bisecting fixing commit since 3ffe1e79c174b2093f7ee3df589a7705572c9620 building syzkaller on acb51638141ff960f547431757130749bc176bc0 testing commit 3ffe1e79c174b2093f7ee3df589a7705572c9620 with gcc (GCC) 8.1.0 kernel signature: b66bcecd3d9e7c2084b04c6b98b32a3280fb5b5a all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! testing current HEAD fbc5fe7a54d02e11972e3b2a5ddb6ffc88162c8f testing commit fbc5fe7a54d02e11972e3b2a5ddb6ffc88162c8f with gcc (GCC) 8.1.0 kernel signature: 96658a92ee0a6ba1ee97cdd401fe6251afc363e0 all runs: OK # git bisect start fbc5fe7a54d02e11972e3b2a5ddb6ffc88162c8f 3ffe1e79c174b2093f7ee3df589a7705572c9620 Bisecting: 905 revisions left to test after this (roughly 10 steps) [f991b1fa0ded689f980cc25312b5003f35add8bf] drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 testing commit f991b1fa0ded689f980cc25312b5003f35add8bf with gcc (GCC) 8.1.0 kernel signature: 975ceb986bbd2a24c1ea57d7ef76ef4b78bd80cc all runs: OK # git bisect bad f991b1fa0ded689f980cc25312b5003f35add8bf Bisecting: 452 revisions left to test after this (roughly 9 steps) [5d9d31116f623c87e12363aab35c3aaafeff9097] irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices testing commit 5d9d31116f623c87e12363aab35c3aaafeff9097 with gcc (GCC) 8.1.0 kernel signature: b00fbc642ce31c52b14ea23451db4de843530891 all runs: OK # git bisect bad 5d9d31116f623c87e12363aab35c3aaafeff9097 Bisecting: 226 revisions left to test after this (roughly 8 steps) [564e2b87491c615a95d9a200fb4ad267e403db4d] tcp: make sure EPOLLOUT wont be missed testing commit 564e2b87491c615a95d9a200fb4ad267e403db4d with gcc (GCC) 8.1.0 kernel signature: deea16b99b1081a649d8c2f63b54a60e3c1697d7 all runs: OK # git bisect bad 564e2b87491c615a95d9a200fb4ad267e403db4d Bisecting: 112 revisions left to test after this (roughly 7 steps) [5c8b1c3659c75c83bd48e8d3b0b8a24a3f29052b] staging: comedi: dt3000: Fix signed integer overflow 'divider * base' testing commit 5c8b1c3659c75c83bd48e8d3b0b8a24a3f29052b with gcc (GCC) 8.1.0 kernel signature: c7eedeb9d8ab5c9ce206b1b71f600f81f1295499 all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 5c8b1c3659c75c83bd48e8d3b0b8a24a3f29052b Bisecting: 56 revisions left to test after this (roughly 6 steps) [9e47a7963485c636a0e75b192c898d72d16bac38] net: hisilicon: Fix dma_map_single failed on arm64 testing commit 9e47a7963485c636a0e75b192c898d72d16bac38 with gcc (GCC) 8.1.0 kernel signature: 0b08abf429b9d368f782aaebdcbe9a5fe3fa36db all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 9e47a7963485c636a0e75b192c898d72d16bac38 Bisecting: 28 revisions left to test after this (roughly 5 steps) [2c4291bd94eeccd9d81dc575d9fb873274b80555] dm zoned: properly handle backing device failure testing commit 2c4291bd94eeccd9d81dc575d9fb873274b80555 with gcc (GCC) 8.1.0 kernel signature: f9f7b5fa3d477d6fe40df78c199baf3b6e215f2b all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 2c4291bd94eeccd9d81dc575d9fb873274b80555 Bisecting: 14 revisions left to test after this (roughly 4 steps) [c946f1306aaf9f0727b4e194d1b37b94ec292592] usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt testing commit c946f1306aaf9f0727b4e194d1b37b94ec292592 with gcc (GCC) 8.1.0 kernel signature: 8613cd50fc4385e562f1a8603647ede7f6d467d8 all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good c946f1306aaf9f0727b4e194d1b37b94ec292592 Bisecting: 7 revisions left to test after this (roughly 3 steps) [3c48e5715813f851207f496a014ebf7a41673386] watchdog: bcm2835_wdt: Fix module autoload testing commit 3c48e5715813f851207f496a014ebf7a41673386 with gcc (GCC) 8.1.0 kernel signature: efedb5a33bc28628dd1f1509ea9255b551e33671 all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 3c48e5715813f851207f496a014ebf7a41673386 Bisecting: 3 revisions left to test after this (roughly 2 steps) [e5df4baea324d3c21dc48f86ad24e5d9aed67c65] tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue testing commit e5df4baea324d3c21dc48f86ad24e5d9aed67c65 with gcc (GCC) 8.1.0 kernel signature: 6dfa5999c9efad319bd6ababc8e94e8c1821f3dc all runs: OK # git bisect bad e5df4baea324d3c21dc48f86ad24e5d9aed67c65 Bisecting: 1 revision left to test after this (roughly 1 step) [99ab76dd3cc573315b7f4c287592ebd371daed38] scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value testing commit 99ab76dd3cc573315b7f4c287592ebd371daed38 with gcc (GCC) 8.1.0 kernel signature: 62895d250367b5d9adee79d1710b81f1795b9edf all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 99ab76dd3cc573315b7f4c287592ebd371daed38 Bisecting: 0 revisions left to test after this (roughly 0 steps) [0d9b9e89ae5a1aa20141fe41c3709149113c4b02] drm/tilcdc: Register cpufreq notifier after we have initialized crtc testing commit 0d9b9e89ae5a1aa20141fe41c3709149113c4b02 with gcc (GCC) 8.1.0 kernel signature: e6e78be25ba4e13b3799ae9fdaf4bc9549acc969 all runs: crashed: kernel BUG at ./include/linux/skbuff.h:LINE! # git bisect good 0d9b9e89ae5a1aa20141fe41c3709149113c4b02 e5df4baea324d3c21dc48f86ad24e5d9aed67c65 is the first bad commit commit e5df4baea324d3c21dc48f86ad24e5d9aed67c65 Author: Tim Froidcoeur Date: Sat Aug 24 08:03:51 2019 +0200 tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue Commit 8c3088f895a0 ("tcp: be more careful in tcp_fragment()") triggers following stack trace: [25244.848046] kernel BUG at ./include/linux/skbuff.h:1406! [25244.859335] RIP: 0010:skb_queue_prev+0x9/0xc [25244.888167] Call Trace: [25244.889182] [25244.890001] tcp_fragment+0x9c/0x2cf [25244.891295] tcp_write_xmit+0x68f/0x988 [25244.892732] __tcp_push_pending_frames+0x3b/0xa0 [25244.894347] tcp_data_snd_check+0x2a/0xc8 [25244.895775] tcp_rcv_established+0x2a8/0x30d [25244.897282] tcp_v4_do_rcv+0xb2/0x158 [25244.898666] tcp_v4_rcv+0x692/0x956 [25244.899959] ip_local_deliver_finish+0xeb/0x169 [25244.901547] __netif_receive_skb_core+0x51c/0x582 [25244.903193] ? inet_gro_receive+0x239/0x247 [25244.904756] netif_receive_skb_internal+0xab/0xc6 [25244.906395] napi_gro_receive+0x8a/0xc0 [25244.907760] receive_buf+0x9a1/0x9cd [25244.909160] ? load_balance+0x17a/0x7b7 [25244.910536] ? vring_unmap_one+0x18/0x61 [25244.911932] ? detach_buf+0x60/0xfa [25244.913234] virtnet_poll+0x128/0x1e1 [25244.914607] net_rx_action+0x12a/0x2b1 [25244.915953] __do_softirq+0x11c/0x26b [25244.917269] ? handle_irq_event+0x44/0x56 [25244.918695] irq_exit+0x61/0xa0 [25244.919947] do_IRQ+0x9d/0xbb [25244.921065] common_interrupt+0x85/0x85 [25244.922479] tcp_rtx_queue_tail() (called by tcp_fragment()) can call tcp_write_queue_prev() on the first packet in the queue, which will trigger the BUG in tcp_write_queue_prev(), because there is no previous packet. This happens when the retransmit queue is empty, for example in case of a zero window. Commit 8c3088f895a0 ("tcp: be more careful in tcp_fragment()") was not a simple cherry-pick of the original one from master (b617158dc096) because there is a specific TCP rtx queue only since v4.15. For more details, please see the commit message of b617158dc096 ("tcp: be more careful in tcp_fragment()"). The BUG() is hit due to the specific code added to versions older than v4.15. The comment in skb_queue_prev() (include/linux/skbuff.h:1406), just before the BUG_ON() somehow suggests to add a check before using it, what Tim did. In master, this code path causing the issue will not be taken because the implementation of tcp_rtx_queue_tail() is different: tcp_fragment() → tcp_rtx_queue_tail() → tcp_write_queue_prev() → skb_queue_prev() → BUG_ON() Fixes: 8c3088f895a0 ("tcp: be more careful in tcp_fragment()") Signed-off-by: Tim Froidcoeur Signed-off-by: Matthieu Baerts Reviewed-by: Christoph Paasch Signed-off-by: Sasha Levin include/net/tcp.h | 4 ++++ 1 file changed, 4 insertions(+) kernel signature: 6dfa5999c9efad319bd6ababc8e94e8c1821f3dc previous signature: e6e78be25ba4e13b3799ae9fdaf4bc9549acc969 revisions tested: 13, total time: 3h9m36.236685378s (build: 1h45m8.393210666s, test: 1h20m21.694369548s) first good commit: e5df4baea324d3c21dc48f86ad24e5d9aed67c65 tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue cc: ["cpaasch@apple.com" "matthieu.baerts@tessares.net" "sashal@kernel.org" "tim.froidcoeur@tessares.net"]