bisecting cause commit starting from 28619527b8a712590c93d0a9e24b4425b9376a8c building syzkaller on 3c88136c8a2afbcdb1be19786c0b66837f5f7cd6 testing commit 28619527b8a712590c93d0a9e24b4425b9376a8c with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in tcp_cleanup_ulp run #1: crashed: general protection fault in tcp_cleanup_ulp run #2: crashed: general protection fault in tcp_cleanup_ulp run #3: crashed: general protection fault in tcp_cleanup_ulp run #4: crashed: general protection fault in tcp_cleanup_ulp run #5: crashed: general protection fault in tcp_cleanup_ulp run #6: OK testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: OK # git bisect start 28619527b8a712590c93d0a9e24b4425b9376a8c v4.18 Bisecting: 6486 revisions left to test after this (roughly 13 steps) [54dbe75bbf1e189982516de179147208e90b5e45] Merge tag 'drm-next-2018-08-15' of git://anongit.freedesktop.org/drm/drm testing commit 54dbe75bbf1e189982516de179147208e90b5e45 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 54dbe75bbf1e189982516de179147208e90b5e45 Bisecting: 3169 revisions left to test after this (roughly 12 steps) [d5acba26bfa097a618be425522b1ec4269d3edaf] Merge tag 'char-misc-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit d5acba26bfa097a618be425522b1ec4269d3edaf with gcc (GCC) 8.1.0 all runs: OK # git bisect good d5acba26bfa097a618be425522b1ec4269d3edaf Bisecting: 1595 revisions left to test after this (roughly 11 steps) [f3ea496213819c80ce9c49a9b65f9261da713d11] Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc testing commit f3ea496213819c80ce9c49a9b65f9261da713d11 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in tcp_cleanup_ulp run #1: crashed: general protection fault in tcp_cleanup_ulp run #2: crashed: general protection fault in tcp_cleanup_ulp run #3: crashed: general protection fault in tcp_cleanup_ulp run #4: crashed: general protection fault in tcp_cleanup_ulp run #5: crashed: general protection fault in tcp_cleanup_ulp run #6: OK # git bisect bad f3ea496213819c80ce9c49a9b65f9261da713d11 Bisecting: 786 revisions left to test after this (roughly 10 steps) [2fd9944f0fd41f7bc2f590169a9a758e1186b345] autofs: fix inconsistent use of now variable testing commit 2fd9944f0fd41f7bc2f590169a9a758e1186b345 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in tcp_cleanup_ulp # git bisect bad 2fd9944f0fd41f7bc2f590169a9a758e1186b345 Bisecting: 377 revisions left to test after this (roughly 9 steps) [2ad0d52699700a91660a406a4046017a2d7f246a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 2ad0d52699700a91660a406a4046017a2d7f246a with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in tcp_cleanup_ulp run #1: crashed: general protection fault in tcp_cleanup_ulp run #2: crashed: general protection fault in tcp_cleanup_ulp run #3: crashed: general protection fault in tcp_cleanup_ulp run #4: crashed: general protection fault in tcp_cleanup_ulp run #5: crashed: general protection fault in tcp_cleanup_ulp run #6: OK # git bisect bad 2ad0d52699700a91660a406a4046017a2d7f246a Bisecting: 213 revisions left to test after this (roughly 8 steps) [7f02e1ce4a13edf295fcedbc663a8ca69bc1ff6e] Merge tag 'hwlock-v4.19' of git://github.com/andersson/remoteproc testing commit 7f02e1ce4a13edf295fcedbc663a8ca69bc1ff6e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7f02e1ce4a13edf295fcedbc663a8ca69bc1ff6e Bisecting: 124 revisions left to test after this (roughly 7 steps) [28a1f3ac1d0c8558ee4453d9634dad891a6e922e] kvm: x86: Set highest physical address bits in non-present/reserved SPTEs testing commit 28a1f3ac1d0c8558ee4453d9634dad891a6e922e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 28a1f3ac1d0c8558ee4453d9634dad891a6e922e Bisecting: 61 revisions left to test after this (roughly 6 steps) [1d0926e99de7b486321e3db924b445531eea5e18] Merge tag 'char-misc-4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit 1d0926e99de7b486321e3db924b445531eea5e18 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1d0926e99de7b486321e3db924b445531eea5e18 Bisecting: 35 revisions left to test after this (roughly 5 steps) [3fe49d699a9604eed851eb45e1e0adab0e25688e] Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf testing commit 3fe49d699a9604eed851eb45e1e0adab0e25688e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 3fe49d699a9604eed851eb45e1e0adab0e25688e Bisecting: 17 revisions left to test after this (roughly 4 steps) [e2948e5af8eeb6c945000772b7613b0323a0a203] ip6_vti: fix creating fallback tunnel device for vti6 testing commit e2948e5af8eeb6c945000772b7613b0323a0a203 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in tcp_cleanup_ulp # git bisect bad e2948e5af8eeb6c945000772b7613b0323a0a203 Bisecting: 8 revisions left to test after this (roughly 3 steps) [cbb2fb13db3209cf4264aa5f76393a12add91315] Merge branch 'sockmap-ulp-fixes' testing commit cbb2fb13db3209cf4264aa5f76393a12add91315 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in tcp_cleanup_ulp run #1: crashed: general protection fault in tcp_cleanup_ulp run #2: crashed: general protection fault in tcp_cleanup_ulp run #3: crashed: general protection fault in tcp_cleanup_ulp run #4: crashed: general protection fault in tcp_cleanup_ulp run #5: crashed: general protection fault in tcp_cleanup_ulp run #6: OK # git bisect bad cbb2fb13db3209cf4264aa5f76393a12add91315 Bisecting: 4 revisions left to test after this (roughly 2 steps) [037b0b86ecf5646f8eae777d8b52ff8b401692ec] tcp, ulp: add alias for all ulp modules testing commit 037b0b86ecf5646f8eae777d8b52ff8b401692ec with gcc (GCC) 8.1.0 all runs: OK # git bisect good 037b0b86ecf5646f8eae777d8b52ff8b401692ec Bisecting: 2 revisions left to test after this (roughly 1 step) [d40b0116c94bd8fc2b63aae35ce8e66bb53bba42] bpf, sockmap: fix leakage of smap_psock_map_entry testing commit d40b0116c94bd8fc2b63aae35ce8e66bb53bba42 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in tcp_cleanup_ulp # git bisect bad d40b0116c94bd8fc2b63aae35ce8e66bb53bba42 Bisecting: 0 revisions left to test after this (roughly 0 steps) [90545cdc3f2b2ea700e24335610cd181e73756da] tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach testing commit 90545cdc3f2b2ea700e24335610cd181e73756da with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in tcp_cleanup_ulp # git bisect bad 90545cdc3f2b2ea700e24335610cd181e73756da 90545cdc3f2b2ea700e24335610cd181e73756da is the first bad commit commit 90545cdc3f2b2ea700e24335610cd181e73756da Author: Daniel Borkmann Date: Thu Aug 16 21:49:07 2018 +0200 tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach I found that in BPF sockmap programs once we either delete a socket from the map or we updated a map slot and the old socket was purged from the map that these socket can never get reattached into a map even though their related psock has been dropped entirely at that point. Reason is that tcp_cleanup_ulp() leaves the old icsk->icsk_ulp_ops intact, so that on the next tcp_set_ulp_id() the kernel returns an -EEXIST thinking there is still some active ULP attached. BPF sockmap is the only one that has this issue as the other user, kTLS, only calls tcp_cleanup_ulp() from tcp_v4_destroy_sock() whereas sockmap semantics allow dropping the socket from the map with all related psock state being cleaned up. Fixes: 1aa12bdf1bfb ("bpf: sockmap, add sock close() hook to remove socks") Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Acked-by: Song Liu Signed-off-by: Alexei Starovoitov :040000 040000 6830e0f869e0a56c9c85848af515b233e652280d 807bfdee84e1daf5ac5adfa696821aa0e024f952 M net revisions tested: 16, total time: 4h32m25.077414693s (build: 1h40m54.238692174s, test: 2h44m6.259773281s) first bad commit: 90545cdc3f2b2ea700e24335610cd181e73756da tcp, ulp: fix leftover icsk_ulp_ops preventing sock from reattach cc: ["ast@kernel.org" "daniel@iogearbox.net" "john.fastabend@gmail.com" "songliubraving@fb.com"] crash: general protection fault in tcp_cleanup_ulp kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 31966 Comm: syz-executor0 Not tainted 4.18.0+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:tcp_cleanup_ulp+0xa3/0x120 net/ipv4/tcp_ulp.c:131 Code: fc ff df 48 c1 ea 03 80 3c 02 00 75 7e 49 8b 9c 24 88 06 00 00 48 8d 7b 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 4a 48 8b 7b 38 e8 be 98 20 fb 4c 89 ea 48 b8 00 00 RSP: 0018:ffff8801c3eaf6a8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10038bb8d5d RDX: 0000000000000007 RSI: 0000000000000003 RDI: 0000000000000038 RBP: ffff8801c3eaf6c0 R08: 0000000000000000 R09: ffffed003b58472a R10: ffffed003b58472a R11: ffff8801dac23953 R12: ffff8801cc448140 R13: ffff8801cc4487c8 R14: 0000000000000000 R15: ffff8801c3eaf7d8 FS: 0000000002a15940(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe42e7ffb8 CR3: 00000001a538b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_v4_destroy_sock+0xfa/0x920 net/ipv4/tcp_ipv4.c:1978 tcp_v6_destroy_sock+0xd/0x20 net/ipv6/tcp_ipv6.c:1762 inet_csk_destroy_sock+0x152/0x3a0 net/ipv4/inet_connection_sock.c:835 tcp_close+0x91a/0x1150 net/ipv4/tcp.c:2477 bpf_tcp_close+0x8f8/0xef0 kernel/bpf/sockmap.c:377 inet_release+0xde/0x1c0 net/ipv4/af_inet.c:428 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:457 __sock_release+0xc7/0x230 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1139 __fput+0x317/0xa30 fs/file_table.c:251 ____fput+0x9/0x10 fs/file_table.c:282 task_work_run+0x19f/0x240 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:193 [inline] exit_to_usermode_loop+0x26e/0x300 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x587/0x700 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x410e91 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 84 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007fffae475660 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000410e91 RDX: 0000000000000000 RSI: 0000000000731160 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffffffffff R10: 00000000009300a0 R11: 0000000000000293 R12: 0000000000000008 R13: 0000000000072eda R14: 0000000000000bfa R15: badc0ffeebadface Modules linked in: ---[ end trace 9c489229e4ea0fe8 ]--- RIP: 0010:tcp_cleanup_ulp+0xa3/0x120 net/ipv4/tcp_ulp.c:131 Code: fc ff df 48 c1 ea 03 80 3c 02 00 75 7e 49 8b 9c 24 88 06 00 00 48 8d 7b 38 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 4a 48 8b 7b 38 e8 be 98 20 fb 4c 89 ea 48 b8 00 00 kobject: 'loop5' (0000000053cee0f6): kobject_uevent_env RSP: 0018:ffff8801c3eaf6a8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10038bb8d5d kobject: 'loop5' (0000000053cee0f6): fill_kobj_path: path = '/devices/virtual/block/loop5' RDX: 0000000000000007 RSI: 0000000000000003 RDI: 0000000000000038 RBP: ffff8801c3eaf6c0 R08: 0000000000000000 R09: ffffed003b58472a R10: ffffed003b58472a R11: ffff8801dac23953 R12: ffff8801cc448140 R13: ffff8801cc4487c8 R14: 0000000000000000 R15: ffff8801c3eaf7d8 kobject: 'loop1' (00000000a4d17c52): kobject_uevent_env FS: 0000000002a15940(0000) GS:ffff8801dac00000(0000) knlGS:0000000000000000 kobject: 'loop1' (00000000a4d17c52): fill_kobj_path: path = '/devices/virtual/block/loop1' CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe42e7ffb8 CR3: 00000001a538b000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400