bisecting cause commit starting from 537de0c8ca2b2fd49046e06194425f56e6246148 building syzkaller on f62e1e85cf54ccfa990868a402eca32bf4513b21 testing commit 537de0c8ca2b2fd49046e06194425f56e6246148 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in send_hsr_supervision_frame run #1: crashed: general protection fault in send_hsr_supervision_frame run #2: crashed: general protection fault in send_hsr_supervision_frame run #3: crashed: general protection fault in send_hsr_supervision_frame run #4: crashed: general protection fault in send_hsr_supervision_frame run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: OK # git bisect start 537de0c8ca2b2fd49046e06194425f56e6246148 v5.1 Bisecting: 6887 revisions left to test after this (roughly 13 steps) [a2d635decbfa9c1e4ae15cb05b68b2559f7f827c] Merge tag 'drm-next-2019-05-09' of git://anongit.freedesktop.org/drm/drm testing commit a2d635decbfa9c1e4ae15cb05b68b2559f7f827c with gcc (GCC) 8.1.0 all runs: OK # git bisect good a2d635decbfa9c1e4ae15cb05b68b2559f7f827c Bisecting: 3707 revisions left to test after this (roughly 12 steps) [22c58fd70ca48a29505922b1563826593b08cc00] Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 22c58fd70ca48a29505922b1563826593b08cc00 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 22c58fd70ca48a29505922b1563826593b08cc00 Bisecting: 1848 revisions left to test after this (roughly 11 steps) [2409207a73cc8e4aff75ceccf6fe5c3ce4d391bc] Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi testing commit 2409207a73cc8e4aff75ceccf6fe5c3ce4d391bc with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2409207a73cc8e4aff75ceccf6fe5c3ce4d391bc Bisecting: 924 revisions left to test after this (roughly 10 steps) [3d4645bf7a76886c70a482a1c6742bac98553f47] Merge tag 's390-5.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux testing commit 3d4645bf7a76886c70a482a1c6742bac98553f47 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 3d4645bf7a76886c70a482a1c6742bac98553f47 Bisecting: 463 revisions left to test after this (roughly 9 steps) [5d1549847c76b1ffcf8e388ef4d0f229bdd1d7e8] netfilter: Fix remainder of pseudo-header protocol 0 testing commit 5d1549847c76b1ffcf8e388ef4d0f229bdd1d7e8 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 5d1549847c76b1ffcf8e388ef4d0f229bdd1d7e8 Bisecting: 231 revisions left to test after this (roughly 8 steps) [a4c33bbb660b89fc7f21957386fb3a0b38e43f98] Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm testing commit a4c33bbb660b89fc7f21957386fb3a0b38e43f98 with gcc (GCC) 8.1.0 all runs: OK # git bisect good a4c33bbb660b89fc7f21957386fb3a0b38e43f98 Bisecting: 117 revisions left to test after this (roughly 7 steps) [763cf1f2d9bfc8349c5791689074c8c17edf660d] Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid testing commit 763cf1f2d9bfc8349c5791689074c8c17edf660d with gcc (GCC) 8.1.0 all runs: OK # git bisect good 763cf1f2d9bfc8349c5791689074c8c17edf660d Bisecting: 58 revisions left to test after this (roughly 6 steps) [c8c8218ec5af5d2598381883acbefbf604e56b5e] netrom: fix a memory leak in nr_rx_frame() testing commit c8c8218ec5af5d2598381883acbefbf604e56b5e with gcc (GCC) 8.1.0 all runs: OK # git bisect good c8c8218ec5af5d2598381883acbefbf604e56b5e Bisecting: 29 revisions left to test after this (roughly 5 steps) [0d581ba311a27762fe1a14e5db5f65d225b3d844] net: hns: add support for vlan TSO testing commit 0d581ba311a27762fe1a14e5db5f65d225b3d844 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 0d581ba311a27762fe1a14e5db5f65d225b3d844 Bisecting: 14 revisions left to test after this (roughly 4 steps) [c3ead2df9776ab22490d78a7f68a8ec58700e07f] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf testing commit c3ead2df9776ab22490d78a7f68a8ec58700e07f with gcc (GCC) 8.1.0 all runs: OK # git bisect good c3ead2df9776ab22490d78a7f68a8ec58700e07f Bisecting: 7 revisions left to test after this (roughly 3 steps) [56c5ee1a5823e9cf5288b84ae6364cb4112f8225] xfrm interface: fix memory leak on creation testing commit 56c5ee1a5823e9cf5288b84ae6364cb4112f8225 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 56c5ee1a5823e9cf5288b84ae6364cb4112f8225 Bisecting: 3 revisions left to test after this (roughly 2 steps) [b9a1e627405d68d475a3c1f35e685ccfb5bbe668] hsr: implement dellink to clean up resources testing commit b9a1e627405d68d475a3c1f35e685ccfb5bbe668 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in send_hsr_supervision_frame run #1: crashed: general protection fault in send_hsr_supervision_frame run #2: crashed: general protection fault in send_hsr_supervision_frame run #3: crashed: general protection fault in send_hsr_supervision_frame run #4: OK run #5: crashed: general protection fault in send_hsr_supervision_frame run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad b9a1e627405d68d475a3c1f35e685ccfb5bbe668 Bisecting: 1 revision left to test after this (roughly 1 step) [114b5b355ec0b6e83a6628a5ab5d03e50fd40a31] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec testing commit 114b5b355ec0b6e83a6628a5ab5d03e50fd40a31 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 114b5b355ec0b6e83a6628a5ab5d03e50fd40a31 Bisecting: 0 revisions left to test after this (roughly 0 steps) [619afef01f74f3572b5e9a266c1230dc83761eec] hsr: fix a memory leak in hsr_del_port() testing commit 619afef01f74f3572b5e9a266c1230dc83761eec with gcc (GCC) 8.1.0 all runs: OK # git bisect good 619afef01f74f3572b5e9a266c1230dc83761eec b9a1e627405d68d475a3c1f35e685ccfb5bbe668 is the first bad commit commit b9a1e627405d68d475a3c1f35e685ccfb5bbe668 Author: Cong Wang Date: Wed Jul 3 17:21:13 2019 -0700 hsr: implement dellink to clean up resources hsr_link_ops implements ->newlink() but not ->dellink(), which leads that resources not released after removing the device, particularly the entries in self_node_db and node_db. So add ->dellink() implementation to replace the priv_destructor. This also makes the code slightly easier to understand. Reported-by: syzbot+c6167ec3de7def23d1e8@syzkaller.appspotmail.com Cc: Arvid Brodin Signed-off-by: Cong Wang Signed-off-by: David S. Miller :040000 040000 65599c9790197ff086c1843ca65b40688d162283 07d35e0ebb6f5a6fa2ee09ede31e24b8def82990 M net revisions tested: 16, total time: 4h20m39.566400101s (build: 1h30m2.837431901s, test: 2h45m16.660629252s) first bad commit: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 hsr: implement dellink to clean up resources cc: ["arvid.brodin@alten.se" "davem@davemloft.net" "linux-kernel@vger.kernel.org" "netdev@vger.kernel.org" "xiyou.wangcong@gmail.com"] crash: general protection fault in send_hsr_supervision_frame kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 22930 Comm: syz-executor.0 Not tainted 5.2.0-rc6+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:send_hsr_supervision_frame+0x30/0xf60 net/hsr/hsr_device.c:251 Code: 89 e5 41 57 41 56 41 55 49 89 fd 41 54 41 89 d4 48 89 c2 53 48 c1 ea 03 48 83 ec 50 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 89 75 c8 0f 85 83 0c 00 00 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffff8880aeb09c68 EFLAGS: 00010282 RAX: dffffc0000000000 RBX: ffff8880a04ab0c0 RCX: 1ffff11012781b24 RDX: 0000000000000002 RSI: 0000000000000017 RDI: 0000000000000000 RBP: ffff8880aeb09ce0 R08: ffffed1015d66c70 R09: ffffed1015d66c6f R10: ffffed1015d66c6f R11: ffff8880aeb3637b R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880aeb09db8 R15: ffff8880aeb24b80 FS: 00007fdab1402700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdab1401db8 CR3: 00000000a4c9e000 CR4: 00000000001406e0 Call Trace: hsr_announce+0xd9/0x2b0 net/hsr/hsr_device.c:335 call_timer_fn+0x14d/0x510 kernel/time/timer.c:1322 expire_timers kernel/time/timer.c:1366 [inline] __run_timers kernel/time/timer.c:1685 [inline] run_timer_softirq+0xc6f/0x1330 kernel/time/timer.c:1698 __do_softirq+0x260/0x958 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1068 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806 RIP: 0010:tomoyo_check_acl+0x95/0x320 security/tomoyo/domain.c:170 Code: 03 42 80 3c 28 00 0f 85 7b 02 00 00 4d 8b 34 24 4d 39 f4 0f 84 68 01 00 00 49 8d 7e 18 48 89 f8 48 89 fe 48 c1 e8 03 83 e6 07 <42> 0f b6 04 28 40 38 f0 7f 08 84 c0 0f 85 f1 01 00 00 41 80 7e 18 RSP: 0018:ffff88809dd4f6f0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1101262b183 RBX: ffffed1013ba9f0c RCX: 1ffff11013ba9f07 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff888093158c18 RBP: ffff88809dd4f740 R08: 6fcba17e28262d1f R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888090674810 R13: dffffc0000000000 R14: ffff888093158c00 R15: ffff88809dd4f818 tomoyo_path_permission+0x1eb/0x340 security/tomoyo/file.c:586 tomoyo_check_open_permission+0x2c6/0x2f0 security/tomoyo/file.c:777 tomoyo_file_open+0x81/0xa0 security/tomoyo/tomoyo.c:319 security_file_open+0x46/0x240 security/security.c:1454 do_dentry_open+0x2d1/0x1000 fs/open.c:765 vfs_open+0x9a/0xc0 fs/open.c:887 do_last fs/namei.c:3416 [inline] path_openat+0xb52/0x3d10 fs/namei.c:3533 do_filp_open+0x177/0x250 fs/namei.c:3563 do_sys_open+0x1dd/0x370 fs/open.c:1070 __do_sys_open fs/open.c:1088 [inline] __se_sys_open fs/open.c:1083 [inline] __x64_sys_open+0x79/0xb0 fs/open.c:1083 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4136b1 Code: 75 14 b8 02 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 19 00 00 c3 48 83 ec 08 e8 0a fa ff ff 48 89 04 24 b8 02 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fa ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007fdab1401c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004136b1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000004be36e RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 00007fdab14029d0 R11: 0000000000000293 R12: 00007fdab14026d4 R13: 00000000004c862b R14: 00000000004df218 R15: 00000000ffffffff Modules linked in: ---[ end trace b506c9e8d4539757 ]--- RIP: 0010:send_hsr_supervision_frame+0x30/0xf60 net/hsr/hsr_device.c:251 Code: 89 e5 41 57 41 56 41 55 49 89 fd 41 54 41 89 d4 48 89 c2 53 48 c1 ea 03 48 83 ec 50 48 89 45 d0 48 b8 00 00 00 00 00 fc ff df <80> 3c 02 00 89 75 c8 0f 85 83 0c 00 00 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffff8880aeb09c68 EFLAGS: 00010282 RAX: dffffc0000000000 RBX: ffff8880a04ab0c0 RCX: 1ffff11012781b24 RDX: 0000000000000002 RSI: 0000000000000017 RDI: 0000000000000000 RBP: ffff8880aeb09ce0 R08: ffffed1015d66c70 R09: ffffed1015d66c6f R10: ffffed1015d66c6f R11: ffff8880aeb3637b R12: 0000000000000000 R13: 0000000000000000 R14: ffff8880aeb09db8 R15: ffff8880aeb24b80 FS: 00007fdab1402700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdab1401db8 CR3: 00000000a4c9e000 CR4: 00000000001406e0