bisecting cause commit starting from 037904a22bf8b2c999a6e2a8ba971b549c1e9600 building syzkaller on b617407b25b37a7a8efa47127005d1f20dd0abe1 testing commit 037904a22bf8b2c999a6e2a8ba971b549c1e9600 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 all runs: OK # git bisect start v4.14 v4.13 Bisecting: 7300 revisions left to test after this (roughly 13 steps) [15d8ffc96464f6571ecf22043c45fad659f11bdd] Merge tag 'mmc-v4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc testing commit 15d8ffc96464f6571ecf22043c45fad659f11bdd with gcc (GCC) 8.1.0 run #0: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.27:./syz-executor"]: exit status 1 Connection timed out during banner exchange lost connection run #1: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.29:./syz-executor"]: exit status 1 ssh: connect to host 10.128.0.29 port 22: Connection timed out lost connection run #2: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.67:./syz-executor"]: exit status 1 ssh: connect to host 10.128.0.67 port 22: Connection timed out lost connection run #3: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.17:./syz-executor"]: exit status 1 ssh: connect to host 10.128.0.17 port 22: Connection timed out lost connection run #4: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.49:./syz-executor"]: exit status 1 ssh: connect to host 10.128.0.49 port 22: Connection timed out lost connection run #5: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.23:./syz-executor"] run #6: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@10.128.0.43:./syz-execprog"] Warning: Permanently added '10.128.0.43' (ECDSA) to the list of known hosts. run #7: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.75:./syz-executor"] Warning: Permanently added '10.128.0.75' (ECDSA) to the list of known hosts. run #8: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.0.15:./syz-executor"] Warning: Permanently added '10.128.0.15' (ECDSA) to the list of known hosts. run #9: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@10.128.0.8:./syz-execprog"] Warning: Permanently added '10.128.0.8' (ECDSA) to the list of known hosts. # git bisect skip 15d8ffc96464f6571ecf22043c45fad659f11bdd Bisecting: 7300 revisions left to test after this (roughly 13 steps) [ace743214ea205c7d433562c5fa24e33bdfda7ab] net/mlx5e: Fix erroneous freeing of encap header buffer testing commit ace743214ea205c7d433562c5fa24e33bdfda7ab with gcc (GCC) 8.1.0 all runs: OK # git bisect good ace743214ea205c7d433562c5fa24e33bdfda7ab Bisecting: 976 revisions left to test after this (roughly 10 steps) [8d5f4b07174976c55a5f5d6967777373c6826944] stmmac: Don't access tx_q->dirty_tx before netif_tx_lock testing commit 8d5f4b07174976c55a5f5d6967777373c6826944 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8d5f4b07174976c55a5f5d6967777373c6826944 Bisecting: 488 revisions left to test after this (roughly 9 steps) [567825502730b6bc108f926bdb1cf2de7ae436ca] Merge tag 'pm-4.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 567825502730b6bc108f926bdb1cf2de7ae436ca with gcc (GCC) 8.1.0 all runs: OK # git bisect good 567825502730b6bc108f926bdb1cf2de7ae436ca Bisecting: 243 revisions left to test after this (roughly 8 steps) [33974a414ce2324554f75dbd204ff0868f499e32] perf trace: Call machine__exit() at exit testing commit 33974a414ce2324554f75dbd204ff0868f499e32 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename # git bisect bad 33974a414ce2324554f75dbd204ff0868f499e32 Bisecting: 85 revisions left to test after this (roughly 7 steps) [19e12196da601f7b80b5639adbcecf60fae13389] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 19e12196da601f7b80b5639adbcecf60fae13389 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename # git bisect bad 19e12196da601f7b80b5639adbcecf60fae13389 Bisecting: 78 revisions left to test after this (roughly 6 steps) [31c2611b66e01378b54f7ef641cb0d23fcd8502f] selftests: Introduce a new test case to tc testsuite testing commit 31c2611b66e01378b54f7ef641cb0d23fcd8502f with gcc (GCC) 8.1.0 all runs: OK # git bisect good 31c2611b66e01378b54f7ef641cb0d23fcd8502f Bisecting: 43 revisions left to test after this (roughly 5 steps) [c9f27f9f85b68c565148b8243502d389351302df] Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs testing commit c9f27f9f85b68c565148b8243502d389351302df with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename # git bisect bad c9f27f9f85b68c565148b8243502d389351302df Bisecting: 16 revisions left to test after this (roughly 4 steps) [a0cb2b5c390151837b08e5f7bca4a6ecddbcd39c] Fix tracing sample code warning. testing commit a0cb2b5c390151837b08e5f7bca4a6ecddbcd39c with gcc (GCC) 8.1.0 all runs: OK # git bisect good a0cb2b5c390151837b08e5f7bca4a6ecddbcd39c Bisecting: 7 revisions left to test after this (roughly 3 steps) [11224e1fc40a6556dc285573ea93dd522f8c563f] Merge tag 'for-linus-4.14c-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip testing commit 11224e1fc40a6556dc285573ea93dd522f8c563f with gcc (GCC) 8.1.0 all runs: OK # git bisect good 11224e1fc40a6556dc285573ea93dd522f8c563f Bisecting: 3 revisions left to test after this (roughly 2 steps) [7937a56fdf0b064c2ffa33025210f725a4ebc822] ovl: handle ENOENT on index lookup testing commit 7937a56fdf0b064c2ffa33025210f725a4ebc822 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename # git bisect bad 7937a56fdf0b064c2ffa33025210f725a4ebc822 Bisecting: 1 revision left to test after this (roughly 1 step) [0ce5cdc9d79277e55c3d80bf7d2b1adea2752078] ovl: Return -ENOMEM if an allocation fails ovl_lookup() testing commit 0ce5cdc9d79277e55c3d80bf7d2b1adea2752078 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 0ce5cdc9d79277e55c3d80bf7d2b1adea2752078 Bisecting: 0 revisions left to test after this (roughly 0 steps) [6eaf011144af10cad34c0d46f82e50d382c8e926] ovl: fix EIO from lookup of non-indexed upper testing commit 6eaf011144af10cad34c0d46f82e50d382c8e926 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in ovl_rename # git bisect bad 6eaf011144af10cad34c0d46f82e50d382c8e926 6eaf011144af10cad34c0d46f82e50d382c8e926 is the first bad commit commit 6eaf011144af10cad34c0d46f82e50d382c8e926 Author: Amir Goldstein Date: Thu Oct 12 19:03:04 2017 +0300 ovl: fix EIO from lookup of non-indexed upper Commit fbaf94ee3cd5 ("ovl: don't set origin on broken lower hardlink") attempt to avoid the condition of non-indexed upper inode with lower hardlink as origin. If this condition is found, lookup returns EIO. The protection of commit mentioned above does not cover the case of lower that is not a hardlink when it is copied up (with either index=off/on) and then lower is hardlinked while overlay is offline. Changes to lower layer while overlayfs is offline should not result in unexpected behavior, so a permanent EIO error after creating a link in lower layer should not be considered as correct behavior. This fix replaces EIO error with success in cases where upper has origin but no index is found, or index is found that does not match upper inode. In those cases, lookup will not fail and the returned overlay inode will be hashed by upper inode instead of by lower origin inode. Fixes: 359f392ca53e ("ovl: lookup index entry for copy up origin") Cc: # v4.13 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi :040000 040000 c132887620e46694c0d24b34cde6e126de31f415 c86df86634cfd3a78d55b1c4c4f1cf786b8ff532 M fs revisions tested: 23, total time: 4h59m53.968374025s (build: 2h6m31.798704042s, test: 2h46m23.2435545s) first bad commit: 6eaf011144af10cad34c0d46f82e50d382c8e926 ovl: fix EIO from lookup of non-indexed upper cc: ["amir73il@gmail.com" "linux-kernel@vger.kernel.org" "linux-unionfs@vger.kernel.org" "miklos@szeredi.hu" "mszeredi@redhat.com"] crash: WARNING in ovl_rename overlayfs: workdir and upperdir must reside under the same mount overlayfs: workdir and upperdir must reside under the same mount kobject: 'loop5' (ffff8801259597e0): kobject_uevent_env kobject: 'loop5' (ffff8801259597e0): fill_kobj_path: path = '/devices/virtual/block/loop5' ------------[ cut here ]------------ WARNING: CPU: 1 PID: 15251 at fs/overlayfs/dir.c:1036 ovl_rename+0xcc9/0x1020 fs/overlayfs/dir.c:1022 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 15251 Comm: syz-executor.0 Not tainted 4.14.0-rc5+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x145/0x1e1 lib/dump_stack.c:52 panic+0x1a9/0x34e kernel/panic.c:181 __warn.cold.8+0x11a/0x156 kernel/panic.c:542 report_bug+0x1a3/0x227 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_trap_no_signal arch/x86/kernel/traps.c:212 [inline] do_trap+0x1ef/0x2d0 arch/x86/kernel/traps.c:261 do_error_trap+0x11f/0x390 arch/x86/kernel/traps.c:298 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:311 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905 RIP: 0010:ovl_rename+0xcc9/0x1020 fs/overlayfs/dir.c:1036 RSP: 0018:ffff88010ffa7a88 EFLAGS: 00010246 RAX: ffff8801198be670 RBX: ffff880119be2840 RCX: 1ffff10023654af7 RDX: dffffc0000000000 RSI: ffff88011b2a5760 RDI: ffff88011b2a57b8 RBP: ffff88010ffa7b90 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8801255481a0 R11: ffff88011b17d060 R12: ffff88011b17d000 R13: ffff880112ddb1e0 R14: 1ffff10021ff4f61 R15: 0000000000000000 vfs_rename+0xda2/0x19c0 fs/namei.c:4455 SYSC_renameat2 fs/namei.c:4603 [inline] SyS_renameat2 fs/namei.c:4492 [inline] SYSC_rename fs/namei.c:4643 [inline] SyS_rename+0x63c/0xc40 fs/namei.c:4641 entry_SYSCALL_64_fastpath+0x23/0xc2 RIP: 0033:0x458da9 RSP: 002b:00007f22a5ea4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000052 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000458da9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 00000000200000c0 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f22a5ea56d4 R13: 00000000004c4e1c R14: 00000000004d8af8 R15: 00000000ffffffff Kernel Offset: disabled Rebooting in 86400 seconds..