bisecting cause commit starting from e142723700baaa621c1b4649ec17a714a4d4a582 building syzkaller on dfd3394d42ddd333c68cf355273b312da8c65a51 testing commit e142723700baaa621c1b4649ec17a714a4d4a582 with gcc (GCC) 8.1.0 all runs: crashed: BUG: using __this_cpu_read() in preemptible code in ip6_finish_output testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: OK # git bisect start e142723700baaa621c1b4649ec17a714a4d4a582 v5.0 Bisecting: 6458 revisions left to test after this (roughly 13 steps) [39e07cb60860e3162fc377380b8a60409315681e] kcov: convert kcov.refcount to refcount_t testing commit 39e07cb60860e3162fc377380b8a60409315681e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 39e07cb60860e3162fc377380b8a60409315681e Bisecting: 3107 revisions left to test after this (roughly 12 steps) [a50243b1ddcdd766d0d17fbfeeb1a22e62fdc461] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit a50243b1ddcdd766d0d17fbfeeb1a22e62fdc461 with gcc (GCC) 8.1.0 all runs: OK # git bisect good a50243b1ddcdd766d0d17fbfeeb1a22e62fdc461 Bisecting: 1576 revisions left to test after this (roughly 11 steps) [2f194646fecaa9fd4607b670ee9ef84d9ed04566] Merge tag 'rproc-v5.1' of git://github.com/andersson/remoteproc testing commit 2f194646fecaa9fd4607b670ee9ef84d9ed04566 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2f194646fecaa9fd4607b670ee9ef84d9ed04566 Bisecting: 790 revisions left to test after this (roughly 10 steps) [070c95d457267eefecd70f5dd434740201d5083c] Merge tag 'iommu-fixes-v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu testing commit 070c95d457267eefecd70f5dd434740201d5083c with gcc (GCC) 8.1.0 all runs: OK # git bisect good 070c95d457267eefecd70f5dd434740201d5083c Bisecting: 377 revisions left to test after this (roughly 9 steps) [1a9df9e29c2afecf6e3089442d429b377279ca3c] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 1a9df9e29c2afecf6e3089442d429b377279ca3c with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1a9df9e29c2afecf6e3089442d429b377279ca3c Bisecting: 188 revisions left to test after this (roughly 8 steps) [9d685c11bf980bdd8036fb003db5a28913192f2e] net: phy: aquantia: print remote capabilities if link partner is Aquantia PHY testing commit 9d685c11bf980bdd8036fb003db5a28913192f2e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9d685c11bf980bdd8036fb003db5a28913192f2e Bisecting: 99 revisions left to test after this (roughly 7 steps) [356d71e00d278d865f8c7f68adebd6ce4698a7e2] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 356d71e00d278d865f8c7f68adebd6ce4698a7e2 with gcc (GCC) 8.1.0 all runs: basic kernel testing failed: timed out # git bisect skip 356d71e00d278d865f8c7f68adebd6ce4698a7e2 Bisecting: 99 revisions left to test after this (roughly 7 steps) [3616d08bcbb564c7765187cd45ad392e49bad73a] ipv6: Move ipv6 stubs to a separate header file testing commit 3616d08bcbb564c7765187cd45ad392e49bad73a with gcc (GCC) 8.1.0 run #0: basic kernel testing failed: timed out run #1: basic kernel testing failed: timed out run #2: basic kernel testing failed: timed out run #3: basic kernel testing failed: timed out run #4: basic kernel testing failed: timed out run #5: basic kernel testing failed: timed out run #6: basic kernel testing failed: timed out run #7: basic kernel testing failed: timed out run #8: OK run #9: OK # git bisect skip 3616d08bcbb564c7765187cd45ad392e49bad73a Bisecting: 99 revisions left to test after this (roughly 7 steps) [4d5ec89fc8d14dcdab7214a0c13a1c7321dc6ea9] net: openvswitch: Add a new action check_pkt_len testing commit 4d5ec89fc8d14dcdab7214a0c13a1c7321dc6ea9 with gcc (GCC) 8.1.0 run #0: basic kernel testing failed: timed out run #1: basic kernel testing failed: timed out run #2: basic kernel testing failed: timed out run #3: basic kernel testing failed: timed out run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 4d5ec89fc8d14dcdab7214a0c13a1c7321dc6ea9 Bisecting: 51 revisions left to test after this (roughly 6 steps) [573363a68f27c75f92b029345eed0026a2bac0c0] selftests: mlxsw: Add qos_lib.sh testing commit 573363a68f27c75f92b029345eed0026a2bac0c0 with gcc (GCC) 8.1.0 all runs: basic kernel testing failed: timed out # git bisect skip 573363a68f27c75f92b029345eed0026a2bac0c0 Bisecting: 51 revisions left to test after this (roughly 6 steps) [1392f553a4bfc1a10fd1e3a1a44e6c0acff46fbe] batman-adv: Warn about sysfs file access testing commit 1392f553a4bfc1a10fd1e3a1a44e6c0acff46fbe with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1392f553a4bfc1a10fd1e3a1a44e6c0acff46fbe Bisecting: 48 revisions left to test after this (roughly 6 steps) [8373c6c84e6748e1dd8b82c43af37572ab040233] ipv4: Define fib_get_nhs when CONFIG_IP_ROUTE_MULTIPATH is disabled testing commit 8373c6c84e6748e1dd8b82c43af37572ab040233 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8373c6c84e6748e1dd8b82c43af37572ab040233 Bisecting: 23 revisions left to test after this (roughly 5 steps) [7c33c72beff9f9cc76284995358b56deccded544] mlxsw: spectrum_acl: Remove failed_rollback dead end testing commit 7c33c72beff9f9cc76284995358b56deccded544 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7c33c72beff9f9cc76284995358b56deccded544 Bisecting: 11 revisions left to test after this (roughly 4 steps) [593cb18285c1686f2370ab8dffcdece69bf1a3b7] nfp: nsp: implement read SFF module EEPROM testing commit 593cb18285c1686f2370ab8dffcdece69bf1a3b7 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 593cb18285c1686f2370ab8dffcdece69bf1a3b7 Bisecting: 5 revisions left to test after this (roughly 3 steps) [97cdcf37b57e3f204be3000b9eab9686f38b4356] net: place xmit recursion in softnet data testing commit 97cdcf37b57e3f204be3000b9eab9686f38b4356 with gcc (GCC) 8.1.0 all runs: crashed: BUG: using __this_cpu_read() in preemptible code in ip6_finish_output # git bisect bad 97cdcf37b57e3f204be3000b9eab9686f38b4356 Bisecting: 2 revisions left to test after this (roughly 2 steps) [b6163f194c699ff75fa6aa4565b1eb8946c2c652] net: phy: improve genphy_read_status testing commit b6163f194c699ff75fa6aa4565b1eb8946c2c652 with gcc (GCC) 8.1.0 all runs: OK # git bisect good b6163f194c699ff75fa6aa4565b1eb8946c2c652 Bisecting: 1 revision left to test after this (roughly 1 step) [5869b8fadad0be948e310c456f111c4103f5fbfb] net: use rcu_dereference_protected to fetch sk_dst_cache in sk_destruct testing commit 5869b8fadad0be948e310c456f111c4103f5fbfb with gcc (GCC) 8.1.0 all runs: OK # git bisect good 5869b8fadad0be948e310c456f111c4103f5fbfb Bisecting: 0 revisions left to test after this (roughly 0 steps) [74dcb4c1a52c7c6666319a149ad4adb001f1d00b] net: phy: aquantia: add SGMII statistics testing commit 74dcb4c1a52c7c6666319a149ad4adb001f1d00b with gcc (GCC) 8.1.0 all runs: OK # git bisect good 74dcb4c1a52c7c6666319a149ad4adb001f1d00b 97cdcf37b57e3f204be3000b9eab9686f38b4356 is the first bad commit commit 97cdcf37b57e3f204be3000b9eab9686f38b4356 Author: Florian Westphal Date: Mon Apr 1 16:42:13 2019 +0200 net: place xmit recursion in softnet data This fills a hole in softnet data, so no change in structure size. Also prepares for xmit_more placement in the same spot; skb->xmit_more will be removed in followup patch. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller :040000 040000 76da6da7493a27156a0e74774236eb4eb1d66022 2a4dc6a69feb78c8f926db9c735be5a9f5e75041 M include :040000 040000 52f717771a86fc0855f31c117d0c3490dd3565e8 b157a54141f9c0cc107fc593bac07978c47686ab M net revisions tested: 20, total time: 5h12m22.795325801s (build: 1h57m3.2477149s, test: 3h9m17.201889598s) first bad commit: 97cdcf37b57e3f204be3000b9eab9686f38b4356 net: place xmit recursion in softnet data cc: ["alexander.h.duyck@intel.com" "amritha.nambiar@intel.com" "ast@kernel.org" "bpf@vger.kernel.org" "daniel@iogearbox.net" "davem@davemloft.net" "ecree@solarflare.com" "fw@strlen.de" "idosch@mellanox.com" "jiri@mellanox.com" "kafai@fb.com" "linux-kernel@vger.kernel.org" "lirongqing@baidu.com" "netdev@vger.kernel.org" "petrm@mellanox.com" "sd@queasysnail.net" "songliubraving@fb.com" "yhs@fb.com"] crash: BUG: using __this_cpu_read() in preemptible code in ip6_finish_output check_preemption_disabled: 8 callbacks suppressed BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/7214 caller is dev_recursion_level include/linux/netdevice.h:3052 [inline] caller is ip6_skb_dst_mtu include/net/ip6_route.h:245 [inline] caller is ip6_finish_output+0x28b/0xb20 net/ipv6/ip6_output.c:149 CPU: 0 PID: 7214 Comm: syz-executor.2 Not tainted 5.1.0-rc2+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 __this_cpu_preempt_check+0x1d2/0x200 lib/smp_processor_id.c:47 dev_recursion_level include/linux/netdevice.h:3052 [inline] ip6_skb_dst_mtu include/net/ip6_route.h:245 [inline] ip6_finish_output+0x28b/0xb20 net/ipv6/ip6_output.c:149 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x1bf/0x630 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:433 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ip6_xmit+0xc22/0x1f30 net/ipv6/ip6_output.c:275 inet6_csk_xmit+0x256/0x450 net/ipv6/inet6_connection_sock.c:139 __tcp_transmit_skb+0x176e/0x3690 net/ipv4/tcp_output.c:1155 tcp_transmit_skb net/ipv4/tcp_output.c:1171 [inline] tcp_send_syn_data net/ipv4/tcp_output.c:3494 [inline] tcp_connect+0x194e/0x3fd0 net/ipv4/tcp_output.c:3533 tcp_v6_connect+0x13cd/0x1d90 net/ipv6/tcp_ipv6.c:331 __inet_stream_connect+0x66b/0xd20 net/ipv4/af_inet.c:659 tcp_sendmsg_fastopen net/ipv4/tcp.c:1155 [inline] tcp_sendmsg_locked+0x20b9/0x3bf0 net/ipv4/tcp.c:1197 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1431 inet_sendmsg+0x10d/0x460 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xb7/0xf0 net/socket.c:661 __sys_sendto+0x1f2/0x2e0 net/socket.c:1932 __do_sys_sendto net/socket.c:1944 [inline] __se_sys_sendto net/socket.c:1940 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1940 do_syscall_64+0xd6/0x4e0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4582b9 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc031b4fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004582b9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000020000380 R09: 000000000000001c R10: 0000000020000000 R11: 0000000000000246 R12: 00007fc031b506d4 R13: 00000000004c59b6 R14: 00000000004d9d10 R15: 00000000ffffffff