bisecting fixing commit since 330f4c53d3c2d8b11d86ec03a964b86dc81452f5 building syzkaller on 9e8eaa75a18a5cf8102e862be692c0781759e51b testing commit 330f4c53d3c2d8b11d86ec03a964b86dc81452f5 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: edf32025a99ccae71fc3c15bbd4632a27ad214998938b54d0d6d3e1d98b51faf all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup testing current HEAD 6bfb56e93bcef41859c2d5ab234ffd80b691be35 testing commit 6bfb56e93bcef41859c2d5ab234ffd80b691be35 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f7adb7de86911e800f842ba690c23c43f88ab9e17ec9d234408c5b6eef015c24 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: boot failed: INFO: task hung in add_early_randomness run #6: boot failed: INFO: task hung in add_early_randomness run #7: boot failed: INFO: task hung in add_early_randomness run #8: boot failed: INFO: task hung in add_early_randomness run #9: boot failed: INFO: task hung in add_early_randomness # git bisect start 6bfb56e93bcef41859c2d5ab234ffd80b691be35 330f4c53d3c2d8b11d86ec03a964b86dc81452f5 Bisecting: 15239 revisions left to test after this (roughly 14 steps) [59f0c2447e2553b0918b4a9fd38763a5c0587d02] Merge tag 'net-5.18-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 59f0c2447e2553b0918b4a9fd38763a5c0587d02 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4a96d938d655a23a758b582e29b3ab90025bade799bbeb2ce63160456745e491 all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good 59f0c2447e2553b0918b4a9fd38763a5c0587d02 Bisecting: 7054 revisions left to test after this (roughly 13 steps) [2518f226c60d8e04d18ba4295500a5b0b8ac7659] Merge tag 'drm-next-2022-05-25' of git://anongit.freedesktop.org/drm/drm testing commit 2518f226c60d8e04d18ba4295500a5b0b8ac7659 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9bd762f8769e83e8b30949ae4e63cc07de751a302a717935412049a27b408ada all runs: OK # git bisect bad 2518f226c60d8e04d18ba4295500a5b0b8ac7659 Bisecting: 4076 revisions left to test after this (roughly 12 steps) [88a618920e9baabc1780479e2fbb68e5551d0563] Merge tag 'docs-5.19' of git://git.lwn.net/linux testing commit 88a618920e9baabc1780479e2fbb68e5551d0563 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8568f2d935cea841f1ff9348fd59e4d5615799a15082391988aac6b8bafcf2f0 all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good 88a618920e9baabc1780479e2fbb68e5551d0563 Bisecting: 2077 revisions left to test after this (roughly 11 steps) [57d7becda9c9e612e6b00676f2eecfac3e719e88] Merge branch 'ptp-ocp-various-updates' testing commit 57d7becda9c9e612e6b00676f2eecfac3e719e88 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 21af5427f88803eca7638177008f2d4516b322e3e9ad4bf1a49aa8dcab4a813b all runs: OK # git bisect bad 57d7becda9c9e612e6b00676f2eecfac3e719e88 Bisecting: 933 revisions left to test after this (roughly 10 steps) [f43f0cd2d9b07caf38d744701b0b54d4244da8cc] Merge tag 'wireless-next-2022-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next testing commit f43f0cd2d9b07caf38d744701b0b54d4244da8cc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 17ac0c0cd8b6702499b502d7f9f1e2ade0347632e7f882721cc181bf36438858 all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good f43f0cd2d9b07caf38d744701b0b54d4244da8cc Bisecting: 469 revisions left to test after this (roughly 9 steps) [1a6dd9996699889313327be03981716a8337656b] can: mcp251xfd: silence clang's -Wunaligned-access warning testing commit 1a6dd9996699889313327be03981716a8337656b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: dbae8bae919efca98455f0cb7702b2f423074ebef50bea37444138b90c7b0332 all runs: OK # git bisect bad 1a6dd9996699889313327be03981716a8337656b Bisecting: 231 revisions left to test after this (roughly 8 steps) [11ecf3412bdc583defd9c79584dd64ff82aa796d] net: dsa: ocelot: accept 1000base-X for VSC9959 and VSC9953 testing commit 11ecf3412bdc583defd9c79584dd64ff82aa796d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f7b98f7122e991da9fb43c09425f53c780b2974e99e2af64ddc38d37db8b4620 all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good 11ecf3412bdc583defd9c79584dd64ff82aa796d Bisecting: 115 revisions left to test after this (roughly 7 steps) [a20ea298071f46effa3aaf965bf9bb34c901db3f] sctp: read sk->sk_bound_dev_if once in sctp_rcv() testing commit a20ea298071f46effa3aaf965bf9bb34c901db3f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 52d70690e64f4fa526d06ec85bfd8382797161def03fc9cca38a9af87f39364b all runs: OK # git bisect bad a20ea298071f46effa3aaf965bf9bb34c901db3f Bisecting: 57 revisions left to test after this (roughly 6 steps) [ad04cc058d644acc6c903d8da4b8d59aa2b6335e] bnxt_en: Update firmware interface to 1.10.2.95 testing commit ad04cc058d644acc6c903d8da4b8d59aa2b6335e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 1051bf34e1aa0b2ca81209734f449fd49495568445419a2d5809cfe6e1f383aa all runs: OK # git bisect bad ad04cc058d644acc6c903d8da4b8d59aa2b6335e Bisecting: 28 revisions left to test after this (roughly 5 steps) [7e708760fc114f049df9dccb994e23d20866b310] net: mscc: ocelot: move ocelot_port_private :: chip_port to ocelot_port :: index testing commit 7e708760fc114f049df9dccb994e23d20866b310 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c89884944bca9344d898f49d43b7b51372cf498fc3e0efc437cd7f0a691abb4b run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: exit status NUM run #1: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #2: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #3: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #4: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #5: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #6: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #7: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #8: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #9: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good 7e708760fc114f049df9dccb994e23d20866b310 Bisecting: 14 revisions left to test after this (roughly 4 steps) [a19cef450bb6b1365c3bd5c82952f95b76688143] net: ethernet: Use swap() instead of open coding it testing commit a19cef450bb6b1365c3bd5c82952f95b76688143 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3d29b5e0a3c1ea78ef95c62402eddb8c124e627341d9adb157ffbdd527030163 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #2: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #3: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #4: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #5: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #6: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #7: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #8: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup run #9: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good a19cef450bb6b1365c3bd5c82952f95b76688143 Bisecting: 7 revisions left to test after this (roughly 3 steps) [1ce8b37241ed291af56f7a49bbdbf20c08728e88] usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling testing commit 1ce8b37241ed291af56f7a49bbdbf20c08728e88 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 04db24acc93506011d0af9910596ba5a246643b4c043e188b9d563598b3b51b2 all runs: OK # git bisect bad 1ce8b37241ed291af56f7a49bbdbf20c08728e88 Bisecting: 3 revisions left to test after this (roughly 2 steps) [d1408f6b4dd78fb1b9e26bcf64477984e5f85409] usbnet: Run unregister_netdev() before unbind() again testing commit d1408f6b4dd78fb1b9e26bcf64477984e5f85409 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fa906f1b8dd852cab41fa9ff06dd09f05675063a5e3725daa7761c18038be506 all runs: OK # git bisect bad d1408f6b4dd78fb1b9e26bcf64477984e5f85409 Bisecting: 0 revisions left to test after this (roughly 1 step) [7b8b82224c26863d9b6c67f6cc6044bc24044e44] net: ethernet: fix platform_no_drv_owner.cocci warning testing commit 7b8b82224c26863d9b6c67f6cc6044bc24044e44 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a8bd45e2010e8e9bdad346420713e8bbacaa4515e6c565735502e31b7e74ede0 all runs: crashed: KASAN: use-after-free Read in cdc_ncm_tx_fixup # git bisect good 7b8b82224c26863d9b6c67f6cc6044bc24044e44 d1408f6b4dd78fb1b9e26bcf64477984e5f85409 is the first bad commit commit d1408f6b4dd78fb1b9e26bcf64477984e5f85409 Author: Lukas Wunner Date: Thu May 12 10:42:01 2022 +0200 usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop(). Tested-by: Oleksij Rempel # LAN9514/9512/9500 Tested-by: Ferry Toth # LAN9514 Signed-off-by: Lukas Wunner Acked-by: Oliver Neukum Cc: Martyn Welch Cc: Andrew Lunn Signed-off-by: David S. Miller drivers/net/usb/asix_devices.c | 6 +----- drivers/net/usb/smsc95xx.c | 3 +-- drivers/net/usb/usbnet.c | 6 +++--- 3 files changed, 5 insertions(+), 10 deletions(-) culprit signature: fa906f1b8dd852cab41fa9ff06dd09f05675063a5e3725daa7761c18038be506 parent signature: a8bd45e2010e8e9bdad346420713e8bbacaa4515e6c565735502e31b7e74ede0 revisions tested: 16, total time: 3h18m10.858149186s (build: 1h42m8.447187247s, test: 1h34m22.718256602s) first good commit: d1408f6b4dd78fb1b9e26bcf64477984e5f85409 usbnet: Run unregister_netdev() before unbind() again recipients (to): ["davem@davemloft.net" "lukas@wunner.de" "oneukum@suse.com"] recipients (cc): []