Hi, We found a bug in Linux 6.10 using syzkaller. It is possibly a null pointer dereference bug. The bug report is as follows, but unfortunately there is no generated syzkaller reproducer. Bug report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 4493 Comm: systemd-journal Not tainted 6.10.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:mtree_range_walk+0x2e4/0x890 lib/maple_tree.c:2774 Code: 48 83 f8 01 0f 84 ba 00 00 00 e8 c7 0f a4 f6 49 83 c4 08 49 ff c6 48 8b 6c 24 10 eb a7 e8 b4 0f a4 f6 45 31 f6 e9 e5 00 00 00 <41> 80 3c 24 00 74 07 31 ff e8 be 1a 07 f7 4c 8b 2c 25 00 00 00 00 RSP: 0000:ffffc90002cc7c38 EFLAGS: 00010297 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff8f0c3620 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff8aed3fbd R10: 0000000000000003 R11: ffff8880202fbc00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc90002cc7da8 R15: 0000000000000001 FS: 00007f9017010900(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9015c26c20 CR3: 00000000201f4000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> mas_state_walk lib/maple_tree.c:3678 [inline] mas_walk+0x7e/0x270 lib/maple_tree.c:4909 lock_vma_under_rcu+0x22b/0x6d0 mm/memory.c:5841 do_user_addr_fault+0x2ef/0x1190 arch/x86/mm/fault.c:1329 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x7a/0x120 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f90177c60be Code: 40 38 00 00 00 00 4c 89 e8 48 f7 f1 48 8b 85 d8 00 00 00 48 c1 e2 04 48 01 d0 49 89 d5 48 8b 50 08 48 85 d2 0f 85 32 03 00 00 <4c> 89 00 48 8b 85 d8 00 00 00 4e 89 44 28 08 48 8b 85 d0 00 00 00 RSP: 002b:00007fffb2ac0810 EFLAGS: 00010246 RAX: 00007f9015c26c20 RBX: 00007fffb2ac0cf0 RCX: 000000000000acf8 RDX: 0000000000000000 RSI: 3833393d4449505f RDI: 00007f9015f76860 RBP: 000055d12aec0690 R08: 0000000000376820 R09: 0000000000376820 R10: 0000000000000002 R11: 7fffffffffffffff R12: 0000000000000009 R13: 0000000000025630 R14: 0000000000000000 R15: 00007fffb2ac0830 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mtree_range_walk+0x2e4/0x890 lib/maple_tree.c:2774 Code: 48 83 f8 01 0f 84 ba 00 00 00 e8 c7 0f a4 f6 49 83 c4 08 49 ff c6 48 8b 6c 24 10 eb a7 e8 b4 0f a4 f6 45 31 f6 e9 e5 00 00 00 <41> 80 3c 24 00 74 07 31 ff e8 be 1a 07 f7 4c 8b 2c 25 00 00 00 00 RSP: 0000:ffffc90002cc7c38 EFLAGS: 00010297 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff8f0c3620 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000005 R09: ffffffff8aed3fbd R10: 0000000000000003 R11: ffff8880202fbc00 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffc90002cc7da8 R15: 0000000000000001 FS: 00007f9017010900(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000563c4dcd61e0 CR3: 00000000201f4000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 48 83 f8 01 cmp $0x1,%rax 4: 0f 84 ba 00 00 00 je 0xc4 a: e8 c7 0f a4 f6 call 0xf6a40fd6 f: 49 83 c4 08 add $0x8,%r12 13: 49 ff c6 inc %r14 16: 48 8b 6c 24 10 mov 0x10(%rsp),%rbp 1b: eb a7 jmp 0xffffffc4 1d: e8 b4 0f a4 f6 call 0xf6a40fd6 22: 45 31 f6 xor %r14d,%r14d 25: e9 e5 00 00 00 jmp 0x10f * 2a: 41 80 3c 24 00 cmpb $0x0,(%r12) <-- trapping instruction 2f: 74 07 je 0x38 31: 31 ff xor %edi,%edi 33: e8 be 1a 07 f7 call 0xf7071af6 38: 4c 8b 2c 25 00 00 00 mov 0x0,%r13 3f: 00 -- Yours sincerely, Xingyu
