BUG: unable to handle kernel paging request in ion_heap_clear_pages

Status: fixed on 2020/03/06 22:15
Subsystems: staging
[Documentation on labels]
Reported-by: syzbot+be6ccf3081ce8afd1b56@syzkaller.appspotmail.com
Fix commit: d98c9e83b5e7 kasan: fix crashes on access to memory mapped by vm_map_ram()
First crash: 2438d, last: 2418d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
BUG: unable to handle kernel paging request in ion_heap_clear_pages 2 (5) 2020/03/01 22:56

Sample crash report:
BUG: unable to handle page fault for address: fffff52001c00000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 7ffcd067 P4D 7ffcd067 PUD 2cd1c067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 3 PID: 3857 Comm: ion_system_heap Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9c/0x1a0 mm/kasan/generic.c:192
Code: c9 4d 0f 49 c1 49 c1 f8 03 45 85 c0 0f 84 10 01 00 00 41 83 e8 01 4e 8d 44 c0 08 eb 0d 48 83 c0 08 4c 39 c0 0f 84 a7 00 00 00 <48> 83 38 00 74 ed 4c 8d 40 08 eb 09 48 83 c0 01 49 39 c0 74 53 80
RSP: 0018:ffffc9000698fab8 EFLAGS: 00010212
RAX: fffff52001c00000 RBX: fffff52001c01600 RCX: ffffffff85decb29
RDX: 0000000000000001 RSI: 000000000000b000 RDI: ffffc9000e000000
RBP: ffffc9000698fad0 R08: fffff52001c01600 R09: 0000000000001600
R10: fffff52001c015ff R11: ffffc9000e00afff R12: fffff52001c00000
R13: 000000000000b000 R14: 0000000000000000 R15: ffffc9000698fd08
FS:  0000000000000000(0000) GS:ffff88802d300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52001c00000 CR3: 0000000020c01000 CR4: 0000000000340ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 memset+0x24/0x40 mm/kasan/common.c:108
 memset include/linux/string.h:365 [inline]
 ion_heap_clear_pages+0x49/0x70 drivers/staging/android/ion/ion_heap.c:106
 ion_heap_sglist_zero+0x245/0x270 drivers/staging/android/ion/ion_heap.c:130
 ion_heap_buffer_zero+0xf5/0x150 drivers/staging/android/ion/ion_heap.c:145
 ion_system_heap_free+0x1eb/0x250 drivers/staging/android/ion/ion_system_heap.c:163
 ion_buffer_destroy+0x159/0x2d0 drivers/staging/android/ion/ion.c:93
 ion_heap_deferred_free+0x29d/0x630 drivers/staging/android/ion/ion_heap.c:239
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Modules linked in:
CR2: fffff52001c00000
---[ end trace 4f12909ca40de3f5 ]---
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:121 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:135 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:166 [inline]
RIP: 0010:check_memory_region_inline mm/kasan/generic.c:182 [inline]
RIP: 0010:check_memory_region+0x9c/0x1a0 mm/kasan/generic.c:192
Code: c9 4d 0f 49 c1 49 c1 f8 03 45 85 c0 0f 84 10 01 00 00 41 83 e8 01 4e 8d 44 c0 08 eb 0d 48 83 c0 08 4c 39 c0 0f 84 a7 00 00 00 <48> 83 38 00 74 ed 4c 8d 40 08 eb 09 48 83 c0 01 49 39 c0 74 53 80
RSP: 0018:ffffc9000698fab8 EFLAGS: 00010212
RAX: fffff52001c00000 RBX: fffff52001c01600 RCX: ffffffff85decb29
RDX: 0000000000000001 RSI: 000000000000b000 RDI: ffffc9000e000000
RBP: ffffc9000698fad0 R08: fffff52001c01600 R09: 0000000000001600
R10: fffff52001c015ff R11: ffffc9000e00afff R12: fffff52001c00000
R13: 000000000000b000 R14: 0000000000000000 R15: ffffc9000698fd08
FS:  0000000000000000(0000) GS:ffff88802d300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffff52001c00000 CR3: 0000000020c01000 CR4: 0000000000340ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (4378):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/16 00:47 upstream 510c9788991c eef6e580 .config console log report syz C ci-qemu-upstream
2019/12/06 07:46 upstream b0d4beaa5a4b 98b4ef2d .config console log report syz C ci-upstream-kasan-gce-selinux-root
2019/12/06 07:26 upstream b0d4beaa5a4b 98b4ef2d .config console log report syz C ci-upstream-kasan-gce-root
2019/12/04 13:02 upstream 63de37476ebd 0ecb9746 .config console log report syz C ci-upstream-kasan-gce
2019/12/03 15:51 upstream 76bb8b05960c ab342da3 .config console log report syz C ci-upstream-kasan-gce-root
2019/12/05 01:14 upstream 63de37476ebd b2088328 .config console log report syz C ci-upstream-kasan-gce-386
2019/12/07 08:36 linux-next 838333c80c4f 85f26751 .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/06 13:40 linux-next 838333c80c4f 98b4ef2d .config console log report syz C ci-upstream-linux-next-kasan-gce-root
2019/12/20 01:11 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/19 23:44 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/19 23:21 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/19 23:14 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-root
2019/12/19 23:13 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-root
2019/12/19 18:39 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce
2019/12/19 18:36 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce-root
2019/12/19 17:18 upstream 4a94c4332334 36650b4b .config console log report ci-upstream-kasan-gce
2019/12/19 14:06 upstream 4a94c4332334 79b211f7 .config console log report ci-upstream-kasan-gce-root
2019/12/19 13:01 upstream 4a94c4332334 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/19 11:30 upstream 4a94c4332334 1b49002e .config console log report ci-qemu-upstream
2019/12/19 09:59 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce-root
2019/12/19 09:15 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/19 09:12 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/19 07:41 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/19 06:27 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce-root
2019/12/19 04:05 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/19 00:50 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/19 00:07 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/18 23:09 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/18 22:35 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce
2019/12/18 19:26 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-root
2019/12/18 19:17 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce
2019/12/18 15:03 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-root
2019/12/18 11:11 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce
2019/12/18 11:08 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce
2019/12/18 09:22 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/18 06:22 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce
2019/12/18 01:59 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/18 00:53 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/17 23:31 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce
2019/12/17 23:29 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/17 22:05 upstream ea200dec5128 2b31345f .config console log report ci-qemu-upstream
2019/12/17 20:27 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce-root
2019/12/17 20:19 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce
2019/12/17 19:42 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce
2019/12/17 19:36 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce-root
2019/12/17 19:36 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce-selinux-root
2019/12/17 18:34 upstream ea200dec5128 a6bc9c88 .config console log report ci-upstream-kasan-gce
2019/12/19 07:41 upstream 80a0c2e511a9 1b49002e .config console log report ci-qemu-upstream-386
2019/12/19 01:57 upstream 2187f215ebaa 79b211f7 .config console log report ci-upstream-kasan-gce-386
2019/12/18 19:16 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-386
2019/12/18 11:36 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-386
2019/12/18 08:16 upstream 2187f215ebaa f2fe0772 .config console log report ci-upstream-kasan-gce-386
2019/12/18 04:46 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce-386
2019/12/18 02:15 upstream 9065e0636036 a6bc9c88 .config console log report ci-upstream-kasan-gce-386
2019/11/30 01:42 linux-next 419593dad843 3a75be00 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.