bisecting cause commit starting from 51fa960d3b5163b1af22efdebcabfccc5d615ad6 building syzkaller on a44eb8f7eadcc16e73055948131b2c56b4fd5272 testing commit 51fa960d3b5163b1af22efdebcabfccc5d615ad6 with gcc (GCC) 8.1.0 kernel signature: 735f163ee810781818ce5ad6662e45c5fe80c4a2984ec7bb87d072da59ca0b9b all runs: crashed: general protection fault in put_cmsg testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 9543c4dc6a785f7f7ee1384da3bf5d9f28e1dd6bfef4e91260459e130ee7c68e all runs: OK # git bisect start 51fa960d3b5163b1af22efdebcabfccc5d615ad6 7111951b8d4973bda27ff663f2cf18b663d15b48 Bisecting: 7614 revisions left to test after this (roughly 13 steps) [919dce24701f7b34681a6a1d3ef95c9f6c4fb1cc] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit 919dce24701f7b34681a6a1d3ef95c9f6c4fb1cc with gcc (GCC) 8.1.0 kernel signature: 4970dfd5ece69192495e4c609c67f010d6dbe07faa9955bb13e03282b4220f29 all runs: OK # git bisect good 919dce24701f7b34681a6a1d3ef95c9f6c4fb1cc Bisecting: 3798 revisions left to test after this (roughly 12 steps) [7e63420847ae5f1036e4f7c42f0b3282e73efbc2] Merge tag 'acpi-5.7-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 7e63420847ae5f1036e4f7c42f0b3282e73efbc2 with gcc (GCC) 8.1.0 kernel signature: a1c92116860ad5879bff234e2c89e705924d8cb27cd9300c6e24852f2b35946f all runs: OK # git bisect good 7e63420847ae5f1036e4f7c42f0b3282e73efbc2 Bisecting: 1898 revisions left to test after this (roughly 11 steps) [b9916af776013051a34ccf47bc5e13acffef16c3] Merge tag 'kbuild-fixes-v5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild testing commit b9916af776013051a34ccf47bc5e13acffef16c3 with gcc (GCC) 8.1.0 kernel signature: a3d8a46a9a366d5623df8bc188a90481647f3b2115d8f69157d37dc6e389f292 all runs: OK # git bisect good b9916af776013051a34ccf47bc5e13acffef16c3 Bisecting: 949 revisions left to test after this (roughly 10 steps) [098286ff930ca752e4c9295ea65840dd55f5f290] bnxt_en: Add doorbell information to bnxt_en_dev struct. testing commit 098286ff930ca752e4c9295ea65840dd55f5f290 with gcc (GCC) 8.1.0 kernel signature: 665f9e3953bafa9109cef64c1e4c05c039989388cf839751936416620b21c759 all runs: OK # git bisect good 098286ff930ca752e4c9295ea65840dd55f5f290 Bisecting: 495 revisions left to test after this (roughly 9 steps) [a811c1fa0a02c062555b54651065899437bacdbe] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit a811c1fa0a02c062555b54651065899437bacdbe with gcc (GCC) 8.1.0 kernel signature: 2351846f60ef2ddb3837b5595f8d0a626951464cc9ca473b37aa635ff9200cc9 all runs: OK # git bisect good a811c1fa0a02c062555b54651065899437bacdbe Bisecting: 316 revisions left to test after this (roughly 8 steps) [7f65f6118a53eeb3cd9baa0ceb5519b478758cd9] Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git testing commit 7f65f6118a53eeb3cd9baa0ceb5519b478758cd9 with gcc (GCC) 8.1.0 kernel signature: ff538082732a2216f8238909f339307213f71832a956d2c8650a0a0aff0a8413 all runs: OK # git bisect good 7f65f6118a53eeb3cd9baa0ceb5519b478758cd9 Bisecting: 158 revisions left to test after this (roughly 7 steps) [a8c9baf28c484a56a0cb1f92e9f740112d1cc567] Merge branch 'hsr-hsr-code-refactoring' testing commit a8c9baf28c484a56a0cb1f92e9f740112d1cc567 with gcc (GCC) 8.1.0 kernel signature: c8867b4c8093a0a53633ef029d58b092476f3e4475b6bcf40a5f04b458964f32 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: boot failed: can't ssh into the instance # git bisect good a8c9baf28c484a56a0cb1f92e9f740112d1cc567 Bisecting: 79 revisions left to test after this (roughly 6 steps) [d728e6402c0023a46b8595e1736695517fd94a7a] net: usb: ax88179_178a: remove redundant assignment to variable ret testing commit d728e6402c0023a46b8595e1736695517fd94a7a with gcc (GCC) 8.1.0 kernel signature: b012c077756704fe6cac6a5d833b139e686e87989a88f98f6225b9f2ea896839 all runs: OK # git bisect good d728e6402c0023a46b8595e1736695517fd94a7a Bisecting: 39 revisions left to test after this (roughly 5 steps) [9b1b31d5d4ac7d931c3d7e0e8114ff9d4fbd0c28] Merge branch 'sfc-remove-nic_data-usage-in-common-code' testing commit 9b1b31d5d4ac7d931c3d7e0e8114ff9d4fbd0c28 with gcc (GCC) 8.1.0 kernel signature: c8315a3ec457dc06b7f074a50f6801b30ca2efad5c9db02ed3d79a5ec0b83ee5 all runs: OK # git bisect good 9b1b31d5d4ac7d931c3d7e0e8114ff9d4fbd0c28 Bisecting: 19 revisions left to test after this (roughly 4 steps) [966a5c08af1b1399fe1014f24877578e8493ffe1] dt-bindings: net: Convert UniPhier AVE4 controller to json-schema testing commit 966a5c08af1b1399fe1014f24877578e8493ffe1 with gcc (GCC) 8.1.0 kernel signature: ab75b58da1b1d5531d0e232c05f29061b5dfb05c88a4bdcab0a2fe4f6dce0786 all runs: crashed: general protection fault in put_cmsg # git bisect bad 966a5c08af1b1399fe1014f24877578e8493ffe1 Bisecting: 9 revisions left to test after this (roughly 3 steps) [c4e7a75a096c02035a102686e2569e7b0341a122] ionic: updates to ionic FW api description testing commit c4e7a75a096c02035a102686e2569e7b0341a122 with gcc (GCC) 8.1.0 kernel signature: 05407822bed66cbc7c95773580474aad79fbd2fa15095d1718553d3ff9976263 all runs: crashed: general protection fault in put_cmsg # git bisect bad c4e7a75a096c02035a102686e2569e7b0341a122 Bisecting: 4 revisions left to test after this (roughly 2 steps) [2618d530dd8b7ac0fdcb83f4c95b88f7b0d37ce6] net/scm: cleanup scm_detach_fds testing commit 2618d530dd8b7ac0fdcb83f4c95b88f7b0d37ce6 with gcc (GCC) 8.1.0 kernel signature: 8ca2250ca525f1cf5e3844dd0c9683b6c6e1f5abc4ce0763fa5700b9c2c73225 all runs: OK # git bisect good 2618d530dd8b7ac0fdcb83f4c95b88f7b0d37ce6 Bisecting: 2 revisions left to test after this (roughly 1 step) [97cf0ef9305bba857f04b914fd59e83813f1eae2] Merge branch 'improve-msg_control-kernel-vs-user-pointer-handling' testing commit 97cf0ef9305bba857f04b914fd59e83813f1eae2 with gcc (GCC) 8.1.0 kernel signature: 7b7c819eed4fa0d54e0b27494b8fd96ac5dcc0b775b264bebcb99cbeeaf1ef19 all runs: crashed: general protection fault in put_cmsg # git bisect bad 97cf0ef9305bba857f04b914fd59e83813f1eae2 Bisecting: 0 revisions left to test after this (roughly 0 steps) [1f466e1f15cf1dac7c86798d694649fc42cd868a] net: cleanly handle kernel vs user buffers for ->msg_control testing commit 1f466e1f15cf1dac7c86798d694649fc42cd868a with gcc (GCC) 8.1.0 kernel signature: 1d8d07f9c1fa496a5674274cdc0375749778a7a6254028f1bf05e1b954975e5c run #0: crashed: general protection fault in put_cmsg run #1: crashed: general protection fault in put_cmsg run #2: crashed: general protection fault in put_cmsg run #3: crashed: general protection fault in put_cmsg run #4: crashed: general protection fault in put_cmsg run #5: crashed: general protection fault in put_cmsg run #6: crashed: general protection fault in put_cmsg run #7: crashed: general protection fault in put_cmsg run #8: crashed: general protection fault in put_cmsg run #9: boot failed: can't ssh into the instance # git bisect bad 1f466e1f15cf1dac7c86798d694649fc42cd868a 1f466e1f15cf1dac7c86798d694649fc42cd868a is the first bad commit commit 1f466e1f15cf1dac7c86798d694649fc42cd868a Author: Christoph Hellwig Date: Mon May 11 13:59:13 2020 +0200 net: cleanly handle kernel vs user buffers for ->msg_control The msg_control field in struct msghdr can either contain a user pointer when used with the recvmsg system call, or a kernel pointer when used with sendmsg. To complicate things further kernel_recvmsg can stuff a kernel pointer in and then use set_fs to make the uaccess helpers accept it. Replace it with a union of a kernel pointer msg_control field, and a user pointer msg_control_user one, and allow kernel_recvmsg operate on a proper kernel pointer using a bitfield to override the normal choice of a user pointer for recvmsg. Signed-off-by: Christoph Hellwig Signed-off-by: David S. Miller include/linux/socket.h | 12 +++++++++++- net/compat.c | 5 +++-- net/core/scm.c | 49 ++++++++++++++++++++++++++++--------------------- net/ipv4/ip_sockglue.c | 3 ++- net/socket.c | 22 ++++++---------------- 5 files changed, 50 insertions(+), 41 deletions(-) culprit signature: 1d8d07f9c1fa496a5674274cdc0375749778a7a6254028f1bf05e1b954975e5c parent signature: 8ca2250ca525f1cf5e3844dd0c9683b6c6e1f5abc4ce0763fa5700b9c2c73225 revisions tested: 16, total time: 3h59m34.964803538s (build: 1h40m51.251330233s, test: 2h17m18.535068189s) first bad commit: 1f466e1f15cf1dac7c86798d694649fc42cd868a net: cleanly handle kernel vs user buffers for ->msg_control cc: ["allison@lohutok.net" "arnd@arndb.de" "axboe@kernel.dk" "davem@davemloft.net" "deepa.kernel@gmail.com" "gregkh@linuxfoundation.org" "hch@lst.de" "kuba@kernel.org" "kuznet@ms2.inr.ac.ru" "linux-kernel@vger.kernel.org" "netdev@vger.kernel.org" "tglx@linutronix.de" "yoshfuji@linux-ipv6.org"] crash: general protection fault in put_cmsg general protection fault, probably for non-canonical address 0xdffffc0004000809: 0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000020004048-0x000000002000404f] CPU: 1 PID: 8442 Comm: syz-executor.2 Not tainted 5.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:put_cmsg+0x138/0x3a0 net/core/scm.c:242 Code: 01 84 c0 74 06 0f 8e 42 02 00 00 f6 43 40 01 0f 85 f0 00 00 00 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <0f> b6 04 01 84 c0 74 08 3c 03 0f 8e 72 01 00 00 49 8d 7d 0c 41 89 RSP: 0018:ffffc90009b5f9c0 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffffc90009b5faf0 RCX: 0000000004000809 RDX: 0000000000000008 RSI: 0000000000000029 RDI: 0000000020004048 RBP: 0000000000000004 R08: ffffc90009b5fab0 R09: 1ffff9200136bf67 R10: 0000000000018ff8 R11: 0000000000000000 R12: 1ffff9200136bf3c R13: 0000000020004040 R14: 0000000000000014 R15: ffff88809ad54c98 FS: 00007f8c019c9700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000080 CR3: 00000000a2b03000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_ipv6_getsockopt.isra.5+0x1c53/0x2400 net/ipv6/ipv6_sockglue.c:1111 ipv6_getsockopt+0xed/0x1c0 net/ipv6/ipv6_sockglue.c:1396 __sys_getsockopt+0x114/0x280 net/socket.c:2172 __do_sys_getsockopt net/socket.c:2187 [inline] __se_sys_getsockopt net/socket.c:2184 [inline] __x64_sys_getsockopt+0xb5/0x150 net/socket.c:2184 do_syscall_64+0xc6/0x620 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45c829 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f8c019c8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00000000004de520 RCX: 000000000045c829 RDX: 0000000000000006 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 000000000078bf00 R08: 0000000020000040 R09: 0000000000000000 R10: 0000000020004040 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000165 R14: 00000000004c3e29 R15: 00007f8c019c96d4 Modules linked in: ---[ end trace afc7edbf8d5096bb ]--- RIP: 0010:put_cmsg+0x138/0x3a0 net/core/scm.c:242 Code: 01 84 c0 74 06 0f 8e 42 02 00 00 f6 43 40 01 0f 85 f0 00 00 00 49 8d 7d 08 48 b8 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 <0f> b6 04 01 84 c0 74 08 3c 03 0f 8e 72 01 00 00 49 8d 7d 0c 41 89 RSP: 0018:ffffc90009b5f9c0 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffffc90009b5faf0 RCX: 0000000004000809 RDX: 0000000000000008 RSI: 0000000000000029 RDI: 0000000020004048 RBP: 0000000000000004 R08: ffffc90009b5fab0 R09: 1ffff9200136bf67 R10: 0000000000018ff8 R11: 0000000000000000 R12: 1ffff9200136bf3c R13: 0000000020004040 R14: 0000000000000014 R15: ffff88809ad54c98 FS: 00007f8c019c9700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffedb7e2800 CR3: 00000000a2b03000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400