* WARNING in __alloc_pages_nodemask
@ 2019-10-16 9:21 zzoru
2019-10-16 12:59 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: zzoru @ 2019-10-16 9:21 UTC (permalink / raw)
To: stern, gregkh, linux-usb, usb-storage, LKML; +Cc: dokyungs, syzkaller
We found the following crash on Linux 5.4-rc1 (Not patched in current
HEAD commit 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442)
with our customized syzkaller.
WARNING: CPU: 0 PID: 12 at linux/mm/page_alloc.c:4727
__alloc_pages_nodemask+0x333/0x760 linux/mm/page_alloc.c:4727
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.4.0-rc1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack linux/lib/dump_stack.c:77 [inline]
dump_stack+0x7c/0xbb linux/lib/dump_stack.c:113
panic+0x205/0x48e linux/kernel/panic.c:220
__warn+0x19c/0x1c0 linux/kernel/panic.c:581
report_bug+0x1a9/0x2b0 linux/lib/bug.c:195
fixup_bug.part.11+0x32/0x80 linux/arch/x86/kernel/traps.c:179
fixup_bug linux/arch/x86/include/asm/irqflags.h:54 [inline]
do_error_trap+0xf5/0x160 linux/arch/x86/kernel/traps.c:272
do_invalid_op+0x31/0x40 linux/arch/x86/kernel/traps.c:291
invalid_op+0x23/0x30 linux/arch/x86/entry/entry_64.S:1028
RIP: 0010:__alloc_pages_nodemask+0x333/0x760 linux/mm/page_alloc.c:4727
Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 68 10 00 00 41 bc 01
00 00 00 48 89 44 24 40 e9 2a fe ff ff 81 e7 00 20 00 00 75 02 <0f> 0b
45 31 e4 e9 6e ff ff ff 41 f7 c6 00 00 40 00 0f 84 2c ff ff
RSP: 0018:ffff88801a1a6f60 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 1ffff11003434def RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000034 RDI: 0000000000000000
RBP: ffffffffffffff5e R08: ffffed1002d261a2 R09: dffffc0000000000
R10: 0000000000000001 R11: ffffed1002d261a1 R12: ffffffffffffff5e
R13: 0000000000000dc0 R14: ffff888017140000 R15: 0000000000000034
alloc_pages linux/include/linux/gfp.h:509 [inline]
kmalloc_order+0x16/0x50 linux/mm/slab_common.c:1294
kmalloc_order_trace+0x18/0x110 linux/mm/slab_common.c:1306
kmalloc linux/include/linux/slab.h:557 [inline]
kzalloc linux/include/linux/slab.h:686 [inline]
init_realtek_cr+0x2ec/0x1440 linux/drivers/usb/storage/realtek_cr.c:990
usb_stor_acquire_resources linux/drivers/usb/storage/usb.c:784 [inline]
usb_stor_probe2+0x738/0xbb0 linux/drivers/usb/storage/usb.c:1047
realtek_cr_probe+0x9b/0xe0 linux/drivers/usb/storage/realtek_cr.c:1048
usb_probe_interface+0x2b9/0x870 linux/drivers/usb/core/driver.c:361
really_probe+0x444/0x830 linux/drivers/base/dd.c:548
driver_probe_device+0xe3/0x250 linux/drivers/base/dd.c:721
__device_attach_driver+0x17a/0x1e0 linux/drivers/base/dd.c:828
bus_for_each_drv+0x143/0x1e0 linux/drivers/base/bus.c:430
__device_attach+0x1f1/0x310 linux/drivers/base/dd.c:894
bus_probe_device+0x1d7/0x280 linux/drivers/base/bus.c:490
device_add+0xb72/0x1660 linux/drivers/base/core.c:2201
usb_set_configuration+0xaca/0x1840 linux/drivers/usb/core/message.c:2023
generic_probe+0x63/0xd0 linux/drivers/usb/core/generic.c:210
usb_probe_device+0x89/0xd0 linux/drivers/usb/core/driver.c:266
really_probe+0x444/0x830 linux/drivers/base/dd.c:548
driver_probe_device+0xe3/0x250 linux/drivers/base/dd.c:721
__device_attach_driver+0x17a/0x1e0 linux/drivers/base/dd.c:828
bus_for_each_drv+0x143/0x1e0 linux/drivers/base/bus.c:430
__device_attach+0x1f1/0x310 linux/drivers/base/dd.c:894
bus_probe_device+0x1d7/0x280 linux/drivers/base/bus.c:490
device_add+0xb72/0x1660 linux/drivers/base/core.c:2201
usb_new_device+0x784/0x10d0 linux/drivers/usb/core/hub.c:2536
hub_port_connect linux/drivers/usb/core/hub.c:5098 [inline]
hub_port_connect_change linux/drivers/usb/core/hub.c:5213 [inline]
port_event linux/drivers/usb/core/hub.c:5359 [inline]
hub_event+0x18ed/0x3610 linux/drivers/usb/core/hub.c:5441
process_one_work+0x8b5/0x17c0 linux/kernel/workqueue.c:2269
worker_thread+0x82/0xb80 linux/kernel/workqueue.c:2415
kthread+0x325/0x3e0 linux/kernel/kthread.c:255
ret_from_fork+0x24/0x30 linux/arch/x86/entry/entry_64.S:352
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Following is my analysis of this bug. (Just add some comments in source code):
realtek_cr.c:
struct rts51x_chip {
u16 vendor_id;
u16 product_id;
char max_lun; // char -> signed 1byte
...
}
static int init_realtek_cr(struct us_data *us)
{
int size, i, retval;
...
us->max_lun = chip->max_lun = rts51x_get_max_lun(us); // From USB
device (-127~126) Malicious usb device can manipulate this value.
size = (chip->max_lun + 1) * sizeof(struct rts51x_status); // Can
be negative integer or 0 (-1+1).
chip->status = kzalloc(size, GFP_KERNEL); // kzalloc(0) ==
ZERO_SIZE_PTR or kzalloc(negative integer) -> Warning
...
for (i = 0; i <= (int)(chip->max_lun); i++) {
retval = rts51x_check_status(us, (u8) i);
...
}
}
tatic int rts51x_check_status(struct us_data *us, u8 lun)
{
struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
int retval;
u8 buf[16];
retval = rts51x_read_status(us, lun, buf, 16, &(chip->status_len));
if (retval != STATUS_SUCCESS)
return -EIO;
usb_stor_dbg(us, "chip->status_len = %d\n", chip->status_len);
chip->status[lun].vid = ((u16) buf[0] << 8) | buf[1]; //
ZERO_SIZE_PTR DEREFERENCE :(
chip->status[lun].pid = ((u16) buf[2] << 8) | buf[3];
chip->status[lun].cur_lun = buf[4];
chip->status[lun].card_type = buf[5];
chip->status[lun].total_lun = buf[6];
chip->status[lun].fw_ver = ((u16) buf[7] << 8) | buf[8];
chip->status[lun].phy_exist = buf[9];
chip->status[lun].multi_flag = buf[10];
chip->status[lun].multi_card = buf[11];
chip->status[lun].log_exist = buf[12];
if (chip->status_len == 16) {
chip->status[lun].detailed_type.detailed_type1 = buf[13];
chip->status[lun].function[0] = buf[14];
chip->status[lun].function[1] = buf[15];
}
return 0;
}
Need to change a declaration of max_lun. (u8)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in __alloc_pages_nodemask
2019-10-16 9:21 WARNING in __alloc_pages_nodemask zzoru
@ 2019-10-16 12:59 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2019-10-16 12:59 UTC (permalink / raw)
To: zzoru; +Cc: stern, linux-usb, usb-storage, LKML, dokyungs, syzkaller
On Wed, Oct 16, 2019 at 02:21:59AM -0700, zzoru wrote:
> We found the following crash on Linux 5.4-rc1 (Not patched in current
> HEAD commit 3b1f00aceb7a67bf079a5a64aa5c6baf78a8f442)
> with our customized syzkaller.
<snip>
For this, and the other report, can you make up a patch to fix the issue
and submit it?
Also, 5.4-rc3 is out, you might want to update to a newer kernel as lots
and lots of USB-specific syzkaller-found issues have been fixed since
-rc1.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in __alloc_pages_nodemask
2019-09-16 20:57 ` Matthew Wilcox
@ 2019-09-19 18:29 ` Andrey Konovalov
0 siblings, 0 replies; 6+ messages in thread
From: Andrey Konovalov @ 2019-09-19 18:29 UTC (permalink / raw)
To: Matthew Wilcox
Cc: David Rientjes, syzbot, Jiri Kosina, Benjamin Tissoires,
Andrea Arcangeli, Andrew Morton, LKML,
Linux Memory Management List, USB list, Michal Hocko,
syzkaller-bugs, Vlastimil Babka, yang.shi, zhongjiang
On Mon, Sep 16, 2019 at 10:58 PM Matthew Wilcox <willy@infradead.org> wrote:
>
> On Mon, Sep 16, 2019 at 01:00:11PM -0700, David Rientjes wrote:
> > On Mon, 16 Sep 2019, syzbot wrote:
> > > HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> > > git tree: https://github.com/google/kasan.git usb-fuzzer
> > > console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> > > kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> > > dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> > > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
> > >
> > > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > > Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
> > >
> > > WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> > > __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> > > Kernel panic - not syncing: panic_on_warn set ...
>
> > > alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> > > alloc_pages include/linux/gfp.h:509 [inline]
> > > kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> > > kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> > > __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> > > usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> > > usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> > > hid_hw_request include/linux/hid.h:1053 [inline]
> > > hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> > Adding Jiri and Benjamin. The hid report length is simply too large for
> > the page allocator to allocate: this is triggering because the resulting
> > allocation order is > MAX_ORDER-1. Any way to make this allocate less
> > physically contiguous memory?
>
> The HID code should, presumably, reject reports which are larger than
> PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER. Particularly since it's using
> GFP_ATOMIC.
This is an int underflow when doing report buffer size calculation, see here:
https://groups.google.com/d/msg/syzkaller-bugs/X0zVbh8aFEM/NsPcshjxBgAJ
#syz dup: KMSAN: kernel-usb-infoleak in hid_submit_ctrl
https://syzkaller.appspot.com/bug?extid=401d71a99cfca9fceb77
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in __alloc_pages_nodemask
2019-09-16 20:00 ` David Rientjes
@ 2019-09-16 20:57 ` Matthew Wilcox
2019-09-19 18:29 ` Andrey Konovalov
0 siblings, 1 reply; 6+ messages in thread
From: Matthew Wilcox @ 2019-09-16 20:57 UTC (permalink / raw)
To: David Rientjes
Cc: syzbot, Jiri Kosina, Benjamin Tissoires, Andrea Arcangeli,
Andrew Morton, andreyknvl, linux-kernel, linux-mm, linux-usb,
mhocko, syzkaller-bugs, vbabka, yang.shi, zhongjiang
On Mon, Sep 16, 2019 at 01:00:11PM -0700, David Rientjes wrote:
> On Mon, 16 Sep 2019, syzbot wrote:
> > HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> > git tree: https://github.com/google/kasan.git usb-fuzzer
> > console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> > dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> > compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
> >
> > WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> > __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> > Kernel panic - not syncing: panic_on_warn set ...
> > alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> > alloc_pages include/linux/gfp.h:509 [inline]
> > kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> > kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> > __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> > usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> > usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> > hid_hw_request include/linux/hid.h:1053 [inline]
> > hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> Adding Jiri and Benjamin. The hid report length is simply too large for
> the page allocator to allocate: this is triggering because the resulting
> allocation order is > MAX_ORDER-1. Any way to make this allocate less
> physically contiguous memory?
The HID code should, presumably, reject reports which are larger than
PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER. Particularly since it's using
GFP_ATOMIC.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: WARNING in __alloc_pages_nodemask
2019-09-16 18:49 syzbot
@ 2019-09-16 20:00 ` David Rientjes
2019-09-16 20:57 ` Matthew Wilcox
0 siblings, 1 reply; 6+ messages in thread
From: David Rientjes @ 2019-09-16 20:00 UTC (permalink / raw)
To: syzbot, Jiri Kosina, Benjamin Tissoires
Cc: Andrea Arcangeli, Andrew Morton, andreyknvl, linux-kernel,
linux-mm, linux-usb, mhocko, syzkaller-bugs, vbabka, yang.shi,
zhongjiang
On Mon, 16 Sep 2019, syzbot wrote:
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
> git tree: https://github.com/google/kasan.git usb-fuzzer
> console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
> kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
> dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
>
> WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
> __alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 0 PID: 1720 Comm: syz-executor388 Not tainted 5.3.0-rc7+ #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
> 01/01/2011
> Call Trace:
> __dump_stack lib/dump_stack.c:77 [inline]
> dump_stack+0xca/0x13e lib/dump_stack.c:113
> panic+0x2a3/0x6da kernel/panic.c:219
> __warn.cold+0x20/0x4a kernel/panic.c:576
> report_bug+0x262/0x2a0 lib/bug.c:186
> fixup_bug arch/x86/kernel/traps.c:179 [inline]
> fixup_bug arch/x86/kernel/traps.c:174 [inline]
> do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
> do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
> invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
> RIP: 0010:__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
> Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 60 10 00 00 41 be 01 00 00 00
> 48 89 44 24 58 e9 ee fd ff ff 81 e5 00 20 00 00 75 02 <0f> 0b 45 31 f6 e9 6b
> ff ff ff 8b 44 24 68 89 04 24 65 8b 2d e9 7e
> RSP: 0018:ffff8881d320f9d8 EFLAGS: 00010046
> RAX: 0000000000000000 RBX: 1ffff1103a641f3f RCX: 0000000000000000
> RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040a20
> RBP: 0000000000000000 R08: ffff8881d3bcc800 R09: ffffed103a541d19
> R10: ffffed103a541d18 R11: ffff8881d2a0e8c7 R12: 0000000000000012
> R13: 0000000000000012 R14: 0000000000000000 R15: ffff8881d2a0e8c0
> alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
> alloc_pages include/linux/gfp.h:509 [inline]
> kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
> kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
> __usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
> usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
> usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
> hid_hw_request include/linux/hid.h:1053 [inline]
> hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
> vfs_ioctl fs/ioctl.c:46 [inline]
> file_ioctl fs/ioctl.c:509 [inline]
> do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
> ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
> __do_sys_ioctl fs/ioctl.c:720 [inline]
> __se_sys_ioctl fs/ioctl.c:718 [inline]
> __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
> do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
> entry_SYSCALL_64_after_hwframe+0x49/0xbe
Adding Jiri and Benjamin. The hid report length is simply too large for
the page allocator to allocate: this is triggering because the resulting
allocation order is > MAX_ORDER-1. Any way to make this allocate less
physically contiguous memory?
^ permalink raw reply [flat|nested] 6+ messages in thread
* WARNING in __alloc_pages_nodemask
@ 2019-09-16 18:49 syzbot
2019-09-16 20:00 ` David Rientjes
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2019-09-16 18:49 UTC (permalink / raw)
To: aarcange, akpm, andreyknvl, linux-kernel, linux-mm, linux-usb,
mhocko, rientjes, syzkaller-bugs, vbabka, yang.shi, zhongjiang
Hello,
syzbot found the following crash on:
HEAD commit: f0df5c1b usb-fuzzer: main usb gadget fuzzer driver
git tree: https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=14b15371600000
kernel config: https://syzkaller.appspot.com/x/.config?x=5c6633fa4ed00be5
dashboard link: https://syzkaller.appspot.com/bug?extid=e38fe539fedfc127987e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1093bed1600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1603cfc6600000
IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e38fe539fedfc127987e@syzkaller.appspotmail.com
WARNING: CPU: 0 PID: 1720 at mm/page_alloc.c:4696
__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 1720 Comm: syz-executor388 Not tainted 5.3.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xca/0x13e lib/dump_stack.c:113
panic+0x2a3/0x6da kernel/panic.c:219
__warn.cold+0x20/0x4a kernel/panic.c:576
report_bug+0x262/0x2a0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:179 [inline]
fixup_bug arch/x86/kernel/traps.c:174 [inline]
do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:__alloc_pages_nodemask+0x36f/0x780 mm/page_alloc.c:4696
Code: fe ff ff 65 48 8b 04 25 00 ef 01 00 48 05 60 10 00 00 41 be 01 00 00
00 48 89 44 24 58 e9 ee fd ff ff 81 e5 00 20 00 00 75 02 <0f> 0b 45 31 f6
e9 6b ff ff ff 8b 44 24 68 89 04 24 65 8b 2d e9 7e
RSP: 0018:ffff8881d320f9d8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 1ffff1103a641f3f RCX: 0000000000000000
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000040a20
RBP: 0000000000000000 R08: ffff8881d3bcc800 R09: ffffed103a541d19
R10: ffffed103a541d18 R11: ffff8881d2a0e8c7 R12: 0000000000000012
R13: 0000000000000012 R14: 0000000000000000 R15: ffff8881d2a0e8c0
alloc_pages_current+0xff/0x200 mm/mempolicy.c:2153
alloc_pages include/linux/gfp.h:509 [inline]
kmalloc_order+0x1a/0x60 mm/slab_common.c:1257
kmalloc_order_trace+0x18/0x110 mm/slab_common.c:1269
__usbhid_submit_report drivers/hid/usbhid/hid-core.c:588 [inline]
usbhid_submit_report+0x5b5/0xde0 drivers/hid/usbhid/hid-core.c:638
usbhid_request+0x3c/0x70 drivers/hid/usbhid/hid-core.c:1252
hid_hw_request include/linux/hid.h:1053 [inline]
hiddev_ioctl+0x526/0x1550 drivers/hid/usbhid/hiddev.c:735
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:509 [inline]
do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
__do_sys_ioctl fs/ioctl.c:720 [inline]
__se_sys_ioctl fs/ioctl.c:718 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x444949
Code: e8 bc af 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 1b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffed614ab8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444949
RDX: 0000000020000080 RSI: 00000000400c4808 RDI: 0000000000000004
RBP: 00000000006cf018 R08: 18c1180b508ac6d9 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 00000000004025f0
R13: 0000000000402680 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-10-16 12:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-16 9:21 WARNING in __alloc_pages_nodemask zzoru
2019-10-16 12:59 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2019-09-16 18:49 syzbot
2019-09-16 20:00 ` David Rientjes
2019-09-16 20:57 ` Matthew Wilcox
2019-09-19 18:29 ` Andrey Konovalov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).