bisecting cause commit starting from 12ad143e1b803e541e48b8ba40f550250259ecdd building syzkaller on 12365b99ce83b8a58433eaedbe412dff563ef8fb testing commit 12ad143e1b803e541e48b8ba40f550250259ecdd with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: OK # git bisect start 12ad143e1b803e541e48b8ba40f550250259ecdd v5.0 Bisecting: 5337 revisions left to test after this (roughly 12 steps) [542d0e583b7b366527175b2b5fc0aad262fa33b0] Merge tag 'devprop-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 542d0e583b7b366527175b2b5fc0aad262fa33b0 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 542d0e583b7b366527175b2b5fc0aad262fa33b0 Bisecting: 2108 revisions left to test after this (roughly 11 steps) [851ca779d110f694b5d078bc4af06d3ad37169e8] Merge tag 'drm-next-2019-03-06' of git://anongit.freedesktop.org/drm/drm testing commit 851ca779d110f694b5d078bc4af06d3ad37169e8 with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read # git bisect bad 851ca779d110f694b5d078bc4af06d3ad37169e8 Bisecting: 1628 revisions left to test after this (roughly 11 steps) [1fc1cd8399ab5541a488a7e47b2f21537dd76c2d] Merge branch 'for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup testing commit 1fc1cd8399ab5541a488a7e47b2f21537dd76c2d with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read # git bisect bad 1fc1cd8399ab5541a488a7e47b2f21537dd76c2d Bisecting: 818 revisions left to test after this (roughly 10 steps) [e0f0ae838a25464179d37f355d763f9ec139fc15] iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver testing commit e0f0ae838a25464179d37f355d763f9ec139fc15 with gcc (GCC) 8.1.0 all runs: OK # git bisect good e0f0ae838a25464179d37f355d763f9ec139fc15 Bisecting: 397 revisions left to test after this (roughly 9 steps) [67e79a6dc2664a3ef85113440e60f7aaca3c7815] Merge tag 'tty-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit 67e79a6dc2664a3ef85113440e60f7aaca3c7815 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 67e79a6dc2664a3ef85113440e60f7aaca3c7815 Bisecting: 206 revisions left to test after this (roughly 8 steps) [a9913f23f39f4aa74956587a03e78b758a10c314] Merge tag 'fs_for_v5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs testing commit a9913f23f39f4aa74956587a03e78b758a10c314 with gcc (GCC) 8.1.0 all runs: OK # git bisect good a9913f23f39f4aa74956587a03e78b758a10c314 Bisecting: 114 revisions left to test after this (roughly 7 steps) [f65e25e343cfc0e6f4db9a687c4085fad268325d] btrfs: Remove unnecessary casts in btrfs_read_root_item testing commit f65e25e343cfc0e6f4db9a687c4085fad268325d with gcc (GCC) 8.1.0 all runs: OK # git bisect good f65e25e343cfc0e6f4db9a687c4085fad268325d Bisecting: 57 revisions left to test after this (roughly 6 steps) [16be1433737ee46f88da57d47f594c4fc1376538] xfs: make xfs_bmbt_to_iomap more useful testing commit 16be1433737ee46f88da57d47f594c4fc1376538 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 16be1433737ee46f88da57d47f594c4fc1376538 Bisecting: 30 revisions left to test after this (roughly 5 steps) [b1e243957e9b3ba8e820fb8583bdf18e7c737aa2] Merge tag 'for-5.1-part1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit b1e243957e9b3ba8e820fb8583bdf18e7c737aa2 with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read # git bisect bad b1e243957e9b3ba8e820fb8583bdf18e7c737aa2 Bisecting: 13 revisions left to test after this (roughly 4 steps) [0a20df7ed3349dfa3260ddee2efa919df44d0ad5] fsnotify: report FS_ISDIR flag with MOVE_SELF and DELETE_SELF events testing commit 0a20df7ed3349dfa3260ddee2efa919df44d0ad5 with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read # git bisect bad 0a20df7ed3349dfa3260ddee2efa919df44d0ad5 Bisecting: 6 revisions left to test after this (roughly 3 steps) [bb2f7b4542c7a1d023d516af37dc70bb49db0438] fanotify: open code fill_event_metadata() testing commit bb2f7b4542c7a1d023d516af37dc70bb49db0438 with gcc (GCC) 8.1.0 all runs: OK # git bisect good bb2f7b4542c7a1d023d516af37dc70bb49db0438 Bisecting: 3 revisions left to test after this (roughly 2 steps) [a8b13aa20afb69161b5123b4f1acc7ea0a03d360] fanotify: enable FAN_REPORT_FID init flag testing commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360 with gcc (GCC) 8.1.0 all runs: crashed: WARNING: bad usercopy in fanotify_read # git bisect bad a8b13aa20afb69161b5123b4f1acc7ea0a03d360 Bisecting: 0 revisions left to test after this (roughly 1 step) [5e469c830fdb5a1ebaa69b375b87f583326fd296] fanotify: copy event fid info to user testing commit 5e469c830fdb5a1ebaa69b375b87f583326fd296 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 5e469c830fdb5a1ebaa69b375b87f583326fd296 a8b13aa20afb69161b5123b4f1acc7ea0a03d360 is the first bad commit commit a8b13aa20afb69161b5123b4f1acc7ea0a03d360 Author: Amir Goldstein Date: Thu Jan 10 19:04:36 2019 +0200 fanotify: enable FAN_REPORT_FID init flag When setting up an fanotify listener, user may request to get fid information in event instead of an open file descriptor. The fid obtained with event on a watched object contains the file handle returned by name_to_handle_at(2) and fsid returned by statfs(2). Restrict FAN_REPORT_FID to class FAN_CLASS_NOTIF, because we have have no good reason to support reporting fid on permission events. When setting a mark, we need to make sure that the filesystem supports encoding file handles with name_to_handle_at(2) and that statfs(2) encodes a non-zero fsid. Cc: Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara :040000 040000 11c711eb9614731a40a178f312445fe75227f17b ffd3c8f7b5f56f7bbec6a2792e4e86309f10e9a1 M fs :040000 040000 801531bbb4dede33b243de6a05de005c7c6f8f5d 2bdc3ecc082331f5fb8e1e552c60e25274340ecf M include revisions tested: 15, total time: 3h7m11.837644267s (build: 1h18m52.210327335s, test: 1h44m34.321455742s) first bad commit: a8b13aa20afb69161b5123b4f1acc7ea0a03d360 fanotify: enable FAN_REPORT_FID init flag cc: ["amir73il@gmail.com" "jack@suse.cz" "linux-api@vger.kernel.org" "linux-fsdevel@vger.kernel.org" "linux-kernel@vger.kernel.org"] crash: WARNING: bad usercopy in fanotify_read 8021q: adding VLAN 0 to HW filter on device batadv0 hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network ------------[ cut here ]------------ Bad or missing usercopy whitelist? Kernel memory exposure attempt detected from SLAB object 'fanotify_event(17:syz0)' (offset 40, size 8)! WARNING: CPU: 0 PID: 7131 at mm/usercopy.c:83 usercopy_warn+0xee/0x110 mm/usercopy.c:78 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 7131 Comm: syz-executor.0 Not tainted 5.0.0-rc4+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x16e/0x1f6 lib/dump_stack.c:113 panic+0x2ad/0x632 kernel/panic.c:214 __warn.cold.8+0x20/0x54 kernel/panic.c:571 report_bug+0x254/0x2d0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:usercopy_warn+0xee/0x110 mm/usercopy.c:78 Code: c8 e8 26 c5 c1 ff 4c 8b 45 c0 4d 89 e9 48 89 d9 48 8b 55 c8 41 57 4c 89 e6 48 c7 c7 e0 0e 75 87 ff 75 d0 41 56 e8 43 29 95 ff <0f> 0b 48 83 c4 18 e9 44 ff ff ff 49 c7 c5 e0 0c 75 87 4d 89 ee 4d RSP: 0018:ffff8880737179b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffffffff885959bd RCX: ffffffff815a4fe0 RDX: 0000000000000000 RSI: ffffffff815a78f5 RDI: 0000000000000005 RBP: ffff888073717a08 R08: ffff888073530000 R09: ffffed1005b03ef8 R10: ffffed1005b03ef8 R11: ffff88802d81f7c7 R12: ffffffff87750ea0 R13: ffff8880241bcd40 R14: ffffffff87750d20 R15: 0000000000000008 __check_heap_object+0x89/0xb5 mm/slab.c:4434 check_heap_object mm/usercopy.c:238 [inline] __check_object_size+0x34c/0x45d mm/usercopy.c:284 check_object_size include/linux/thread_info.h:119 [inline] check_copy_size include/linux/thread_info.h:150 [inline] copy_to_user include/linux/uaccess.h:151 [inline] copy_fid_to_user fs/notify/fanotify/fanotify_user.c:230 [inline] copy_event_to_user fs/notify/fanotify/fanotify_user.c:288 [inline] fanotify_read+0xd45/0x1280 fs/notify/fanotify/fanotify_user.c:359 8021q: adding VLAN 0 to HW filter on device team0 __vfs_read+0x113/0x850 fs/read_write.c:416 vfs_read+0x17f/0x3e0 fs/read_write.c:452 ksys_read+0xe6/0x1f0 fs/read_write.c:578 __do_sys_read fs/read_write.c:588 [inline] __se_sys_read fs/read_write.c:586 [inline] __x64_sys_read+0x73/0xb0 fs/read_write.c:586 do_syscall_64+0x103/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457799 Code: 8d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fdcddbdfc88 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000000000071bf00 RCX: 0000000000457799 RDX: 000000000000006b RSI: 0000000020000000 RDI: 0000000000000004 hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network R13: 00000000006ec190 R14: 00000000004aac44 R15: 00007fdcddbe06d4 Kernel Offset: disabled Rebooting in 86400 seconds..