000000
RDX: 037aa11ab4000000 RSI: ffff8801b659ebe0 RDI: 0000000000000286
RBP: ffff8801b65afc08 R08: ffff8801b659ebb8 R09: 0000000000000006
R10: ffff8801b659e380 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: dead4ead00000000 R15: ffffffff88d18ae0
FS: 00007f6ec0bd77a0(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe04236178 CR3: 00000001b6582000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
__sys_sendmmsg+0x240/0x6f0 net/socket.c:2212
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
quarantine_reduce+0x141/0x170 mm/kasan/quarantine.c:259
kasan_kmalloc+0x99/0xe0 mm/kasan/kasan.c:538
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
slab_post_alloc_hook mm/slab.h:444 [inline]
slab_alloc mm/slab.c:3392 [inline]
kmem_cache_alloc+0x11b/0x760 mm/slab.c:3552
inotify_new_watch fs/notify/inotify/inotify_user.c:561 [inline]
inotify_update_watch+0x211/0x4e0 fs/notify/inotify/inotify_user.c:608
__do_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:737 [inline]
__se_sys_inotify_add_watch fs/notify/inotify/inotify_user.c:687 [inline]
__x64_sys_inotify_add_watch+0x2d1/0x360 fs/notify/inotify/inotify_user.c:687
__do_sys_sendmmsg net/socket.c:2241 [inline]
__se_sys_sendmmsg net/socket.c:2238 [inline]
__x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2238
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x49/0xbe
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x455979
RIP: 0033:0x7f6ec02eba07
RSP: 002b:00007f34e7b7dc68 EFLAGS: 00000246
RSP: 002b:00007ffe04235d28 EFLAGS: 00000206 ORIG_RAX: 00000000000000fe
ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000184b250 RCX: 00007f6ec02eba07
RAX: ffffffffffffffda RBX: 00007f34e7b7e6d4 RCX: 0000000000455979
RDX: 0000000000000008 RSI: 000000000185b520 RDI: 0000000000000006
RBP: 0000000001863e80 R08: 00007f6ec0bd77a0 R09: 0000000000000001
RDX: 0000000000000002 RSI: 0000000020000880 RDI: 0000000000000014
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000000000001
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000013
R13: 000000000191bcb0 R14: 000000000184b250 R15: 000000000000000b
Code:
R13: 00000000000004d0 R14: 00000000006fa420 R15: 0000000000000001
00 00 00 80 48 01 c2 72 43 48 b9 00 00 00 80 ff 77 00 00 48 01 ca 48 b9 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 c1 e2 06 48 01 ca <48> 8b 4a 20 48 8d 71 ff 83 e1 01 48 0f 45 d6 4c 8b 6a 30 e9 f4
RIP: virt_to_head_page include/linux/mm.h:624 [inline] RSP: ffff8801b65afbd0
RIP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] RSP: ffff8801b65afbd0
RIP: qlist_free_all+0x12b/0x160 mm/kasan/quarantine.c:163 RSP: ffff8801b65afbd0
---[ end trace a02bc5138dd61ad8 ]---
* Struck through repros no longer work on HEAD.