bisecting cause commit starting from 6417f03132a6952cd17ddd8eaddbac92b61b17e0 building syzkaller on 7216542e366bb6d7f750ca7cc7bbd11d9a386c09 testing commit 6417f03132a6952cd17ddd8eaddbac92b61b17e0 with gcc (GCC) 10.2.1 20210217 kernel signature: 1866954452439ad662f0d3fb6fd9a3f96319c06a3c375fcd596b60cb10f22dbc run #0: crashed: WARNING in kvm_wait run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: boot failed: WARNING in kvm_wait reproducer seems to be flaky testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217 kernel signature: 1b39ece6c114dcf3dc22df5b446ca8181a6e81142b68d7d80f219bc196bda5d1 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 10.2.1 20210217 kernel signature: 5a38f43f8ec2e10b6025e64d0f8e5c1205138012faed3d3588a2936288ab00bc all runs: OK # git bisect start f40ddce88593482919761f74910f42f4b84c004b 2c85ebc57b3e1817b6ce1a6b703928e113a90442 Bisecting: 7761 revisions left to test after this (roughly 13 steps) [538fcf57aaee6ad78a05f52b69a99baa22b33418] Merge branches 'acpi-scan', 'acpi-pnp' and 'acpi-sleep' testing commit 538fcf57aaee6ad78a05f52b69a99baa22b33418 with gcc (GCC) 10.2.1 20210217 kernel signature: 628cae681969f952add60b458afa27a8b6fe2a22e4cf81a37402c644a66eefa0 all runs: OK # git bisect good 538fcf57aaee6ad78a05f52b69a99baa22b33418 Bisecting: 3868 revisions left to test after this (roughly 12 steps) [d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214] Merge tag 'net-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214 with gcc (GCC) 10.2.1 20210217 kernel signature: 2cd13b2fb4a74ec7fec7bfaca7e7866a24e36ff3567a7a5fe8d878ebb94d56c2 all runs: OK # git bisect good d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214 Bisecting: 1934 revisions left to test after this (roughly 11 steps) [70b6ff35d62050d1573876cc0e1e078acd3e6008] cfg80211/mac80211: fix kernel-doc for SAR APIs testing commit 70b6ff35d62050d1573876cc0e1e078acd3e6008 with gcc (GCC) 10.2.1 20210217 kernel signature: b3431c97651b6ecae8536d88a95d370a2b59e1a6ea157aa222b44b8c9b0a1757 all runs: OK # git bisect good 70b6ff35d62050d1573876cc0e1e078acd3e6008 Bisecting: 965 revisions left to test after this (roughly 10 steps) [17b6c49da37f5d57d76bf352d32b0ac498e7c133] Merge tag 'x86_urgent_for_v5.11_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 17b6c49da37f5d57d76bf352d32b0ac498e7c133 with gcc (GCC) 10.2.1 20210217 kernel signature: 16db546551d4e0e38362ed16121aa709836efff83bbb7b4f7867bd96361fa62c run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 17b6c49da37f5d57d76bf352d32b0ac498e7c133 Bisecting: 464 revisions left to test after this (roughly 9 steps) [e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b] Merge tag 'net-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b with gcc (GCC) 10.2.1 20210217 kernel signature: 28fb3e748acca1ae4663891a47fdd1984caad69bcc7ed30bacb7fd7624bf72ed run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: crashed: unregister_netdevice: waiting for DEV to become free # git bisect bad e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b Bisecting: 241 revisions left to test after this (roughly 8 steps) [e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e] Merge tag 'char-misc-5.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e with gcc (GCC) 10.2.1 20210217 kernel signature: a29cf77fcd5b036ee6fb28e1e7a660730723e4c44e445d920a8aca01e152bad1 all runs: OK # git bisect good e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e Bisecting: 126 revisions left to test after this (roughly 7 steps) [ea49c88f4071e2bdd55e78987f251ea54aa11004] Merge tag 'mkp-scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi testing commit ea49c88f4071e2bdd55e78987f251ea54aa11004 with gcc (GCC) 10.2.1 20210217 kernel signature: 62b559d51b6358cb294ce2e82584c093e147defce4e747c297a5444629a85c41 all runs: OK # git bisect good ea49c88f4071e2bdd55e78987f251ea54aa11004 Bisecting: 63 revisions left to test after this (roughly 6 steps) [4f3786e011940d83d7a9c365730936db96a0b233] MAINTAINERS: ipvs: move Wensong Zhang to CREDITS testing commit 4f3786e011940d83d7a9c365730936db96a0b233 with gcc (GCC) 10.2.1 20210217 kernel signature: 852733ff6a6d377da3f1b05effdf7a5d354373074c07fb6c93c4fbaae6292299 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 4f3786e011940d83d7a9c365730936db96a0b233 Bisecting: 30 revisions left to test after this (roughly 5 steps) [ece9ab2a78afa1424c1aff45b1a95748dbc1f100] Merge branch 'bnxt_en-bug-fixes' testing commit ece9ab2a78afa1424c1aff45b1a95748dbc1f100 with gcc (GCC) 10.2.1 20210217 kernel signature: 9806ce08bb435eb1aacc87d9eb6d2e8a802d6e768a9cfa7c3ed97f6ea3a849a4 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad ece9ab2a78afa1424c1aff45b1a95748dbc1f100 Bisecting: 15 revisions left to test after this (roughly 4 steps) [f97844f9c518172f813b7ece18a9956b1f70c1bb] dt-bindings: net: renesas,etheravb: RZ/G2H needs tx-internal-delay-ps testing commit f97844f9c518172f813b7ece18a9956b1f70c1bb with gcc (GCC) 10.2.1 20210217 kernel signature: 8ddc5f4566081afa2c8c61bc49152269e7565f4ab3be42d078e2075799692119 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad f97844f9c518172f813b7ece18a9956b1f70c1bb Bisecting: 7 revisions left to test after this (roughly 3 steps) [c49243e8898233de18edfaaa5b7b261ea457f221] Merge branch 'net-fix-issues-around-register_netdevice-failures' testing commit c49243e8898233de18edfaaa5b7b261ea457f221 with gcc (GCC) 10.2.1 20210217 kernel signature: 5641e4968422233f8f3036d0ed048d940d62b05dd131d15951ae59c52bc30df8 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad c49243e8898233de18edfaaa5b7b261ea457f221 Bisecting: 3 revisions left to test after this (roughly 2 steps) [c1787ffd0d24eb93eefac2dbba0eac5700da9ff1] ppp: fix refcount underflow on channel unbridge testing commit c1787ffd0d24eb93eefac2dbba0eac5700da9ff1 with gcc (GCC) 10.2.1 20210217 kernel signature: 97357f1d6103e880c0e4a9da8048773833fce5761761cf2923c4cf2ee4e1aa67 all runs: OK # git bisect good c1787ffd0d24eb93eefac2dbba0eac5700da9ff1 Bisecting: 1 revision left to test after this (roughly 1 step) [c269a24ce057abfc31130960e96ab197ef6ab196] net: make free_netdev() more lenient with unregistering devices testing commit c269a24ce057abfc31130960e96ab197ef6ab196 with gcc (GCC) 10.2.1 20210217 kernel signature: 89d6d497a5b0bcf3f3785f2921c7f7e7727a4da4cc4aedc3f8e765233d372c36 all runs: OK # git bisect good c269a24ce057abfc31130960e96ab197ef6ab196 Bisecting: 0 revisions left to test after this (roughly 0 steps) [766b0515d5bec4b780750773ed3009b148df8c0a] net: make sure devices go through netdev_wait_all_refs testing commit 766b0515d5bec4b780750773ed3009b148df8c0a with gcc (GCC) 10.2.1 20210217 kernel signature: 5641e4968422233f8f3036d0ed048d940d62b05dd131d15951ae59c52bc30df8 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: crashed: unregister_netdevice: waiting for DEV to become free run #17: OK run #18: crashed: unregister_netdevice: waiting for DEV to become free run #19: OK # git bisect bad 766b0515d5bec4b780750773ed3009b148df8c0a 766b0515d5bec4b780750773ed3009b148df8c0a is the first bad commit commit 766b0515d5bec4b780750773ed3009b148df8c0a Author: Jakub Kicinski Date: Wed Jan 6 10:40:07 2021 -0800 net: make sure devices go through netdev_wait_all_refs If register_netdevice() fails at the very last stage - the notifier call - some subsystems may have already seen it and grabbed a reference. struct net_device can't be freed right away without calling netdev_wait_all_refs(). Now that we have a clean interface in form of dev->needs_free_netdev and lenient free_netdev() we can undo what commit 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.") has done and complete the unregistration path by bringing the net_set_todo() call back. After registration fails user is still expected to explicitly free the net_device, so make sure ->needs_free_netdev is cleared, otherwise rolling back the registration will cause the old double free for callers who release rtnl_lock before the free. This also solves the problem of priv_destructor not being called on notifier error. net_set_todo() will be moved back into unregister_netdevice_queue() in a follow up. Reported-by: Hulk Robot Reported-by: Yang Yingliang Signed-off-by: Jakub Kicinski net/core/dev.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) culprit signature: 5641e4968422233f8f3036d0ed048d940d62b05dd131d15951ae59c52bc30df8 parent signature: 89d6d497a5b0bcf3f3785f2921c7f7e7727a4da4cc4aedc3f8e765233d372c36 Reproducer flagged being flaky revisions tested: 17, total time: 4h27m38.194253748s (build: 1h49m11.174613612s, test: 2h36m52.080455316s) first bad commit: 766b0515d5bec4b780750773ed3009b148df8c0a net: make sure devices go through netdev_wait_all_refs recipients (to): ["davem@davemloft.net" "kuba@kernel.org" "kuba@kernel.org" "netdev@vger.kernel.org"] recipients (cc): ["andriin@fb.com" "ast@kernel.org" "linux-kernel@vger.kernel.org"] crash: unregister_netdevice: waiting for DEV to become free unregister_netdevice: waiting for sit0 to become free. Usage count = -1