bisecting cause commit starting from c5eb0a61238dd6faf37f58c9ce61c9980aaffd7a building syzkaller on 8b277b8e2ac2f385eec24532a4786cc4ad12e9ae testing commit c5eb0a61238dd6faf37f58c9ce61c9980aaffd7a compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0b6b9612490b422d7da42a9329f5c061bdf63ebafe188ab85e6ec30055fdbd48 all runs: crashed: KASAN: use-after-free Read in bio_poll testing release v5.17 testing commit f443e374ae131c168a065ea1748feac6b2e76613 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b2787aa1bc6a179271f49175757e9f56c813c47627d1e1b31f076768909cc4c0 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: exit status NUM run #1: crashed: KASAN: use-after-free Read in bio_poll run #2: crashed: KASAN: use-after-free Read in bio_poll run #3: crashed: KASAN: use-after-free Read in bio_poll run #4: crashed: KASAN: use-after-free Read in bio_poll run #5: crashed: KASAN: use-after-free Read in bio_poll run #6: crashed: KASAN: use-after-free Read in bio_poll run #7: crashed: KASAN: use-after-free Read in bio_poll run #8: crashed: KASAN: use-after-free Read in bio_poll run #9: crashed: KASAN: use-after-free Read in bio_poll testing release v5.16 testing commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 96eac08028b2e3dd5c1210776630649572f5cde4886daf21a678d9d402791ec1 run #0: crashed: KASAN: use-after-free Read in bio_poll run #1: crashed: KASAN: use-after-free Read in bio_poll run #2: crashed: KASAN: use-after-free Read in bio_poll run #3: crashed: KASAN: use-after-free Read in bio_poll run #4: crashed: KASAN: use-after-free Read in bio_poll run #5: crashed: KASAN: slab-out-of-bounds Read in bio_poll run #6: crashed: KASAN: use-after-free Read in bio_poll run #7: crashed: KASAN: use-after-free Read in bio_poll run #8: crashed: KASAN: use-after-free Read in bio_poll run #9: crashed: KASAN: use-after-free Read in bio_poll testing release v5.15 testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 90e0c318d0aa3a1c9dbf6e9d951f95670c4a99366588c5f0c81985a8886fe18b all runs: OK # git bisect start df0cc57e057f18e44dac8e6c18aba47ab53202f9 8bb7eca972ad531c9b149c0a51ab43a417385813 Bisecting: 7870 revisions left to test after this (roughly 13 steps) [2219b0ceefe835b92a8a74a73fe964aa052742a2] Merge tag 'soc-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 2219b0ceefe835b92a8a74a73fe964aa052742a2 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7e8e5a58476d91b5710fb582ff43c99266290412b3c5dbbef44d0ca06eeffc54 run #0: crashed: KASAN: use-after-free Read in bio_poll run #1: crashed: KASAN: use-after-free Read in bio_poll run #2: crashed: KASAN: use-after-free Read in bio_poll run #3: crashed: KASAN: use-after-free Read in bio_poll run #4: crashed: KASAN: use-after-free Read in bio_poll run #5: crashed: KASAN: use-after-free Read in bio_poll run #6: crashed: KASAN: use-after-free Read in bio_poll run #7: crashed: KASAN: use-after-free Read in bio_poll run #8: crashed: KASAN: use-after-free Read in bio_poll run #9: crashed: general protection fault in bio_poll # git bisect bad 2219b0ceefe835b92a8a74a73fe964aa052742a2 Bisecting: 2946 revisions left to test after this (roughly 12 steps) [fc02cb2b37fe2cbf1d3334b9f0f0eab9431766c4] Merge tag 'net-next-for-5.16' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit fc02cb2b37fe2cbf1d3334b9f0f0eab9431766c4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 06d65e66365619cd8d0f194842d8e9d4b650912c338cdf0c820c762b7c3ab128 run #0: crashed: KASAN: use-after-free Read in bio_poll run #1: crashed: KASAN: use-after-free Read in bio_poll run #2: crashed: KASAN: use-after-free Read in bio_poll run #3: crashed: KASAN: use-after-free Read in bio_poll run #4: crashed: KASAN: use-after-free Read in bio_poll run #5: crashed: KASAN: use-after-free Read in bio_poll run #6: crashed: KASAN: use-after-free Read in bio_poll run #7: crashed: KASAN: use-after-free Read in bio_poll run #8: crashed: KASAN: use-after-free Read in bio_poll run #9: crashed: KASAN: global-out-of-bounds Read in bio_poll # git bisect bad fc02cb2b37fe2cbf1d3334b9f0f0eab9431766c4 Bisecting: 2251 revisions left to test after this (roughly 11 steps) [b7b98f868987cd3e86c9bd9a6db048614933d7a0] Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit b7b98f868987cd3e86c9bd9a6db048614933d7a0 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 727ce8c86fb540de710042bab41a36e1d6970d741cef54b0b5a2ca1c11f17353 all runs: OK # git bisect good b7b98f868987cd3e86c9bd9a6db048614933d7a0 Bisecting: 1127 revisions left to test after this (roughly 10 steps) [6e5772c8d9cf0a77ba4d6fd34fd4126fb66c9983] Merge tag 'x86_cc_for_v5.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 6e5772c8d9cf0a77ba4d6fd34fd4126fb66c9983 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cf09201f73d9ee80cc2fe7ba5b9304545d5960caf0cef408a3d76399f767f094 all runs: crashed: KASAN: use-after-free Read in bio_poll # git bisect bad 6e5772c8d9cf0a77ba4d6fd34fd4126fb66c9983 Bisecting: 564 revisions left to test after this (roughly 9 steps) [19901165d90fdca1e57c9baa0d5b4c63d15c476a] Merge tag 'for-5.16/inode-sync-2021-10-29' of git://git.kernel.dk/linux-block testing commit 19901165d90fdca1e57c9baa0d5b4c63d15c476a compiler: gcc (GCC) 10.2.1 20210217 ./include/linux/page-flags.h:806:29: error: macro "PAGEFLAG_FALSE" requires 2 arguments, but only 1 given ./include/linux/page-flags.h:807:32: error: macro "TESTSCFLAG_FALSE" requires 2 arguments, but only 1 given ./include/linux/page-flags.h:806:1: error: unknown type name 'PAGEFLAG_FALSE' ./include/linux/page-flags.h:807:18: error: expected ';' before 'static' # git bisect skip 19901165d90fdca1e57c9baa0d5b4c63d15c476a Bisecting: 564 revisions left to test after this (roughly 9 steps) [cf2197ca4b8c199d188593ca6800ea1827c42171] bcache: move uapi header bcache.h to bcache code directory testing commit cf2197ca4b8c199d188593ca6800ea1827c42171 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6b9f1bdc25e0b74729f5a611e98480c07ea0a8754644d3d8fa250a52efd96354 all runs: boot failed: general protection fault in blk_mq_free_request # git bisect skip cf2197ca4b8c199d188593ca6800ea1827c42171 Bisecting: 564 revisions left to test after this (roughly 9 steps) [3caee4634be68e755d2fb130962f1623661dbd5b] block: use bdev_get_queue() in bio.c testing commit 3caee4634be68e755d2fb130962f1623661dbd5b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 29f7be996912673e662555dc486fc1c9134849e5a804628df877768cb8cdc0ae run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: failed to write control pipe: write |NUM: broken pipe run #1: crashed: KASAN: use-after-free Read in bio_poll run #2: crashed: KASAN: use-after-free Read in bio_poll run #3: crashed: KASAN: use-after-free Read in bio_poll run #4: crashed: KASAN: use-after-free Read in bio_poll run #5: crashed: KASAN: use-after-free Read in bio_poll run #6: crashed: KASAN: use-after-free Read in bio_poll run #7: crashed: KASAN: use-after-free Read in bio_poll run #8: crashed: KASAN: use-after-free Read in bio_poll run #9: crashed: KASAN: use-after-free Read in bio_poll # git bisect bad 3caee4634be68e755d2fb130962f1623661dbd5b Bisecting: 43 revisions left to test after this (roughly 6 steps) [0f38d76646157357fcfa02f50575ea044830c494] blk-mq: cleanup blk_mq_submit_bio testing commit 0f38d76646157357fcfa02f50575ea044830c494 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b518c985bd1c28dfc5a150feb3ccaf782df40592f0a271413e97712e04cb95c4 run #0: crashed: general protection fault in hctx_lock run #1: crashed: general protection fault in hctx_lock run #2: crashed: general protection fault in hctx_lock run #3: boot failed: general protection fault in hctx_lock run #4: boot failed: general protection fault in hctx_lock run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK reproducer seems to be flaky # git bisect bad 0f38d76646157357fcfa02f50575ea044830c494 Bisecting: 20 revisions left to test after this (roughly 5 steps) [322cff70d46c6c230a722684fd65ae6b5f57436e] block/mq-deadline: Prioritize high-priority requests testing commit 322cff70d46c6c230a722684fd65ae6b5f57436e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7135c830d1bc2243f3a11a906e135c39001eb74a7840e22b2bb9380392b1d08b all runs: OK # git bisect good 322cff70d46c6c230a722684fd65ae6b5f57436e Bisecting: 9 revisions left to test after this (roughly 3 steps) [63064be150e4b1ba1e4af594ef5aa81adf21a52d] blk-mq: Add blk_mq_alloc_map_and_rqs() testing commit 63064be150e4b1ba1e4af594ef5aa81adf21a52d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 09e0224c5276ff57ee312632a57c54af799a33705b15a8eb2b871f789dd01ff9 all runs: OK # git bisect good 63064be150e4b1ba1e4af594ef5aa81adf21a52d Bisecting: 4 revisions left to test after this (roughly 2 steps) [a7b36ee6ba299ffa5c3b36af187b4d0fb32a557c] block: move blk-throtl fast path inline testing commit a7b36ee6ba299ffa5c3b36af187b4d0fb32a557c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 476c09acf8f59ad6a7969ab1286d10f199c87e2748d074ce07bb2942b747a5a5 all runs: OK # git bisect good a7b36ee6ba299ffa5c3b36af187b4d0fb32a557c Bisecting: 1 revision left to test after this (roughly 1 step) [47c122e35d7e43b14129ceb9ed3a7e67599978fa] block: pre-allocate requests if plug is started and is a batch testing commit 47c122e35d7e43b14129ceb9ed3a7e67599978fa compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9a1da44f99b9ec75bb271c7891c39aabf940823d8eb808852b78852791df6ab7 all runs: OK # git bisect good 47c122e35d7e43b14129ceb9ed3a7e67599978fa Bisecting: 0 revisions left to test after this (roughly 0 steps) [b90cfaed3789ecdc5580027fc91e3056bc6b3216] blk-mq: cleanup and rename __blk_mq_alloc_request testing commit b90cfaed3789ecdc5580027fc91e3056bc6b3216 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 81d284910c40d05bb8a88ae1bba34537193d05aa4011aca9d493f4670ac5579f all runs: OK # git bisect good b90cfaed3789ecdc5580027fc91e3056bc6b3216 0f38d76646157357fcfa02f50575ea044830c494 is the first bad commit commit 0f38d76646157357fcfa02f50575ea044830c494 Author: Christoph Hellwig Date: Tue Oct 12 12:40:45 2021 +0200 blk-mq: cleanup blk_mq_submit_bio Move the blk_mq_alloc_data stack allocation only into the branch that actually needs it, and use rq->mq_hctx instead of data.hctx to refer to the hctx. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20211012104045.658051-3-hch@lst.de Signed-off-by: Jens Axboe block/blk-mq.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) culprit signature: b518c985bd1c28dfc5a150feb3ccaf782df40592f0a271413e97712e04cb95c4 parent signature: 81d284910c40d05bb8a88ae1bba34537193d05aa4011aca9d493f4670ac5579f Reproducer flagged being flaky revisions tested: 16, total time: 3h47m0.919822641s (build: 1h39m40.722644904s, test: 2h5m7.029650148s) first bad commit: 0f38d76646157357fcfa02f50575ea044830c494 blk-mq: cleanup blk_mq_submit_bio recipients (to): ["axboe@kernel.dk" "axboe@kernel.dk" "hch@lst.de" "linux-block@vger.kernel.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: general protection fault in hctx_lock general protection fault, probably for non-canonical address 0xdffffc0000000027: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000138-0x000000000000013f] CPU: 1 PID: 2899 Comm: jbd2/sda1-8 Not tainted 5.15.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:hctx_lock+0x22/0x150 block/blk-mq.c:738 Code: 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 54 55 48 89 f5 53 48 89 fb 48 81 c7 38 01 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 19 01 00 00 f6 83 38 01 00 00 20 75 65 48 b8 00 RSP: 0018:ffffc9000c79f480 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000027 RSI: ffffc9000c79f4c0 RDI: 0000000000000138 RBP: ffffc9000c79f4c0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffed100342c8e9 R11: 0000000000000282 R12: 0000000000000001 R13: dffffc0000000000 R14: ffff88801b8c8e30 R15: 0000000000000148 FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020015000 CR3: 000000002377c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: blk_mq_run_hw_queue+0x71/0x290 block/blk-mq.c:1653 blk_mq_submit_bio+0x10a7/0x17f0 block/blk-mq.c:2289 __submit_bio+0x612/0x740 block/blk-core.c:932 __submit_bio_noacct_mq block/blk-core.c:1012 [inline] submit_bio_noacct+0x5f8/0x940 block/blk-core.c:1042 submit_bio+0xcc/0x3a0 block/blk-core.c:1104 submit_bh_wbc+0x4e9/0x6a0 fs/buffer.c:3054 journal_submit_commit_record.part.0+0x6c1/0xa00 fs/jbd2/commit.c:156 journal_submit_commit_record fs/jbd2/commit.c:128 [inline] jbd2_journal_commit_transaction+0x3f61/0x6360 fs/jbd2/commit.c:925 kjournald2+0x1b3/0x880 fs/jbd2/journal.c:213 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Modules linked in: ---[ end trace c1b12c2ef43f5412 ]--- RIP: 0010:hctx_lock+0x22/0x150 block/blk-mq.c:738 Code: 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 54 55 48 89 f5 53 48 89 fb 48 81 c7 38 01 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 19 01 00 00 f6 83 38 01 00 00 20 75 65 48 b8 00 RSP: 0018:ffffc9000c79f480 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000027 RSI: ffffc9000c79f4c0 RDI: 0000000000000138 RBP: ffffc9000c79f4c0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffed100342c8e9 R11: 0000000000000282 R12: 0000000000000001 R13: dffffc0000000000 R14: ffff88801b8c8e30 R15: 0000000000000148 FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa5871f7718 CR3: 000000007cda3000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) 7: 00 8: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax f: fc ff df 12: 41 54 push %r12 14: 55 push %rbp 15: 48 89 f5 mov %rsi,%rbp 18: 53 push %rbx 19: 48 89 fb mov %rdi,%rbx 1c: 48 81 c7 38 01 00 00 add $0x138,%rdi 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 19 01 00 00 jne 0x14d 34: f6 83 38 01 00 00 20 testb $0x20,0x138(%rbx) 3b: 75 65 jne 0xa2 3d: 48 rex.W 3e: b8 .byte 0xb8