syzbot
BUG: corrupted list in free_block
Status:
auto-closed as invalid on 2019/10/25 08:39
Subsystems:
kernel
[Documentation on labels]
Reported-by: syzbot+db65e4a770078362ada3@syzkaller.appspotmail.com
First crash: 2778d, last: 2620d
Sample crash report:
Enabling of bearer <udp:syz1> rejected, already enabled
IPVS: stopping master sync thread 26700 ...
list_del corruption, ffffea0001595f08->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:45!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 11904 Comm: kworker/0:5 Not tainted 5.0.0+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cache_reap
RIP: 0010:__list_del_entry_valid.cold+0x23/0x4f lib/list_debug.c:45
Code: e8 25 9d 2e fe 0f 0b 4c 89 f6 48 c7 c7 60 52 a2 87 e8 14 9d 2e fe 0f 0b 4c 89 ea 4c 89 f6 48 c7 c7 a0 51 a2 87 e8 00 9d 2e fe <0f> 0b 4c 89 e2 4c 89 f6 48 c7 c7 00 52 a2 87 e8 ec 9c 2e fe 0f 0b
RSP: 0000:ffff8880658f7bd8 EFLAGS: 00010086
RAX: 000000000000004e RBX: ffffe8ffffc81ce8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815ab926 RDI: ffffed100cb1ef6d
RBP: ffff8880658f7bf0 R08: 000000000000004e R09: ffffed1015d05011
R10: ffffed1015d05010 R11: ffff8880ae828087 R12: dead000000000200
R13: dead000000000100 R14: ffffea0001595f08 R15: ffffea0001595f08
FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f265b8b7000 CR3: 000000008f67a000 CR4: 00000000001406f0
Call Trace:
__list_del_entry include/linux/list.h:117 [inline]
list_del include/linux/list.h:125 [inline]
free_block+0xd8/0x250 mm/slab.c:3416
drain_array_locked+0x36/0x90 mm/slab.c:2201
drain_array+0x8c/0xb0 mm/slab.c:4026
cache_reap+0xf4/0x280 mm/slab.c:4067
process_one_work+0x98e/0x1790 kernel/workqueue.c:2259
worker_thread+0x98/0xe40 kernel/workqueue.c:2405
kthread+0x357/0x430 kernel/kthread.c:253
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
======================================================
* Struck through repros no longer work on HEAD.