bisecting cause commit starting from f49aa1de98363b6c5fba4637678d6b0ba3d18065
building syzkaller on 84b9d38467dd971812a7ce47dcaf0144e2576b6c
testing commit f49aa1de98363b6c5fba4637678d6b0ba3d18065 with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in sk_psock_unlink
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0
all runs: crashed: WARNING: ODEBUG bug in del_timer
testing release v5.0
testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0
all runs: crashed: WARNING in strp_done
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in sk_psock_unlink
run #1: crashed: KASAN: use-after-free Read in sk_psock_unlink
run #2: crashed: KASAN: use-after-free Read in sk_psock_unlink
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in psock_map_pop
run #1: crashed: KASAN: use-after-free Read in psock_map_pop
run #2: crashed: KASAN: use-after-free Read in psock_map_pop
run #3: crashed: KASAN: use-after-free Read in psock_map_pop
run #4: crashed: KASAN: use-after-free Read in psock_map_pop
run #5: crashed: KASAN: use-after-free Read in psock_map_pop
run #6: crashed: KASAN: use-after-free Read in psock_map_pop
run #7: crashed: KASAN: use-after-free Read in psock_map_pop
run #8: crashed: KASAN: use-after-free Read in psock_map_pop
run #9: OK
testing release v4.18
testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in psock_map_pop
run #1: crashed: KASAN: use-after-free Read in psock_map_pop
run #2: crashed: KASAN: use-after-free Read in psock_map_pop
run #3: crashed: KASAN: use-after-free Read in psock_map_pop
run #4: crashed: KASAN: use-after-free Read in psock_map_pop
run #5: crashed: KASAN: use-after-free Read in psock_map_pop
run #6: crashed: KASAN: use-after-free Read in psock_map_pop
run #7: crashed: KASAN: use-after-free Read in psock_map_pop
run #8: OK
run #9: crashed: KASAN: use-after-free Read in psock_map_pop
testing release v4.17
testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0
all runs: OK
# git bisect start v4.18 v4.17
Bisecting: 7032 revisions left to test after this (roughly 13 steps)
[3036bc45364f98515a2c446d7fac2c34dcfbeff4] Merge tag 'media/v4.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
testing commit 3036bc45364f98515a2c446d7fac2c34dcfbeff4 with gcc (GCC) 8.1.0
run #0: OK
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work
run #7: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work
run #8: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work
run #9: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work
# git bisect good 3036bc45364f98515a2c446d7fac2c34dcfbeff4
Bisecting: 3348 revisions left to test after this (roughly 12 steps)
[721afaa2aeb860067decdddadc84ed16f42f2048] Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
testing commit 721afaa2aeb860067decdddadc84ed16f42f2048 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 721afaa2aeb860067decdddadc84ed16f42f2048
Bisecting: 1674 revisions left to test after this (roughly 11 steps)
[7b72717a20bba8bdd01b14c0460be7d15061cd6b] iw_cxgb4: correctly enforce the max reg_mr depth
testing commit 7b72717a20bba8bdd01b14c0460be7d15061cd6b with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 7b72717a20bba8bdd01b14c0460be7d15061cd6b
Bisecting: 837 revisions left to test after this (roughly 10 steps)
[47f7dc4b845a9fe60c53b84b8c88cf14efd0de7f] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
testing commit 47f7dc4b845a9fe60c53b84b8c88cf14efd0de7f with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in psock_map_pop
run #1: crashed: KASAN: use-after-free Read in psock_map_pop
run #2: crashed: KASAN: use-after-free Read in psock_map_pop
run #3: crashed: KASAN: use-after-free Read in psock_map_pop
run #4: crashed: KASAN: use-after-free Read in psock_map_pop
run #5: crashed: KASAN: use-after-free Read in psock_map_pop
run #6: crashed: KASAN: use-after-free Read in psock_map_pop
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 47f7dc4b845a9fe60c53b84b8c88cf14efd0de7f
Bisecting: 414 revisions left to test after this (roughly 9 steps)
[4e33d7d47943aaa84a5904472cf2f9c6d6b0a6ca] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
testing commit 4e33d7d47943aaa84a5904472cf2f9c6d6b0a6ca with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Read in psock_map_pop
run #1: crashed: KASAN: use-after-free Read in psock_map_pop
run #2: crashed: KASAN: use-after-free Read in psock_map_pop
run #3: crashed: KASAN: use-after-free Read in psock_map_pop
run #4: crashed: KASAN: use-after-free Read in psock_map_pop
run #5: crashed: KASAN: use-after-free Read in psock_map_pop
run #6: crashed: KASAN: use-after-free Read in psock_map_pop
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 4e33d7d47943aaa84a5904472cf2f9c6d6b0a6ca
Bisecting: 202 revisions left to test after this (roughly 8 steps)
[d7d5388679312b7a7b6377e38e2b8fb06a82d84e] Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
testing commit d7d5388679312b7a7b6377e38e2b8fb06a82d84e with gcc (GCC) 8.1.0
run #0: crashed: WARNING: ODEBUG bug in sock_hash_free
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad d7d5388679312b7a7b6377e38e2b8fb06a82d84e
Bisecting: 114 revisions left to test after this (roughly 7 steps)
[ea5f39f2f994e6fb8cb8d0304aa5f422ae3bbf83] Merge branch 'akpm' (patches from Andrew)
testing commit ea5f39f2f994e6fb8cb8d0304aa5f422ae3bbf83 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good ea5f39f2f994e6fb8cb8d0304aa5f422ae3bbf83
Bisecting: 59 revisions left to test after this (roughly 6 steps)
[48a3c64b4649b5b23a4ca756af93b4ee820ff883] Merge tag 'drm-fixes-2018-06-29' of git://anongit.freedesktop.org/drm/drm
testing commit 48a3c64b4649b5b23a4ca756af93b4ee820ff883 with gcc (GCC) 8.1.0
run #0: crashed: general protection fault in bpf_tcp_close
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 48a3c64b4649b5b23a4ca756af93b4ee820ff883
Bisecting: 26 revisions left to test after this (roughly 5 steps)
[90368a37fbbe76056db2b703c08903939a2a18dc] Merge tag 'printk-for-4.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
testing commit 90368a37fbbe76056db2b703c08903939a2a18dc with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 90368a37fbbe76056db2b703c08903939a2a18dc
Bisecting: 12 revisions left to test after this (roughly 4 steps)
[2d8aa4ef6aac566617052640e9bb07ecb9c45183] Merge tag 'drm-misc-fixes-2018-06-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
testing commit 2d8aa4ef6aac566617052640e9bb07ecb9c45183 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 2d8aa4ef6aac566617052640e9bb07ecb9c45183
Bisecting: 6 revisions left to test after this (roughly 3 steps)
[a685557fbbc3122ed11e8ad3fa63a11ebc5de8c3] dm thin: handle running out of data space vs concurrent discard
testing commit a685557fbbc3122ed11e8ad3fa63a11ebc5de8c3 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good a685557fbbc3122ed11e8ad3fa63a11ebc5de8c3
Bisecting: 3 revisions left to test after this (roughly 2 steps)
[dbc626597c39b24cefce09fbd8e9dea85869a801] dm: prevent DAX mounts if not supported
testing commit dbc626597c39b24cefce09fbd8e9dea85869a801 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good dbc626597c39b24cefce09fbd8e9dea85869a801
Bisecting: 1 revision left to test after this (roughly 1 step)
[2cd3ae2129736f9019130064d09713a375870941] aio: mark __aio_sigset::sigmask const
testing commit 2cd3ae2129736f9019130064d09713a375870941 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 2cd3ae2129736f9019130064d09713a375870941
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[ff23908bb78bbc0999ff35e6f319f1648c4ded93] Merge tag 'for-4.18/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
testing commit ff23908bb78bbc0999ff35e6f319f1648c4ded93 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good ff23908bb78bbc0999ff35e6f319f1648c4ded93
48a3c64b4649b5b23a4ca756af93b4ee820ff883 is the first bad commit
revisions tested: 21, total time: 7h3m45.206498817s (build: 3h16m27.510908739s, test: 3h36m24.417474603s)
first bad commit: 48a3c64b4649b5b23a4ca756af93b4ee820ff883 Merge tag 'drm-fixes-2018-06-29' of git://anongit.freedesktop.org/drm/drm
cc: ["torvalds@linux-foundation.org"]
crash: general protection fault in bpf_tcp_close
IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 12454 Comm: syz-executor.5 Not tainted 4.18.0-rc2+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__write_once_size include/linux/compiler.h:215 [inline]
RIP: 0010:__hlist_del include/linux/list.h:649 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:440 [inline]
RIP: 0010:bpf_tcp_close+0x58e/0xbb0 kernel/bpf/sockmap.c:271
Code: 85 5d 04 00 00 4c 8d 48 18 48 8b 48 10 4c 89 ce 48 c1 ee 03 42 80 3c 3e 00 0f 85 1e 04 00 00 48 8b 70 18 48 89 f7 48 c1 ef 03 <42> 80 3c 3f 00 0f 85 66 04 00 00 48 85 c9 48 89 0e 74 1a 48 8d 79 
RSP: 0018:ffff88009bf0fcd0 EFLAGS: 00010a02
RAX: ffff880092c88800 RBX: ffff8800854d9c00 RCX: 0000000000000000
RDX: 1ffff10010a9b380 RSI: dead000000000200 RDI: 1bd5a00000000040
RBP: ffff88009bf0fd48 R08: ffffed0014b0ae2d R09: ffff880092c88818
R10: ffffed0014b0ae2c R11: ffff8800a5857163 R12: ffff8800866286e0
R13: 0000000000000000 R14: ffff8800854d9c18 R15: dffffc0000000000
FS:  0000000002234940(0000) GS:ffff8800aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000075c000 CR3: 000000008d25f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 inet_release+0xd9/0x1c0 net/ipv4/af_inet.c:427
 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:459
 __sock_release+0xc2/0x230 net/socket.c:599
 sock_close+0x10/0x20 net/socket.c:1150
 __fput+0x232/0x780 fs/file_table.c:209
 ____fput+0x9/0x10 fs/file_table.c:243
 task_work_run+0x111/0x180 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:192 [inline]
 exit_to_usermode_loop+0x1a4/0x200 arch/x86/entry/common.c:166
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x407/0x4d0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x412f61
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 
RSP: 002b:00007ffc06ccfcb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000412f61
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff
R10: 00007ffc06ccfd90 R11: 0000000000000293 R12: 00000000007610a8
R13: 00000000000159f1 R14: 0000000000015a1e R15: 000000000075bf2c
Modules linked in:
---[ end trace a5b1240f8221acd7 ]---
RIP: 0010:__write_once_size include/linux/compiler.h:215 [inline]
RIP: 0010:__hlist_del include/linux/list.h:649 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:440 [inline]
RIP: 0010:bpf_tcp_close+0x58e/0xbb0 kernel/bpf/sockmap.c:271
Code: 85 5d 04 00 00 4c 8d 48 18 48 8b 48 10 4c 89 ce 48 c1 ee 03 42 80 3c 3e 00 0f 85 1e 04 00 00 48 8b 70 18 48 89 f7 48 c1 ef 03 <42> 80 3c 3f 00 0f 85 66 04 00 00 48 85 c9 48 89 0e 74 1a 48 8d 79 
RSP: 0018:ffff88009bf0fcd0 EFLAGS: 00010a02
RAX: ffff880092c88800 RBX: ffff8800854d9c00 RCX: 0000000000000000
RDX: 1ffff10010a9b380 RSI: dead000000000200 RDI: 1bd5a00000000040
RBP: ffff88009bf0fd48 R08: ffffed0014b0ae2d R09: ffff880092c88818
R10: ffffed0014b0ae2c R11: ffff8800a5857163 R12: ffff8800866286e0
R13: 0000000000000000 R14: ffff8800854d9c18 R15: dffffc0000000000
FS:  0000000002234940(0000) GS:ffff8800aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000075c000 CR3: 000000008d25f000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400