bisecting cause commit starting from 42226c989789d8da4af1de0c31070c96726d990c building syzkaller on 744a39e220cece33e207035facce6c5ae161b775 testing commit 42226c989789d8da4af1de0c31070c96726d990c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 317593e6e3b1b9bc0598e96f3d193c0d6c0102846d37a8d3c703c36a11149a5f all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll testing release v5.17 testing commit f443e374ae131c168a065ea1748feac6b2e76613 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0c6c7392a0a88d09f47d1778214bff4df56090159087d58ee03c909145d53490 all runs: OK # git bisect start 42226c989789d8da4af1de0c31070c96726d990c f443e374ae131c168a065ea1748feac6b2e76613 Bisecting: 8311 revisions left to test after this (roughly 13 steps) [25fd2d41b505d0640bdfe67aa77c549de2d3c18a] selftests: kselftest framework: provide "finished" helper testing commit 25fd2d41b505d0640bdfe67aa77c549de2d3c18a compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: dc2713cdeebb3043e9ecf708ab60abfa93faecbafcfd05d807b556a76ddbfd30 all runs: OK # git bisect good 25fd2d41b505d0640bdfe67aa77c549de2d3c18a Bisecting: 4416 revisions left to test after this (roughly 12 steps) [ff61bc81b3feebcef4d0431a92e2e40e8d4fe8b3] Merge tag 'pinctrl-v5.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit ff61bc81b3feebcef4d0431a92e2e40e8d4fe8b3 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: bfc61b60b08f07dfe4665526e00b02fe17f7a2eab970adb4200d80f973d23032 all runs: OK # git bisect good ff61bc81b3feebcef4d0431a92e2e40e8d4fe8b3 Bisecting: 2209 revisions left to test after this (roughly 11 steps) [9a195da42feca3948d7f1ee8a689e2b9d2406fb5] perf beauty: Update copy of linux/socket.h with the kernel sources testing commit 9a195da42feca3948d7f1ee8a689e2b9d2406fb5 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a63cc2214b7ce8776f7ee0eff7e00a75dbebd7cad9e2ca77ad5fbf11bba7ffe6 all runs: OK # git bisect good 9a195da42feca3948d7f1ee8a689e2b9d2406fb5 Bisecting: 1104 revisions left to test after this (roughly 10 steps) [1c0513dec41e4d40eb21402dff397ad84ca13a44] x86/retpoline: Add ANNOTATE_NOENDBR for retpolines testing commit 1c0513dec41e4d40eb21402dff397ad84ca13a44 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3c274be04ecc5f53462e05de4164448e4d2049756299169a9db9a9707828ae12 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll # git bisect bad 1c0513dec41e4d40eb21402dff397ad84ca13a44 Bisecting: 548 revisions left to test after this (roughly 9 steps) [911b2b95168c7790ed5ea2703d804086c03088df] Merge branch 'akpm' (patches from Andrew) testing commit 911b2b95168c7790ed5ea2703d804086c03088df compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 299f6e47b1f2b829b09bf62cdc52909e5d8119aff70063adcf897c12b246a4e9 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll # git bisect bad 911b2b95168c7790ed5ea2703d804086c03088df Bisecting: 278 revisions left to test after this (roughly 8 steps) [5dee87215b2c539e7b82704d56f610a4e558b9cc] Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm testing commit 5dee87215b2c539e7b82704d56f610a4e558b9cc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 21a7ec4b4ae61de0b9e3f81c2905376386c5c664f877067be9992efda8e4b80b all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll # git bisect bad 5dee87215b2c539e7b82704d56f610a4e558b9cc Bisecting: 141 revisions left to test after this (roughly 7 steps) [3b1509f275ce13865c28ce254c36dc7c915808eb] Merge tag 'for-5.18/io_uring-2022-04-01' of git://git.kernel.dk/linux-block testing commit 3b1509f275ce13865c28ce254c36dc7c915808eb compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a0b5f9cdd2a17d9126270f5e348c7b109b5282239765aea0c4321471adae70ed all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll # git bisect bad 3b1509f275ce13865c28ce254c36dc7c915808eb Bisecting: 65 revisions left to test after this (roughly 6 steps) [5a3fe95d76999980a106f661bf70379818a77701] Merge tag 'xarray-5.18' of git://git.infradead.org/users/willy/xarray testing commit 5a3fe95d76999980a106f661bf70379818a77701 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 102a87e72d83805740ae8323ceaa3ceba4aa4d1fede63006900ad817df9c5f2d all runs: OK # git bisect good 5a3fe95d76999980a106f661bf70379818a77701 Bisecting: 31 revisions left to test after this (roughly 5 steps) [9a005bea4f59b603c413ac1df19cda37aa3aa486] Merge tag '5.18-smb3-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 testing commit 9a005bea4f59b603c413ac1df19cda37aa3aa486 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4a9e73ca840bb8880e68ac5a1758c71adf63884b20e33936423b30efeeb0417e run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: exit status NUM run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 9a005bea4f59b603c413ac1df19cda37aa3aa486 Bisecting: 15 revisions left to test after this (roughly 4 steps) [8197b053a83335dd1b7eb7581a933924e25c1025] io_uring: fix put_kbuf without proper locking testing commit 8197b053a83335dd1b7eb7581a933924e25c1025 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 22583861340c335cf4444a992c30a3985a006bd54d026d1eef7fb3be0e96e194 all runs: OK # git bisect good 8197b053a83335dd1b7eb7581a933924e25c1025 Bisecting: 8 revisions left to test after this (roughly 3 steps) [7a3ecddc571cc3294e5d6bb5948ff2b0cfa12735] Merge tag '5.18-rc-ksmbd-server-fixes' of git://git.samba.org/ksmbd testing commit 7a3ecddc571cc3294e5d6bb5948ff2b0cfa12735 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 663e9f1ebedb644c718bd976eb7f0a06395a2f976f7172dd0a9cb547e116fb57 all runs: OK # git bisect good 7a3ecddc571cc3294e5d6bb5948ff2b0cfa12735 Bisecting: 4 revisions left to test after this (roughly 2 steps) [5291984004edfcc7510024e52eaed044573b79c7] dm: fix bio polling to handle possibile BLK_STS_AGAIN testing commit 5291984004edfcc7510024e52eaed044573b79c7 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 14fe5f501a480c3d24c4bc897b7275a5766b681e9261a968e688bf49dd4ac284 all runs: OK # git bisect good 5291984004edfcc7510024e52eaed044573b79c7 Bisecting: 2 revisions left to test after this (roughly 1 step) [9666d4206e9a14ff612e374b6b572b3efc797d46] io_uring: fail links if msg-ring doesn't succeeed testing commit 9666d4206e9a14ff612e374b6b572b3efc797d46 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 36986ef0597c9c656c6528df21be53de92d27375e694775c7d60774402ea4714 all runs: OK # git bisect good 9666d4206e9a14ff612e374b6b572b3efc797d46 Bisecting: 1 revision left to test after this (roughly 1 step) [3f1d52abf098c85b177b8c6f5b310e8347d1bc42] io_uring: defer msg-ring file validity check until command issue testing commit 3f1d52abf098c85b177b8c6f5b310e8347d1bc42 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: db05b9d2569b380f5aad64174ca159fb84e29fd6d8cbbceb35f4fe839c080335 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll # git bisect bad 3f1d52abf098c85b177b8c6f5b310e8347d1bc42 3f1d52abf098c85b177b8c6f5b310e8347d1bc42 is the first bad commit commit 3f1d52abf098c85b177b8c6f5b310e8347d1bc42 Author: Jens Axboe Date: Tue Mar 29 10:43:56 2022 -0600 io_uring: defer msg-ring file validity check until command issue In preparation for not using the file at prep time, defer checking if this file refers to a valid io_uring instance until issue time. Signed-off-by: Jens Axboe fs/io_uring.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) culprit signature: db05b9d2569b380f5aad64174ca159fb84e29fd6d8cbbceb35f4fe839c080335 parent signature: 36986ef0597c9c656c6528df21be53de92d27375e694775c7d60774402ea4714 revisions tested: 16, total time: 3h20m19.757341349s (build: 1h37m17.074030902s, test: 1h41m26.162648684s) first bad commit: 3f1d52abf098c85b177b8c6f5b310e8347d1bc42 io_uring: defer msg-ring file validity check until command issue recipients (to): ["axboe@kernel.dk" "axboe@kernel.dk" "io-uring@vger.kernel.org"] recipients (cc): ["asml.silence@gmail.com" "linux-kernel@vger.kernel.org"] crash: BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 1b4c4067 P4D 1b4c4067 PUD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 4082 Comm: syz-executor.0 Not tainted 5.17.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc900029bf8d8 EFLAGS: 00010246 RAX: ffffffff88f936e0 RBX: dffffc0000000000 RCX: 0000000000000003 RDX: 0000000000000003 RSI: ffffc900029bf950 RDI: ffff88801cb128c0 RBP: ffff88801cb12901 R08: 0000000000000000 R09: ffffc900029bf927 R10: fffff52000537f24 R11: 0000000000000001 R12: ffff88801cb12938 R13: 0000000000000003 R14: ffff88801cb128c0 R15: ffffc900029bf950 FS: 0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000178ff000 CR4: 0000000000350ef0 Call Trace: io_do_iopoll+0x219/0xe80 fs/io_uring.c:2819 io_iopoll_try_reap_events+0x97/0x107 fs/io_uring.c:2873 io_ring_ctx_wait_and_kill+0x166/0x2b4 fs/io_uring.c:10357 io_uring_release+0x3d/0x41 fs/io_uring.c:10374 __fput+0x204/0x8d0 fs/file_table.c:317 task_work_run+0xc0/0x160 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0x9ab/0x2500 kernel/exit.c:806 do_group_exit+0xb2/0x2a0 kernel/exit.c:935 get_signal+0x376/0x2130 kernel/signal.c:2863 arch_do_signal_or_restart+0x2b2/0x1720 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0x80 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fbb3f7690e9 Code: Unable to access opcode bytes at RIP 0x7fbb3f7690bf. RSP: 002b:00007fbb3eede218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fbb3f87bf68 RCX: 00007fbb3f7690e9 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbb3f87bf6c RBP: 00007fbb3f87bf60 R08: 00007ffc44bed080 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007fbb3f87bf6c R13: 00007ffc44bde94f R14: 00007fbb3eede300 R15: 0000000000022000 Modules linked in: CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 0018:ffffc900029bf8d8 EFLAGS: 00010246 RAX: ffffffff88f936e0 RBX: dffffc0000000000 RCX: 0000000000000003 RDX: 0000000000000003 RSI: ffffc900029bf950 RDI: ffff88801cb128c0 RBP: ffff88801cb12901 R08: 0000000000000000 R09: ffffc900029bf927 R10: fffff52000537f24 R11: 0000000000000001 R12: ffff88801cb12938 R13: 0000000000000003 R14: ffff88801cb128c0 R15: ffffc900029bf950 FS: 0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000000178ff000 CR4: 0000000000350ef0