bisecting cause commit starting from 717478d89fe22df61a4ecf73b1adb31b5f8d1bba building syzkaller on 838e7e2cd9228583ca33c49a39aea4d863d3e36d testing commit 717478d89fe22df61a4ecf73b1adb31b5f8d1bba compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b0181f485e7854461dc1882e3643d50e6feb3311e0413c36dfb20220166845ed all runs: crashed: general protection fault in sg_alloc_append_table_from_pages testing release v5.14 testing commit 7d2a07b769330c34b4deabeed939325c77a7ec2f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8c219514f33cf5f7e995cffb6643e798eb9f0e406da2dbcbb7423680d5a3f503 all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.13 testing commit 62fb9874f5da54fdb243003b386128037319b219 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f0d89eb8f9d4c9864735171e2eb3e5feeaf7d26439e5a7bae1ef45fb8f9578ab all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.12 testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f3685dd148c0d7f62ec2c26b6ccd338a86cdce80e434ce6a225cc94922f0c2db all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 1f5c2551444cc5a9717d44acd7d59dea64de831f0ec6d140c76c393b1a8be7b9 all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6fadf1b92bad0f2eefaa047034d1044e5b34f9c1872d7811646aed5049f137a7 all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 79f11e7a8eed3e447672927cef5561c2ba920551ad72927757519c7fec1a8d58 all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3a10be75bbfb45817efdf085ef0d7bb7934a9655779dbb5140e82be0f1d7e80e all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 compiler: gcc version 8.4.1 20210217 (GCC), GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6c15458155203600f9eead46349048b82bfa958d35a9c08152de83a646393e6d all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 3ec8f747eafa1b5378a4cc37ea09f1a8798bfd8f4ee7c3e4b1f24c42b3888ba2 all runs: crashed: general protection fault in __sg_alloc_table_from_pages testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1e50721387abc6962be73a376a0e25993de05554e109369a0cf0059deb740472 all runs: OK # git bisect start 7111951b8d4973bda27ff663f2cf18b663d15b48 d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 Bisecting: 6113 revisions left to test after this (roughly 13 steps) [9f68e3655aae6d49d6ba05dd263f99f33c2567af] Merge tag 'drm-next-2020-01-30' of git://anongit.freedesktop.org/drm/drm testing commit 9f68e3655aae6d49d6ba05dd263f99f33c2567af compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 8c529cf4948de96c0df257cf7754da2e14046498260e7c408b201a74057a490f all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 9f68e3655aae6d49d6ba05dd263f99f33c2567af Bisecting: 3686 revisions left to test after this (roughly 12 steps) [fb95aae6e67c4e319a24b3eea32032d4246a5335] Merge tag 'sound-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit fb95aae6e67c4e319a24b3eea32032d4246a5335 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 281b4b322e5521308bc6930835205c64a315be9287e0e03c0e55ba1cfa771660 all runs: OK # git bisect good fb95aae6e67c4e319a24b3eea32032d4246a5335 Bisecting: 1843 revisions left to test after this (roughly 11 steps) [8815a94f27d2f30fe1216ce10c7da0f6ae69ca0f] drm/vmwgfx: move the require_exist handling together testing commit 8815a94f27d2f30fe1216ce10c7da0f6ae69ca0f compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: c8b2e374fa469437e087cc37381279832a2f5d4e84f49ce7d2c01375222f227f all runs: boot failed: general protection fault in do_mount_root # git bisect skip 8815a94f27d2f30fe1216ce10c7da0f6ae69ca0f Bisecting: 1842 revisions left to test after this (roughly 11 steps) [4872e6aa217fbb475ffa0ad7bda0d9acff543f2c] drm/vmwgfx: check master authentication in surface_ref ioctls testing commit 4872e6aa217fbb475ffa0ad7bda0d9acff543f2c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: d9f4d327b922cc76c51e7366495de021552fab604ecae3a1e7e27538a9b2ec4e all runs: boot failed: general protection fault in do_mount_root # git bisect skip 4872e6aa217fbb475ffa0ad7bda0d9acff543f2c Bisecting: 1842 revisions left to test after this (roughly 11 steps) [fa889d85551e0bd962fdefe1cc113f9ba1d04a36] Merge tag 'gpio-v5.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio testing commit fa889d85551e0bd962fdefe1cc113f9ba1d04a36 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 5da65a3e57bbaaf3996d6ecd1557fdc249d2eeb05a25276a09173787b4f2e1fb all runs: OK # git bisect good fa889d85551e0bd962fdefe1cc113f9ba1d04a36 Bisecting: 1827 revisions left to test after this (roughly 11 steps) [dd22dfa62c9cb2669ed4b181e359645108c69578] Merge branch 'linux-5.6' of git://github.com/skeggsb/linux into drm-next testing commit dd22dfa62c9cb2669ed4b181e359645108c69578 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 909e0580b6c325dac2bddb6e84ec2315edf1a96535b7837ae11cfe04d704117b all runs: boot failed: general protection fault in do_mount_root # git bisect skip dd22dfa62c9cb2669ed4b181e359645108c69578 Bisecting: 1827 revisions left to test after this (roughly 11 steps) [1d47d0bb72895e754ffbdc410314ddb9c790c6fa] fbdev: omapfb: use devm_platform_ioremap_resource() to simplify code testing commit 1d47d0bb72895e754ffbdc410314ddb9c790c6fa compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: a405756ec8891dc597831e4587bd356b5c51a4533e2c437427d54f0483e343c6 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 1d47d0bb72895e754ffbdc410314ddb9c790c6fa Bisecting: 199 revisions left to test after this (roughly 8 steps) [c1bbed668997268c9edccdc9db1bd1487d9e20b0] udmabuf: add a pointer to the miscdevice in dma-buf private data testing commit c1bbed668997268c9edccdc9db1bd1487d9e20b0 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 4b0118afcd9595f618d6ccf715d7a900b87d31bce0697269ff39a490b43ea41d all runs: OK # git bisect good c1bbed668997268c9edccdc9db1bd1487d9e20b0 Bisecting: 99 revisions left to test after this (roughly 7 steps) [14856e9efb87381ab3ff71085ae8129ee4b2607e] drm/udl: Remove udl_fb.c testing commit 14856e9efb87381ab3ff71085ae8129ee4b2607e compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: eb875572ac25ecabe35b5e1a7395e73b26e73751746a98d7f93c9571545b4885 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 14856e9efb87381ab3ff71085ae8129ee4b2607e Bisecting: 49 revisions left to test after this (roughly 6 steps) [17d5183ed559e4f5b82b78cc293f5850a289fefe] drm/panel: lvds: use drm_panel backlight support testing commit 17d5183ed559e4f5b82b78cc293f5850a289fefe compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1030bce944fdd9e6616f52608151886a42630e154b6749c791d2faf1efbf1021 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 17d5183ed559e4f5b82b78cc293f5850a289fefe Bisecting: 24 revisions left to test after this (roughly 5 steps) [cd45e30a7099e5fcbc25fcfa035fa604255afdee] drm/udl: Move log-cpp code out of udl_damage_handler() testing commit cd45e30a7099e5fcbc25fcfa035fa604255afdee compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 8f9842a0678dac470505881dd8019e328539971c28684fa82dd411821a4be557 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad cd45e30a7099e5fcbc25fcfa035fa604255afdee Bisecting: 12 revisions left to test after this (roughly 4 steps) [9623ecb07f17b009e4021990b424bf9bbc5e199c] drm/mgag200: Call mgag200_driver_{load, unload}() before registering device testing commit 9623ecb07f17b009e4021990b424bf9bbc5e199c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: db0e20773eadaef84bba73d5e02da43debc421b683e1d6e90518ee7844eefd66 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 9623ecb07f17b009e4021990b424bf9bbc5e199c Bisecting: 5 revisions left to test after this (roughly 3 steps) [1b78e72baee87796e37d3a7cab1aded03c91d820] video: fbdev: uvesafb: modify the static fb_ops directly testing commit 1b78e72baee87796e37d3a7cab1aded03c91d820 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 10bdb181f82dc03c5a5c7a626d3b0c82794b6ed67e67e47cbc67d33be2c69b89 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 1b78e72baee87796e37d3a7cab1aded03c91d820 Bisecting: 2 revisions left to test after this (roughly 2 steps) [f4e97477bece94a1e07402c899e65676153dff73] video: fbdev: atyfb: modify the static fb_ops directly testing commit f4e97477bece94a1e07402c899e65676153dff73 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 467af0516977d067b3481034e0b4575dbaf506b2eef1e6ff7f1b95dcb692ae53 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad f4e97477bece94a1e07402c899e65676153dff73 Bisecting: 1 revision left to test after this (roughly 1 step) [17a7ce203490459cff14fb1c8f9a15d65fd1c544] udmabuf: separate out creating/destroying scatter-table testing commit 17a7ce203490459cff14fb1c8f9a15d65fd1c544 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 585671cec798ad30778a2419ec56d56e0dd2e0a299d38c56c92e95b1c04928f1 all runs: OK # git bisect good 17a7ce203490459cff14fb1c8f9a15d65fd1c544 Bisecting: 0 revisions left to test after this (roughly 0 steps) [284562e1f34874e267d4f499362c3816f8f6bc3f] udmabuf: implement begin_cpu_access/end_cpu_access hooks testing commit 284562e1f34874e267d4f499362c3816f8f6bc3f compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 467af0516977d067b3481034e0b4575dbaf506b2eef1e6ff7f1b95dcb692ae53 all runs: crashed: general protection fault in __sg_alloc_table_from_pages # git bisect bad 284562e1f34874e267d4f499362c3816f8f6bc3f 284562e1f34874e267d4f499362c3816f8f6bc3f is the first bad commit commit 284562e1f34874e267d4f499362c3816f8f6bc3f Author: Gurchetan Singh Date: Mon Dec 2 17:36:27 2019 -0800 udmabuf: implement begin_cpu_access/end_cpu_access hooks With the misc device, we should end up using the result of get_arch_dma_ops(..) or dma-direct ops. This can allow us to have WC mappings in the guest after synchronization. Signed-off-by: Gurchetan Singh Link: http://patchwork.freedesktop.org/patch/msgid/20191203013627.85991-4-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann drivers/dma-buf/udmabuf.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) culprit signature: 467af0516977d067b3481034e0b4575dbaf506b2eef1e6ff7f1b95dcb692ae53 parent signature: 585671cec798ad30778a2419ec56d56e0dd2e0a299d38c56c92e95b1c04928f1 revisions tested: 27, total time: 5h17m1.485827813s (build: 2h59m10.326185826s, test: 2h14m10.137207743s) first bad commit: 284562e1f34874e267d4f499362c3816f8f6bc3f udmabuf: implement begin_cpu_access/end_cpu_access hooks recipients (to): ["dri-devel@lists.freedesktop.org" "gurchetansingh@chromium.org" "kraxel@redhat.com" "kraxel@redhat.com" "linaro-mm-sig@lists.linaro.org" "linux-media@vger.kernel.org" "sumit.semwal@linaro.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: general protection fault in __sg_alloc_table_from_pages kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 11609 Comm: syz-executor.0 Not tainted 5.4.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sg_alloc_table_from_pages lib/scatterlist.c:424 [inline] RIP: 0010:__sg_alloc_table_from_pages+0x1aa/0x670 lib/scatterlist.c:389 Code: d0 03 00 00 48 8b 5d b8 8b 7d c4 3b 7b 0c 0f 83 9a fe ff ff 48 8b 5d d0 45 8d 70 01 44 89 c1 48 8d 1c cb 48 89 d9 48 c1 e9 03 <80> 3c 01 00 0f 85 10 03 00 00 45 39 f2 4c 8b 1b 0f 86 a4 01 00 00 RSP: 0018:ffff888087167b10 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000002 RDX: 0000160000000000 RSI: ffff8880b2ffe300 RDI: 0000000000000000 RBP: ffff888087167b98 R08: 0000000000000000 R09: 00000000fffff000 R10: 0000000000000000 R11: ffff8880b2ffe31f R12: ffff8880b2ffe9c0 R13: ffff8880ac596000 R14: 0000000000000001 R15: ffff8880b2ffe9d0 FS: 00007fd8213db700(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f37032bb718 CR3: 00000000ad592000 CR4: 0000000000340ee0 Call Trace: sg_alloc_table_from_pages+0x11/0x20 lib/scatterlist.c:468 get_sg_table+0xdd/0x300 drivers/dma-buf/udmabuf.c:61 begin_cpu_udmabuf+0x1ce/0x2f0 drivers/dma-buf/udmabuf.c:121 dma_buf_begin_cpu_access+0x6f/0x100 drivers/dma-buf/dma-buf.c:996 dma_buf_ioctl+0x181/0x420 drivers/dma-buf/dma-buf.c:386 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x196/0x1150 fs/ioctl.c:696 ksys_ioctl+0x62/0x90 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:718 do_syscall_64+0x9d/0x550 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fd821ca68d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd8213db188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fd821dab0e0 RCX: 00007fd821ca68d9 RDX: 0000000020000000 RSI: 0000000040086200 RDI: 0000000000000004 RBP: 00007fd821d00cb4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffed25eb65f R14: 00007fd8213db300 R15: 0000000000022000 Modules linked in: ---[ end trace 6605fa7f4df0f805 ]--- RIP: 0010:__sg_alloc_table_from_pages lib/scatterlist.c:424 [inline] RIP: 0010:__sg_alloc_table_from_pages+0x1aa/0x670 lib/scatterlist.c:389 Code: d0 03 00 00 48 8b 5d b8 8b 7d c4 3b 7b 0c 0f 83 9a fe ff ff 48 8b 5d d0 45 8d 70 01 44 89 c1 48 8d 1c cb 48 89 d9 48 c1 e9 03 <80> 3c 01 00 0f 85 10 03 00 00 45 39 f2 4c 8b 1b 0f 86 a4 01 00 00 RSP: 0018:ffff888087167b10 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000000002 RDX: 0000160000000000 RSI: ffff8880b2ffe300 RDI: 0000000000000000 RBP: ffff888087167b98 R08: 0000000000000000 R09: 00000000fffff000 R10: 0000000000000000 R11: ffff8880b2ffe31f R12: ffff8880b2ffe9c0 R13: ffff8880ac596000 R14: 0000000000000001 R15: ffff8880b2ffe9d0 FS: 00007fd8213db700(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564452972160 CR3: 00000000ad592000 CR4: 0000000000340ee0 ---------------- Code disassembly (best guess): 0: d0 03 rolb (%rbx) 2: 00 00 add %al,(%rax) 4: 48 8b 5d b8 mov -0x48(%rbp),%rbx 8: 8b 7d c4 mov -0x3c(%rbp),%edi b: 3b 7b 0c cmp 0xc(%rbx),%edi e: 0f 83 9a fe ff ff jae 0xfffffeae 14: 48 8b 5d d0 mov -0x30(%rbp),%rbx 18: 45 8d 70 01 lea 0x1(%r8),%r14d 1c: 44 89 c1 mov %r8d,%ecx 1f: 48 8d 1c cb lea (%rbx,%rcx,8),%rbx 23: 48 89 d9 mov %rbx,%rcx 26: 48 c1 e9 03 shr $0x3,%rcx * 2a: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1) <-- trapping instruction 2e: 0f 85 10 03 00 00 jne 0x344 34: 45 39 f2 cmp %r14d,%r10d 37: 4c 8b 1b mov (%rbx),%r11 3a: 0f 86 a4 01 00 00 jbe 0x1e4