bisecting cause commit starting from a1f92694393a5a607212293cdccececdf6272253 building syzkaller on 84fe5d96c58ec30d441399e40229bab5da6297bd testing commit a1f92694393a5a607212293cdccececdf6272253 with gcc (GCC) 10.2.1 20210217 kernel signature: 218c4c60f15ef7f054f5e8b9ed28ed8286119f6c50dfb5e16a44835f6eaf7bfe all runs: crashed: KASAN: use-after-free Read in blk_mq_exit_sched testing release v5.12 testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 with gcc (GCC) 10.2.1 20210217 kernel signature: 20a3195b0c2adea39c30d2e9f830a6fa425a34f031f28cd84a5fc4bf09ce8f4d all runs: OK # git bisect start a1f92694393a5a607212293cdccececdf6272253 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 Bisecting: 10552 revisions left to test after this (roughly 13 steps) [4bc2082311311892742deb2ce04bc335f85ee27a] block/partitions/efi.c: Fix the efi_partition() kernel-doc header testing commit 4bc2082311311892742deb2ce04bc335f85ee27a with gcc (GCC) 10.2.1 20210217 kernel signature: a83cbd2c087968ba52d925921615139e0e2e20f770fd878bcb84ccb391a2819c all runs: OK # git bisect good 4bc2082311311892742deb2ce04bc335f85ee27a Bisecting: 5273 revisions left to test after this (roughly 12 steps) [d835ff6c96ae6fa1ea474b0290a46e514ab6742b] Merge tag 'leds-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds testing commit d835ff6c96ae6fa1ea474b0290a46e514ab6742b with gcc (GCC) 10.2.1 20210217 kernel signature: 4f37310e1e0e9bf5e70b4f98d8190a45c886d4ea42033ac1de0cc3211a10a9e5 run #0: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #1: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #2: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #3: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #4: crashed: WARNING in __nf_unregister_net_hook run #5: crashed: WARNING in __nf_unregister_net_hook run #6: crashed: WARNING in __nf_unregister_net_hook run #7: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #8: crashed: WARNING in __nf_unregister_net_hook run #9: crashed: WARNING in __nf_unregister_net_hook # git bisect bad d835ff6c96ae6fa1ea474b0290a46e514ab6742b Bisecting: 2639 revisions left to test after this (roughly 11 steps) [60a3647600027cbd54eb21997af3e175fbfa5592] net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support testing commit 60a3647600027cbd54eb21997af3e175fbfa5592 with gcc (GCC) 10.2.1 20210217 kernel signature: d38961c1881a150d7a7c0dfaa1cdc50d49b7cc07b23d8269b46333ec50ed6f64 run #0: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #1: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #2: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #3: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #4: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #5: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #6: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #7: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #8: crashed: WARNING in __nf_unregister_net_hook run #9: crashed: WARNING in __nf_unregister_net_hook # git bisect bad 60a3647600027cbd54eb21997af3e175fbfa5592 Bisecting: 1306 revisions left to test after this (roughly 10 steps) [c2bcb4cf021121d7c162e44b7773281891e3abc2] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit c2bcb4cf021121d7c162e44b7773281891e3abc2 with gcc (GCC) 10.2.1 20210217 kernel signature: deac67f7032982e46fe2594c1391f9faff25b5bb346ecb040960d22d25c26348 all runs: OK # git bisect good c2bcb4cf021121d7c162e44b7773281891e3abc2 Bisecting: 653 revisions left to test after this (roughly 9 steps) [fb8517f4fade44fa5e42e29ca4d6e4a7ed50b512] rtw88: 8822c: add CFO tracking testing commit fb8517f4fade44fa5e42e29ca4d6e4a7ed50b512 with gcc (GCC) 10.2.1 20210217 kernel signature: ac93fd6cf15fa3269801fc5491c8d64ab5e4ad58cf5f21dde974de99badbc70f all runs: OK # git bisect good fb8517f4fade44fa5e42e29ca4d6e4a7ed50b512 Bisecting: 326 revisions left to test after this (roughly 8 steps) [310718ba6a13a5d0d65ea1ea338ea9f9f992dacf] mt76: connac: do not run mt76_txq_schedule_all directly testing commit 310718ba6a13a5d0d65ea1ea338ea9f9f992dacf with gcc (GCC) 10.2.1 20210217 kernel signature: 454d38458c809bbb833ba1d1c0dfee42e3f51a0b1043b10cda30f7db7f14ff67 run #0: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-executor" "root@10.128.1.103:./syz-executor"] Warning: Permanently added '10.128.1.103' (ECDSA) to the list of known hosts. run #1: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@10.128.1.105:./syz-execprog"] Warning: Permanently added '10.128.1.105' (ECDSA) to the list of known hosts. run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 310718ba6a13a5d0d65ea1ea338ea9f9f992dacf Bisecting: 175 revisions left to test after this (roughly 7 steps) [47a6959fa331fe892a4fc3b48ca08e92045c6bda] netfilter: allow to turn off xtables compat layer testing commit 47a6959fa331fe892a4fc3b48ca08e92045c6bda with gcc (GCC) 10.2.1 20210217 kernel signature: 3d75c969896418dc1c49288dab74d9aa4ed446185bc8bc5b60d7c16325c5301b all runs: basic kernel testing failed: WARNING in __nf_unregister_net_hook # git bisect skip 47a6959fa331fe892a4fc3b48ca08e92045c6bda Bisecting: 175 revisions left to test after this (roughly 7 steps) [1f70dfc542e88492a3bba3017e5e286dab7d3be6] iavf: redefine the magic number for FDIR GTP-U header fields testing commit 1f70dfc542e88492a3bba3017e5e286dab7d3be6 with gcc (GCC) 10.2.1 20210217 kernel signature: be340dc9e23d93218cbfd8a69b094318b688d8073d3accd7050c0a3dec5c9557 run #0: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@10.128.0.103:./syz-execprog"] Warning: Permanently added '10.128.0.103' (ECDSA) to the list of known hosts. run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 1f70dfc542e88492a3bba3017e5e286dab7d3be6 Bisecting: 121 revisions left to test after this (roughly 7 steps) [5f6c2f536de648ac31564d8c413337ff4f7af93a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit 5f6c2f536de648ac31564d8c413337ff4f7af93a with gcc (GCC) 10.2.1 20210217 kernel signature: a35ac244dbcc65e4679e313b9ae7049d65f803c4138b5b1529813db195d543e0 all runs: OK # git bisect good 5f6c2f536de648ac31564d8c413337ff4f7af93a Bisecting: 58 revisions left to test after this (roughly 6 steps) [6876a18d3361e1893187970e1881a1d88d894d3f] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 6876a18d3361e1893187970e1881a1d88d894d3f with gcc (GCC) 10.2.1 20210217 kernel signature: eb48532d9faef0ff2375f73bf4cfb8be34347242e4704b76e7c85e7be0de8435 all runs: OK # git bisect good 6876a18d3361e1893187970e1881a1d88d894d3f Bisecting: 28 revisions left to test after this (roughly 5 steps) [d0c5d18da2da00f3bf550286426fabd01cb63bde] Merge tag 'linux-can-next-for-5.13-20210426' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next testing commit d0c5d18da2da00f3bf550286426fabd01cb63bde with gcc (GCC) 10.2.1 20210217 kernel signature: 7e8a45fd48c7b68105c9372ba2c288a2afca901cb8be659eb4adc046826b251a run #0: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #1: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #2: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #3: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #4: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #5: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #6: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #7: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #8: crashed: WARNING in __nf_unregister_net_hook run #9: crashed: WARNING in __nf_unregister_net_hook # git bisect bad d0c5d18da2da00f3bf550286426fabd01cb63bde Bisecting: 14 revisions left to test after this (roughly 4 steps) [f7163c4882e883fabdafb894176994fd2ade33e2] netfilter: remove all xt_table anchors from struct net testing commit f7163c4882e883fabdafb894176994fd2ade33e2 with gcc (GCC) 10.2.1 20210217 kernel signature: d020d0c8f63e994c21865d6989f10addd4dcda0ca47ed5eff0a03b79d6f660d0 run #0: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #1: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #2: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #3: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #4: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #5: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #6: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #7: crashed: WARNING in __nf_unregister_net_hook run #8: crashed: WARNING in __nf_unregister_net_hook run #9: crashed: WARNING in __nf_unregister_net_hook # git bisect bad f7163c4882e883fabdafb894176994fd2ade33e2 Bisecting: 7 revisions left to test after this (roughly 3 steps) [20a9df33594fe643f9cf46375a9243e3ab8ed3a6] netfilter: iptables: unregister the tables by name testing commit 20a9df33594fe643f9cf46375a9243e3ab8ed3a6 with gcc (GCC) 10.2.1 20210217 kernel signature: b56ef5774aea036d3a005a155e60f29224b5a819895d08280c504ccca103c508 all runs: OK # git bisect good 20a9df33594fe643f9cf46375a9243e3ab8ed3a6 Bisecting: 3 revisions left to test after this (roughly 2 steps) [a4aeafa28cf706f65f763026c26d83e7e8c96592] netfilter: xt_nat: pass table to hookfn testing commit a4aeafa28cf706f65f763026c26d83e7e8c96592 with gcc (GCC) 10.2.1 20210217 kernel signature: 4734469513cf429d0400cd669d84b83bade1698349e770c239cb249c3a9a8c39 all runs: OK # git bisect good a4aeafa28cf706f65f763026c26d83e7e8c96592 Bisecting: 1 revision left to test after this (roughly 1 step) [f9006acc8dfe59e25aa75729728ac57a8d84fc32] netfilter: arp_tables: pass table pointer via nf_hook_ops testing commit f9006acc8dfe59e25aa75729728ac57a8d84fc32 with gcc (GCC) 10.2.1 20210217 kernel signature: 6f4c3fc420e9d66ef0d5a77f8cd20be176d02a738d70bad3195a00ccf34c394e run #0: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #1: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #2: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #3: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #4: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #5: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #6: basic kernel testing failed: WARNING in __nf_unregister_net_hook run #7: crashed: WARNING in __nf_unregister_net_hook run #8: crashed: WARNING in __nf_unregister_net_hook run #9: crashed: WARNING in __nf_unregister_net_hook # git bisect bad f9006acc8dfe59e25aa75729728ac57a8d84fc32 Bisecting: 0 revisions left to test after this (roughly 0 steps) [ae689334225ff0e4ef112459ecd24aea932c2b00] netfilter: ip_tables: pass table pointer via nf_hook_ops testing commit ae689334225ff0e4ef112459ecd24aea932c2b00 with gcc (GCC) 10.2.1 20210217 kernel signature: aead905270ea021f2299103d5afd659ce5eca3250e318f25bbf3fdeaea490dee all runs: OK # git bisect good ae689334225ff0e4ef112459ecd24aea932c2b00 f9006acc8dfe59e25aa75729728ac57a8d84fc32 is the first bad commit commit f9006acc8dfe59e25aa75729728ac57a8d84fc32 Author: Florian Westphal Date: Wed Apr 21 09:51:08 2021 +0200 netfilter: arp_tables: pass table pointer via nf_hook_ops Same change as previous patch. Only difference: no need to handle NULL template_ops parameter, the only caller (arptable_filter) always passes non-NULL argument. This removes all remaining accesses to net->ipv4.arptable_filter. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/linux/netfilter_arp/arp_tables.h | 2 +- net/ipv4/netfilter/arp_tables.c | 43 +++++++++++++++++++++----------- net/ipv4/netfilter/arptable_filter.c | 6 ++--- 3 files changed, 32 insertions(+), 19 deletions(-) culprit signature: 6f4c3fc420e9d66ef0d5a77f8cd20be176d02a738d70bad3195a00ccf34c394e parent signature: aead905270ea021f2299103d5afd659ce5eca3250e318f25bbf3fdeaea490dee revisions tested: 18, total time: 4h46m30.002261547s (build: 2h16m31.024681004s, test: 2h27m42.707003863s) first bad commit: f9006acc8dfe59e25aa75729728ac57a8d84fc32 netfilter: arp_tables: pass table pointer via nf_hook_ops recipients (to): ["coreteam@netfilter.org" "davem@davemloft.net" "dsahern@kernel.org" "fw@strlen.de" "fw@strlen.de" "kadlec@netfilter.org" "kuba@kernel.org" "netdev@vger.kernel.org" "netfilter-devel@vger.kernel.org" "pablo@netfilter.org" "pablo@netfilter.org" "yoshfuji@linux-ipv6.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: WARNING in __nf_unregister_net_hook ------------[ cut here ]------------ hook not found, pf 3 num 0 WARNING: CPU: 1 PID: 1294 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x17a/0x560 net/netfilter/core.c:480 Modules linked in: CPU: 1 PID: 1294 Comm: kworker/u4:6 Not tainted 5.12.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__nf_unregister_net_hook+0x17a/0x560 net/netfilter/core.c:480 Code: 89 f0 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 a7 03 00 00 8b 53 1c 44 89 e6 48 c7 c7 20 bc 9e 89 4c 89 04 24 e8 fe 3a 62 01 <0f> 0b 4c 8b 04 24 e9 ba 00 00 00 48 89 ea 48 c1 e2 04 49 8d 7c 10 RSP: 0018:ffffc900053cfbf0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88814a0d8100 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: fffff52000a79f70 RBP: 0000000000000001 R08: 0000000000000001 R09: ffff8880ba11fa1b R10: ffffed1017423f43 R11: 0000000000000001 R12: 0000000000000003 R13: ffff888028b78000 R14: ffff88814a0d811c R15: ffff888028b78f60 FS: 0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f79e3821050 CR3: 0000000023258000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: nf_unregister_net_hook net/netfilter/core.c:502 [inline] nf_unregister_net_hooks+0xb1/0xf0 net/netfilter/core.c:576 ops_pre_exit_list net/core/net_namespace.c:165 [inline] cleanup_net+0x3a4/0x990 net/core/net_namespace.c:583 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275 worker_thread+0x598/0xf80 kernel/workqueue.c:2421 kthread+0x36f/0x450 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294