general protection fault in memcg_flush_percpu_vmstats

Status: fixed on 2019/11/29 15:48
Subsystems: mm cgroups
[Documentation on labels]
Fix commit: 7961eee39784 mm: memcontrol: fix NULL-ptr deref in percpu stats flush
First crash: 2523d, last: 2460d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 5.3 000/193] 5.3.11-stable review 200 (200) 2019/11/12 18:26
[patch 01/17] mm: memcontrol: fix NULL-ptr deref in percpu stats flush 1 (1) 2019/11/06 05:16
[PATCH] mm: memcontrol: fix NULL-ptr deref in percpu stats flush 2 (2) 2019/10/18 16:58

Sample crash report:
Code: b8 80 96 98 00 eb cc 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000ffbba12c EFLAGS: 00000246 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000000000
RDX: 00000000fffffffc RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9528 Comm: syz-executor987 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:memcg_flush_percpu_vmstats+0x4a7/0x920 mm/memcontrol.c:3299
Code: 05 41 89 c0 41 0f b6 04 24 41 38 c7 7c 08 84 c0 0f 85 5c 03 00 00 44 3b 05 1a ba f4 07 0f 83 e2 00 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 0f 85 90 03 00 00 48 8b 85 30 fe ff ff 48 8b b0 90
RSP: 0018:ffff888089f97990 EFLAGS: 00010206
RAX: 0000000000000012 RBX: ffff888089f97b18 RCX: ffffffff833c0e9b
RDX: 0000000000000000 RSI: ffffffff833c0f27 RDI: 0000000000000007
RBP: ffff888089f97bd0 R08: 0000000000000000 R09: ffffed10146c9399
R10: ffffed10146c9398 R11: ffff8880a3649cc7 R12: fffffbfff134afe8
R13: dffffc0000000000 R14: 0000000000000090 R15: 0000000000000007
FS:  0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:0000000057da7840
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020000100 CR3: 0000000094eed000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __mem_cgroup_free+0x1a/0x190 mm/memcontrol.c:4760
 mem_cgroup_free mm/memcontrol.c:4772 [inline]
 mem_cgroup_css_alloc+0x3a1/0x1840 mm/memcontrol.c:4890
 css_create kernel/cgroup/cgroup.c:5156 [inline]
 cgroup_apply_control_enable+0x44d/0xc30 kernel/cgroup/cgroup.c:3119
 cgroup_mkdir+0x892/0x1190 kernel/cgroup/cgroup.c:5393
 kernfs_iop_mkdir+0x14d/0x1d0 fs/kernfs/dir.c:1123
 vfs_mkdir+0x42e/0x670 fs/namei.c:3815
 do_mkdirat+0x234/0x2a0 fs/namei.c:3838
 __do_sys_mkdir fs/namei.c:3854 [inline]
 __se_sys_mkdir fs/namei.c:3852 [inline]
 __ia32_sys_mkdir+0x5a/0x80 fs/namei.c:3852
 do_syscall_32_irqs_on arch/x86/entry/common.c:332 [inline]
 do_fast_syscall_32+0x27b/0xdb3 arch/x86/entry/common.c:403
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7ffca29
Code: b8 80 96 98 00 eb cc 8b 04 24 c3 8b 1c 24 c3 8b 34 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000ffbba12c EFLAGS: 00000246 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 0000000020000000 RCX: 0000000000000000
RDX: 00000000fffffffc RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 17e8d8419c14e65b ]---
RIP: 0010:memcg_flush_percpu_vmstats+0x4a7/0x920 mm/memcontrol.c:3299
Code: 05 41 89 c0 41 0f b6 04 24 41 38 c7 7c 08 84 c0 0f 85 5c 03 00 00 44 3b 05 1a ba f4 07 0f 83 e2 00 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 0f 85 90 03 00 00 48 8b 85 30 fe ff ff 48 8b b0 90
RSP: 0018:ffff888089f97990 EFLAGS: 00010206
RAX: 0000000000000012 RBX: ffff888089f97b18 RCX: ffffffff833c0e9b
RDX: 0000000000000000 RSI: ffffffff833c0f27 RDI: 0000000000000007
RBP: ffff888089f97bd0 R08: 0000000000000000 R09: ffffed10146c9399
R10: ffffed10146c9398 R11: ffff8880a3649cc7 R12: fffffbfff134afe8
R13: dffffc0000000000 R14: 0000000000000090 R15: 0000000000000007
FS:  0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:0000000057da7840
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000020000100 CR3: 0000000094eed000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/09/08 00:29 upstream 1e3778cb223e a60cb4cd .config console log report syz C ci-upstream-kasan-gce-386
2019/10/07 03:05 upstream b212921b13bd f3f7d9c8 .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/08/29 10:14 upstream 6525771f58cb fd37b39e .config console log report syz ci-upstream-kasan-gce-root
2019/08/29 09:23 upstream 6525771f58cb fd37b39e .config console log report syz ci-upstream-kasan-gce
2019/08/29 09:15 upstream 6525771f58cb fd37b39e .config console log report syz ci-upstream-kasan-gce-selinux-root
2019/08/29 09:26 upstream 6525771f58cb fd37b39e .config console log report syz ci-upstream-kasan-gce-386
2019/10/21 06:07 linux-next c4b9850b3676 8c88c9c1 .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/08/29 06:29 linux-next ed2393ca0910 fd37b39e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/31 07:38 upstream 320000e72ec0 a41ca8fa .config console log report ci-upstream-kasan-gce-selinux-root
2019/10/11 11:23 upstream fb20da6af705 1a3bad90 .config console log report ci-upstream-kasan-gce-selinux-root
2019/10/06 01:54 upstream 4ea655343ce4 f3f7d9c8 .config console log report ci-upstream-kasan-gce-selinux-root
2019/09/17 08:08 upstream cef7298262e9 51ca0454 .config console log report ci-upstream-kasan-gce
2019/09/13 08:24 upstream 505a8ec7e11a 40fa42bc .config console log report ci-upstream-kasan-gce-root
2019/09/10 11:41 upstream 56037cadf604 a60cb4cd .config console log report ci-upstream-kasan-gce-smack-root
2019/09/08 09:10 upstream b3a9964cfa69 a60cb4cd .config console log report ci-upstream-kasan-gce
2019/08/30 03:17 upstream 6525771f58cb fd37b39e .config console log report ci-upstream-kasan-gce
2019/09/07 23:26 upstream 1e3778cb223e a60cb4cd .config console log report ci-upstream-kasan-gce-386
2019/10/10 20:22 linux-next 4a9e93dbc796 a4efa8c0 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/08/29 03:02 linux-next ed2393ca0910 fd37b39e .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.