Hello, The following program causes random assorted memory corruptions:
https://gist.githubusercontent.com/dvyukov/da3463af2d1ff8c7d3624891b5d7427f/raw/09cf0f4af529f4506f9e0a9fa6bdb066a8777b9d/gistfile1.txt It does some ioctl's on /dev/sg0. general protection fault: 0000 [#1] SMP KASAN Modules linked in: CPU: 1 PID: 2843 Comm: rsyslogd Not tainted 4.11.0-rc3+ #365 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880062754300 task.stack: ffff880062fc8000 RIP: 0010:__read_once_size include/linux/compiler.h:254 [inline] RIP: 0010:radix_tree_load_root lib/radix-tree.c:602 [inline] RIP: 0010:__radix_tree_lookup+0x12c/0x5e0 lib/radix-tree.c:1040 RSP: 0000:ffff880062fced90 EFLAGS: 00010202 RAX: 000000f37b916d5e RBX: 0000079bdc8b6ae8 RCX: ffff880062fcefa8 RDX: 0000000000000000 RSI: 0001622819596228 RDI: 0000079bdc8b6ae8 RBP: ffff880062fcef78 R08: ffffed000da135c2 R09: ffffed000da135c2 R10: 0000000000000001 R11: ffffed000da135c1 R12: ffff880062fcefa8 R13: dffffc0000000000 R14: 0000079bdc8b6ae8 R15: 0001622819596228 FS: 00007f773eae2700(0000) GS:ffff88006d080000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f773eae1e30 CR3: 0000000064ac0000 CR4: 00000000001406e0 Call Trace: radix_tree_lookup_slot+0x78/0xe0 lib/radix-tree.c:1079 find_get_entry+0x186/0x990 mm/filemap.c:1190 pagecache_get_page+0x116/0xb60 mm/filemap.c:1298 find_get_page include/linux/pagemap.h:258 [inline] lookup_swap_cache+0x8d/0x110 mm/swap_state.c:296 do_swap_page+0x278/0x2110 mm/memory.c:2702 handle_pte_fault mm/memory.c:3727 [inline] __handle_mm_fault+0x1747/0x3e70 mm/memory.c:3841 handle_mm_fault+0x141/0x4f0 mm/memory.c:3878 __do_page_fault+0x503/0xb50 arch/x86/mm/fault.c:1397 trace_do_page_fault+0x145/0x720 arch/x86/mm/fault.c:1490 do_async_page_fault+0x72/0xc0 arch/x86/kernel/kvm.c:264 async_page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1014 RIP: 0033:0x7f77411261fd RSP: 002b:00007f773eae1e30 EFLAGS: 00010293 RAX: 0000000000000024 RBX: 00000000020944d0 RCX: 00007f77411261fd RDX: 0000000000000fff RSI: 00007f77405225a0 RDI: 0000000000000004 RBP: 0000000000000000 R08: 000000000207f160 R09: 0000000004000001 R10: 0000000000000001 R11: 0000000000000293 R12: 000000000065e420 R13: 00007f773eae29c0 R14: 00007f774176b040 R15: 0000000000000003 Code: ff 42 c6 04 28 00 48 8d 85 d8 fe ff ff 48 c1 e8 03 42 c6 04 28 00 48 8b 85 48 fe ff ff c6 00 00 48 8b 85 40 fe ff ff 48 c1 e8 03 <42> 80 3c 28 00 0f 85 07 04 00 00 48 8b 85 38 fe ff ff 4c 8b 60 RIP: __read_once_size include/linux/compiler.h:254 [inline] RSP: ffff880062fced90 RIP: radix_tree_load_root lib/radix-tree.c:602 [inline] RSP: ffff880062fced90 RIP: __radix_tree_lookup+0x12c/0x5e0 lib/radix-tree.c:1040 RSP: ffff880062fced90 ---[ end trace 53d928cd2f7a08d4 ]--- BUG: unable to handle kernel paging request at 00000152000081a4 IP: qlist_move_cache+0x74/0x100 mm/kasan/quarantine.c:274 PGD 0 Oops: 0000 [#1] SMP KASAN Modules linked in: CPU: 0 PID: 29 Comm: kworker/u8:1 Not tainted 4.11.0-rc3+ #365 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: netns cleanup_net task: ffff88006c096800 task.stack: ffff88006c098000 RIP: 0010:qlist_move_cache+0x74/0x100 mm/kasan/quarantine.c:274 RSP: 0018:ffff88006c09f368 EFLAGS: 00010002 RAX: 00000152000081a4 RBX: 000077ff80000000 RCX: 00000152000081a4 RDX: ffff8800696dd200 RSI: ffff88006c09f388 RDI: ffffffff865cce58 RBP: ffff88006c09f378 R08: ffff88006c019340 R09: 0000000080000000 R10: 00000152000081a4 R11: ffffea0000000000 R12: ffffea00016892ef R13: ffffffff84fa9740 R14: ffffffff865d1760 R15: ffff8800696dd200 FS: 0000000000000000(0000) GS:ffff88006d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000152000081a4 CR3: 0000000069898000 CR4: 00000000001406f0 Call Trace: quarantine_remove_cache+0x79/0xf0 mm/kasan/quarantine.c:317 kasan_cache_shutdown+0x9/0x10 mm/kasan/kasan.c:451 shutdown_cache mm/slab_common.c:532 [inline] kmem_cache_destroy+0x52/0x120 mm/slab_common.c:830 tipc_server_stop+0x13f/0x190 net/tipc/server.c:636 tipc_topsrv_stop+0x200/0x360 net/tipc/subscr.c:397 tipc_exit_net+0x15/0x40 net/tipc/core.c:96 ops_exit_list.isra.4+0xae/0x150 net/core/net_namespace.c:141 cleanup_net+0x5c7/0xb60 net/core/net_namespace.c:463 process_one_work+0xb20/0x1b40 kernel/workqueue.c:2097 worker_thread+0x1b4/0x1340 kernel/workqueue.c:2231 kthread+0x359/0x420 kernel/kthread.c:229 ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430 Code: 00 8b 49 14 0f 84 87 00 00 00 4c 8b 47 08 49 89 00 48 89 47 08 48 c7 00 00 00 00 00 4c 89 d0 48 01 4f 10 4d 85 d2 74 64 48 89 c1 <4c> 8b 10 4c 01 c9 72 6d 49 89 d8 4c 01 c1 48 c1 e9 0c 4c 8d 04 RIP: qlist_move_cache+0x74/0x100 mm/kasan/quarantine.c:274 RSP: ffff88006c09f368 CR2: 00000152000081a4 ---[ end trace 9db83f7c295b4f05 ]--- BUG: unable to handle kernel paging request at ffffeba5308001e0 IP: virt_to_head_page include/linux/mm.h:570 [inline] IP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] IP: qlist_free_all+0x133/0x160 mm/kasan/quarantine.c:163 PGD 0 Oops: 0000 [#1] SMP KASAN Modules linked in: CPU: 3 PID: 3281 Comm: syz-executor Not tainted 4.11.0-rc3+ #365 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880068f2e180 task.stack: ffff88005aaa0000 RIP: 0010:virt_to_head_page include/linux/mm.h:570 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:127 [inline] RIP: 0010:qlist_free_all+0x133/0x160 mm/kasan/quarantine.c:163 RSP: 0018:ffff88005aaa7838 EFLAGS: 00010212 RAX: 00000057000081a4 RBX: ffffea0000000000 RCX: 00000034a6100038 RDX: ffffeba5308001c0 RSI: ffff880068f2e990 RDI: 0000000000000286 RBP: ffff88005aaa7870 R08: ffffed000ffff125 R09: 0000000000000000 R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 00000057000081a4 R15: ffffffff84ec7680 FS: 00007f38772ec700(0000) GS:ffff88006d180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffeba5308001e0 CR3: 0000000061a10000 CR4: 00000000001426e0 Call Trace: quarantine_reduce+0x151/0x180 mm/kasan/quarantine.c:259 kasan_kmalloc+0xd9/0xf0 mm/kasan/kasan.c:605 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:559 slab_post_alloc_hook mm/slab.h:456 [inline] slab_alloc mm/slab.c:3408 [inline] kmem_cache_alloc+0x102/0x720 mm/slab.c:3570 __split_vma+0x1b7/0x8d0 mm/mmap.c:2515 do_munmap+0x2a0/0xfc0 mm/mmap.c:2636 mmap_region+0x4ef/0x1670 mm/mmap.c:1616 do_mmap+0x69b/0xd50 mm/mmap.c:1453 do_mmap_pgoff include/linux/mm.h:2121 [inline] vm_mmap_pgoff+0x1ec/0x280 mm/util.c:309 SYSC_mmap_pgoff mm/mmap.c:1503 [inline] SyS_mmap_pgoff+0x23b/0x5f0 mm/mmap.c:1461 SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x445b79 RSP: 002b:00007f38772eb858 EFLAGS: 00000282 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00000000007081f8 RCX: 0000000000445b79 RDX: 0000000000000003 RSI: 0000000000001000 RDI: 0000000020011000 RBP: 0000000000000086 R08: ffffffffffffffff R09: 0000000000000000 R10: 0000000000000032 R11: 0000000000000282 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f38772ec9c0 R15: 00007f38772ec700 Code: 4c 48 b9 00 00 00 80 ff 77 00 00 48 01 ca 48 bb 00 00 00 00 00 ea ff ff 48 c1 ea 0c 48 8d 0c d5 00 00 00 00 48 29 d1 48 8d 14 cb <48> 8b 4a 20 48 8d 71 ff 83 e1 01 48 0f 45 d6 4c 8b 6a 30 e9 ec RIP: virt_to_head_page include/linux/mm.h:570 [inline] RSP: ffff88005aaa7838 RIP: qlink_to_cache mm/kasan/quarantine.c:127 [inline] RSP: ffff88005aaa7838 RIP: qlist_free_all+0x133/0x160 mm/kasan/quarantine.c:163 RSP: ffff88005aaa7838 CR2: ffffeba5308001e0 ---[ end trace 39ffdc493242bddb ]--- kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 3 PID: 6433 Comm: udevd Not tainted 4.11.0-rc2+ #340 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 task: ffff880011b80880 task.stack: ffff88000ffe0000 RIP: 0010:ep_item_poll fs/eventpoll.c:805 [inline] RIP: 0010:ep_send_events_proc+0x363/0xe80 fs/eventpoll.c:1535 RSP: 0018:ffff88000ffe7520 EFLAGS: 00010206 RAX: ffff880069b82600 RBX: ffff880069163918 RCX: 000000040001f30a RDX: ffff880069163970 RSI: 0000000080003e69 RDI: 000000040001f34a RBP: ffff88000ffe7820 R08: ffffed000d6604f9 R09: 0000000000000000 R10: 0000000000000006 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff880069163920 R14: ffff88000ffe77f8 R15: ffff88000ffe7af0 FS: 00007f2e361ac7a0(0000) GS:ffff88006e300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000104ccb8 CR3: 000000003df31000 CR4: 00000000000006e0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: ep_scan_ready_list+0x3a9/0xea0 fs/eventpoll.c:631 ep_send_events fs/eventpoll.c:1583 [inline] ep_poll+0x543/0xf00 fs/eventpoll.c:1686 SYSC_epoll_wait fs/eventpoll.c:2040 [inline] SyS_epoll_wait+0x167/0x1f0 fs/eventpoll.c:2005 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x7f2e358bf943 RSP: 002b:00007ffd6620afc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8 RAX: ffffffffffffffda RBX: 00000000020221d0 RCX: 00007f2e358bf943 RDX: 0000000000000004 RSI: 00007ffd6620b020 RDI: 0000000000000004 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f2e35b69e40 R13: 0000000002033a00 R14: 0000000000000d10 R15: 00007f2e35b6a498 Code: 00 00 48 8b 43 18 48 8d 78 28 48 89 f9 48 c1 e9 03 42 80 3c 21 00 0f 85 f1 08 00 00 48 8b 48 28 48 8d 79 40 48 89 fe 48 c1 ee 03 <42> 80 3c 26 00 0f 85 a3 08 00 00 48 89 95 50 fd ff ff 48 8b b5 RIP: ep_item_poll fs/eventpoll.c:805 [inline] RSP: ffff88000ffe7520 RIP: ep_send_events_proc+0x363/0xe80 fs/eventpoll.c:1535 RSP: ffff88000ffe7520 ---[ end trace f9bae0064f40d8b7 ]--- On commit 093b995e3b55a0ae0670226ddfcb05bfbf0099ae
