bisecting cause commit starting from 9c849ce86e0fa93a218614eac562ace44053d7ce building syzkaller on 7eb7e15259fddd67759f90feb2b016da878f76c7 testing commit 9c849ce86e0fa93a218614eac562ace44053d7ce compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 3d66c252a8e294aaeb60d58e0452c3692028ba65b1dd721879353f4e7722d89e run #0: crashed: general protection fault in io_issue_sqe run #1: crashed: general protection fault in io_issue_sqe run #2: crashed: general protection fault in io_issue_sqe run #3: crashed: general protection fault in io_issue_sqe run #4: crashed: general protection fault in io_issue_sqe run #5: crashed: general protection fault in io_issue_sqe run #6: crashed: general protection fault in io_issue_sqe run #7: crashed: general protection fault in io_issue_sqe run #8: crashed: general protection fault in io_issue_sqe run #9: crashed: general protection fault in io_issue_sqe run #10: crashed: general protection fault in io_issue_sqe run #11: crashed: general protection fault in io_issue_sqe run #12: crashed: general protection fault in io_issue_sqe run #13: crashed: general protection fault in io_issue_sqe run #14: crashed: general protection fault in io_issue_sqe run #15: crashed: general protection fault in io_issue_sqe run #16: crashed: general protection fault in io_issue_sqe run #17: crashed: general protection fault in io_issue_sqe run #18: crashed: general protection fault in io_issue_sqe run #19: boot failed: possible deadlock in blktrans_open testing release v5.14 testing commit 7d2a07b769330c34b4deabeed939325c77a7ec2f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 1bc25c310b773f41f60536ec01fad7eee81fbd08982b6b34e2bd4f1aafdef1ea all runs: OK # git bisect start 9c849ce86e0fa93a218614eac562ace44053d7ce 7d2a07b769330c34b4deabeed939325c77a7ec2f Bisecting: 669 revisions left to test after this (roughly 9 steps) [e5e726f7bb9f711102edea7e5bd511835640e3b4] Merge tag 'locking-core-2021-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e5e726f7bb9f711102edea7e5bd511835640e3b4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 1733ff4a829dea659b34d9545ce77739b1dba8f8faccb7a67ac6f75852adb4b8 all runs: OK # git bisect good e5e726f7bb9f711102edea7e5bd511835640e3b4 Bisecting: 362 revisions left to test after this (roughly 8 steps) [44d7d3b0d1cdb2119dba33bbedd602ce30528d6c] Merge tag 'for-5.15/libata-2021-08-30' of git://git.kernel.dk/linux-block testing commit 44d7d3b0d1cdb2119dba33bbedd602ce30528d6c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 54befc1dce2553a2844290fea0efd4d161e7a62d09ce38506d1a1ef8ca3ac964 all runs: OK # git bisect good 44d7d3b0d1cdb2119dba33bbedd602ce30528d6c Bisecting: 181 revisions left to test after this (roughly 8 steps) [ae9d84d6f1b1012a7829c03b9a318f499dc7719d] Merge pull request #56 from namjaejeon/cifsd-for-next testing commit ae9d84d6f1b1012a7829c03b9a318f499dc7719d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: ab292d991527e9de3c442f9b248ebd3c56cd9c736e833267099173be4ea69d11 all runs: OK # git bisect good ae9d84d6f1b1012a7829c03b9a318f499dc7719d Bisecting: 93 revisions left to test after this (roughly 7 steps) [c547d89a9a445f6bb757b93247de43d312e722da] Merge tag 'for-5.15/io_uring-2021-08-30' of git://git.kernel.dk/linux-block testing commit c547d89a9a445f6bb757b93247de43d312e722da compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: f2d4d007710e94687ec056a4fba7cf1b22b55fbc36dc91eceff38e5b609708c9 all runs: crashed: general protection fault in io_issue_sqe # git bisect bad c547d89a9a445f6bb757b93247de43d312e722da Bisecting: 43 revisions left to test after this (roughly 6 steps) [a141dd896f544df9627502cfb3fc1a73fb6587e4] io_uring: correct __must_hold annotation testing commit a141dd896f544df9627502cfb3fc1a73fb6587e4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 72d98c3484c7827c927c577fcaa62ccb6518ca0eb804fb7b83f3da98783406fe all runs: OK # git bisect good a141dd896f544df9627502cfb3fc1a73fb6587e4 Bisecting: 21 revisions left to test after this (roughly 5 steps) [26578cda3db983b17cabe4e577af26306beb9987] io_uring: add ->splice_fd_in checks testing commit 26578cda3db983b17cabe4e577af26306beb9987 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: d2483e7f5d7b9d5e282008ac9f876aa86cb1e2155a1c0ff154cd84f81cf52b2f all runs: OK # git bisect good 26578cda3db983b17cabe4e577af26306beb9987 Bisecting: 10 revisions left to test after this (roughly 4 steps) [a8295b982c46d4a7c259a4cdd58a2681929068a9] io_uring: fix failed linkchain code logic testing commit a8295b982c46d4a7c259a4cdd58a2681929068a9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 90868c7d7caf2ee587d73daa2964561a21610ef38ecce79ef3359d9e9cf449ab all runs: crashed: general protection fault in io_issue_sqe # git bisect bad a8295b982c46d4a7c259a4cdd58a2681929068a9 Bisecting: 5 revisions left to test after this (roughly 3 steps) [d32f89da7fa8ccc8b3fb8f909d61e42b9bc39329] net: add accept helper not installing fd testing commit d32f89da7fa8ccc8b3fb8f909d61e42b9bc39329 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 0b5680b33cda16c4ecf5dcb255df16bcaea8f05c2c1d3853bc0a3cbe0d81ac90 all runs: OK # git bisect good d32f89da7fa8ccc8b3fb8f909d61e42b9bc39329 Bisecting: 2 revisions left to test after this (roughly 2 steps) [aaa4db12ef7bdc3e343580d1d3c0b2a8874fc1fb] io_uring: accept directly into fixed file table testing commit aaa4db12ef7bdc3e343580d1d3c0b2a8874fc1fb compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 37f998a811630ad3dc950bc079806d909edb3f3eac6d5d90268f621df88fe890 all runs: OK # git bisect good aaa4db12ef7bdc3e343580d1d3c0b2a8874fc1fb Bisecting: 0 revisions left to test after this (roughly 1 step) [14afdd6ee3a0db7bcae887d1951ed21c4d1539cd] io_uring: remove redundant req_set_fail() testing commit 14afdd6ee3a0db7bcae887d1951ed21c4d1539cd compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 2d36861af3045865b176fc9764029777e05249709e3a2b3adb65a2bd8b532c7a all runs: OK # git bisect good 14afdd6ee3a0db7bcae887d1951ed21c4d1539cd a8295b982c46d4a7c259a4cdd58a2681929068a9 is the first bad commit commit a8295b982c46d4a7c259a4cdd58a2681929068a9 Author: Hao Xu Date: Fri Aug 27 17:46:09 2021 +0800 io_uring: fix failed linkchain code logic Given a linkchain like this: req0(link_flag)-->req1(link_flag)-->...-->reqn(no link_flag) There is a problem: - if some intermediate linked req like req1 's submittion fails, reqs after it won't be cancelled. - sqpoll disabled: maybe it's ok since users can get the error info of req1 and stop submitting the following sqes. - sqpoll enabled: definitely a problem, the following sqes will be submitted in the next round. The solution is to refactor the code logic to: - if a linked req's submittion fails, just mark it and the head(if it exists) as REQ_F_FAIL. Leverage req->result to indicate whether it is failed or cancelled. - submit or fail the whole chain when we come to the end of it. Signed-off-by: Hao Xu Reviewed-by: Pavel Begunkov Link: https://lore.kernel.org/r/20210827094609.36052-3-haoxu@linux.alibaba.com Signed-off-by: Jens Axboe fs/io_uring.c | 61 +++++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 47 insertions(+), 14 deletions(-) culprit signature: 90868c7d7caf2ee587d73daa2964561a21610ef38ecce79ef3359d9e9cf449ab parent signature: 2d36861af3045865b176fc9764029777e05249709e3a2b3adb65a2bd8b532c7a revisions tested: 12, total time: 3h2m10.941938232s (build: 1h23m27.980734137s, test: 1h37m0.555530577s) first bad commit: a8295b982c46d4a7c259a4cdd58a2681929068a9 io_uring: fix failed linkchain code logic recipients (to): ["asml.silence@gmail.com" "axboe@kernel.dk" "haoxu@linux.alibaba.com"] recipients (cc): [] crash: general protection fault in io_issue_sqe general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] CPU: 1 PID: 10206 Comm: syz-executor.2 Not tainted 5.14.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:io_accept fs/io_uring.c:4846 [inline] RIP: 0010:io_issue_sqe+0x24d6/0x5cc0 fs/io_uring.c:6329 Code: 48 c1 e9 03 80 3c 01 00 0f 85 46 28 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 0c 24 49 8d b9 80 00 00 00 48 89 f9 48 c1 e9 03 <0f> b6 04 01 84 c0 74 08 3c 03 0f 8e 2f 28 00 00 41 f6 81 81 00 00 RSP: 0018:ffffc9000a6bfb70 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 1ffff920014d7f82 RCX: 0000000000000010 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000080 RBP: ffff888034e1c7d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888034e1c780 R13: ffff888034e1c7c8 R14: ffff888034e1c79c R15: 0000000000000800 FS: 00007f85cd6b9700(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000522230 CR3: 00000000458eb000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __io_queue_sqe+0x85/0x960 fs/io_uring.c:6586 tctx_task_work+0x171/0x4b0 fs/io_uring.c:2090 task_work_run+0xc0/0x160 kernel/task_work.c:164 tracehook_notify_signal include/linux/tracehook.h:212 [inline] handle_signal_work kernel/entry/common.c:146 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x256/0x290 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f85cd6b9188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: 0000000000000304 RBX: 000000000056bf80 RCX: 00000000004665f9 RDX: 0000000000000000 RSI: 0000000000000304 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007fff28aa8d5f R14: 00007f85cd6b9300 R15: 0000000000022000 Modules linked in: ---[ end trace 8fd38d0c2989449c ]--- RIP: 0010:io_accept fs/io_uring.c:4846 [inline] RIP: 0010:io_issue_sqe+0x24d6/0x5cc0 fs/io_uring.c:6329 Code: 48 c1 e9 03 80 3c 01 00 0f 85 46 28 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 0c 24 49 8d b9 80 00 00 00 48 89 f9 48 c1 e9 03 <0f> b6 04 01 84 c0 74 08 3c 03 0f 8e 2f 28 00 00 41 f6 81 81 00 00 RSP: 0018:ffffc9000a6bfb70 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 1ffff920014d7f82 RCX: 0000000000000010 RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000080 RBP: ffff888034e1c7d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888034e1c780 R13: ffff888034e1c7c8 R14: ffff888034e1c79c R15: 0000000000000800 FS: 00007f85cd6b9700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa1c55d3000 CR3: 00000000458eb000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 48 c1 e9 03 shr $0x3,%rcx 4: 80 3c 01 00 cmpb $0x0,(%rcx,%rax,1) 8: 0f 85 46 28 00 00 jne 0x2854 e: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 15: fc ff df 18: 4d 8b 0c 24 mov (%r12),%r9 1c: 49 8d b9 80 00 00 00 lea 0x80(%r9),%rdi 23: 48 89 f9 mov %rdi,%rcx 26: 48 c1 e9 03 shr $0x3,%rcx * 2a: 0f b6 04 01 movzbl (%rcx,%rax,1),%eax <-- trapping instruction 2e: 84 c0 test %al,%al 30: 74 08 je 0x3a 32: 3c 03 cmp $0x3,%al 34: 0f 8e 2f 28 00 00 jle 0x2869 3a: 41 rex.B 3b: f6 .byte 0xf6 3c: 81 .byte 0x81 3d: 81 .byte 0x81