bisecting cause commit starting from 9e0babf2c06c73cda2c0cd37a1653d823adb40ec building syzkaller on 442206d76b974cca2d83ec763d4cf5ee829eb7d6 testing commit 9e0babf2c06c73cda2c0cd37a1653d823adb40ec with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: OK # git bisect start v5.1 v5.0 Bisecting: 7074 revisions left to test after this (roughly 13 steps) [b5dd0c658c31b469ccff1b637e5124851e7a4a1c] Merge branch 'akpm' (patches from Andrew) testing commit b5dd0c658c31b469ccff1b637e5124851e7a4a1c with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! # git bisect bad b5dd0c658c31b469ccff1b637e5124851e7a4a1c Bisecting: 3569 revisions left to test after this (roughly 12 steps) [3478588b5136966c80c571cf0006f08e9e5b8f04] Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 3478588b5136966c80c571cf0006f08e9e5b8f04 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 3478588b5136966c80c571cf0006f08e9e5b8f04 Bisecting: 1580 revisions left to test after this (roughly 11 steps) [da2577fe63f865cd9dc785a42c29c0071f567a35] Merge tag 'sound-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit da2577fe63f865cd9dc785a42c29c0071f567a35 with gcc (GCC) 8.1.0 all runs: OK # git bisect good da2577fe63f865cd9dc785a42c29c0071f567a35 Bisecting: 860 revisions left to test after this (roughly 10 steps) [67e79a6dc2664a3ef85113440e60f7aaca3c7815] Merge tag 'tty-5.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit 67e79a6dc2664a3ef85113440e60f7aaca3c7815 with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! # git bisect bad 67e79a6dc2664a3ef85113440e60f7aaca3c7815 Bisecting: 373 revisions left to test after this (roughly 9 steps) [1f08c4a54b7cb62ed6450808c37d06c907f1a2dd] staging: mt7621-dma: remove license boilerplate text testing commit 1f08c4a54b7cb62ed6450808c37d06c907f1a2dd with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1f08c4a54b7cb62ed6450808c37d06c907f1a2dd Bisecting: 192 revisions left to test after this (roughly 8 steps) [b39e557b7762498c7038ccd49dbdee88b2d00043] misc/habanalabs: adjust Kconfig to fix build errors testing commit b39e557b7762498c7038ccd49dbdee88b2d00043 with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! # git bisect bad b39e557b7762498c7038ccd49dbdee88b2d00043 Bisecting: 90 revisions left to test after this (roughly 7 steps) [c2bc02f8828d2efef2852249ce61acb8967d4f4a] coresight: Use of_node_name_eq for node name comparisons testing commit c2bc02f8828d2efef2852249ce61acb8967d4f4a with gcc (GCC) 8.1.0 all runs: OK # git bisect good c2bc02f8828d2efef2852249ce61acb8967d4f4a Bisecting: 45 revisions left to test after this (roughly 6 steps) [3013bf62b67aef921bc2e9ba10e639a022002d02] binder: reduce mmap_sem write-side lock testing commit 3013bf62b67aef921bc2e9ba10e639a022002d02 with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! # git bisect bad 3013bf62b67aef921bc2e9ba10e639a022002d02 Bisecting: 22 revisions left to test after this (roughly 5 steps) [bde4a19fc04f5f46298c86b1acb7a4af1d5f138d] binder: use userspace pointer as base of buffer space testing commit bde4a19fc04f5f46298c86b1acb7a4af1d5f138d with gcc (GCC) 8.1.0 all runs: crashed: kernel BUG at drivers/android/binder_alloc.c:LINE! # git bisect bad bde4a19fc04f5f46298c86b1acb7a4af1d5f138d Bisecting: 10 revisions left to test after this (roughly 4 steps) [36e738bdab536c0bdfa16e999fa66a3b9b776e5d] misc: dt-bindings: Add Qualcomm Fastrpc bindings testing commit 36e738bdab536c0bdfa16e999fa66a3b9b776e5d with gcc (GCC) 8.1.0 all runs: OK # git bisect good 36e738bdab536c0bdfa16e999fa66a3b9b776e5d Bisecting: 5 revisions left to test after this (roughly 3 steps) [1a7c3d9bb7a926e88d5f57643e75ad1abfc55013] binder: create userspace-to-binder-buffer copy function testing commit 1a7c3d9bb7a926e88d5f57643e75ad1abfc55013 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1a7c3d9bb7a926e88d5f57643e75ad1abfc55013 Bisecting: 2 revisions left to test after this (roughly 2 steps) [db6b0b810bf945d1991917ffce0e93383101f2fa] binder: avoid kernel vm_area for buffer fixups testing commit db6b0b810bf945d1991917ffce0e93383101f2fa with gcc (GCC) 8.1.0 all runs: OK # git bisect good db6b0b810bf945d1991917ffce0e93383101f2fa Bisecting: 0 revisions left to test after this (roughly 1 step) [c41358a5f5217abd7c051e8d42397e5b80f3b3ed] binder: remove user_buffer_offset testing commit c41358a5f5217abd7c051e8d42397e5b80f3b3ed with gcc (GCC) 8.1.0 all runs: OK # git bisect good c41358a5f5217abd7c051e8d42397e5b80f3b3ed bde4a19fc04f5f46298c86b1acb7a4af1d5f138d is the first bad commit commit bde4a19fc04f5f46298c86b1acb7a4af1d5f138d Author: Todd Kjos Date: Fri Feb 8 10:35:20 2019 -0800 binder: use userspace pointer as base of buffer space Now that alloc->buffer points to the userspace vm_area rename buffer->data to buffer->user_data and rename local pointers that hold user addresses. Also use the "__user" tag to annotate all user pointers so sparse can flag cases where user pointer vaues are copied to kernel pointers. Refactor code to use offsets instead of user pointers. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman :040000 040000 f3801dffdc3e9dc3db2c83fe9bbb44b2d8ea256d 742112a56320f3474b09ac19464856cfbfdcb07b M drivers revisions tested: 16, total time: 4h14m45.449794046s (build: 1h26m59.64062373s, test: 2h42m58.150620664s) first bad commit: bde4a19fc04f5f46298c86b1acb7a4af1d5f138d binder: use userspace pointer as base of buffer space cc: ["arve@android.com" "christian@brauner.io" "devel@driverdev.osuosl.org" "gregkh@linuxfoundation.org" "joel@joelfernandes.org" "linux-kernel@vger.kernel.org" "maco@android.com" "tkjos@android.com" "tkjos@google.com"] crash: kernel BUG at drivers/android/binder_alloc.c:LINE! 8021q: adding VLAN 0 to HW filter on device team0 IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready ------------[ cut here ]------------ kernel BUG at drivers/android/binder_alloc.c:1141! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7077 Comm: syz-executor.4 Not tainted 5.0.0-rc6+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:binder_alloc_do_buffer_copy+0xae/0x420 drivers/android/binder_alloc.c:1141 Code: 24 58 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3a 03 00 00 49 8b 44 24 58 48 29 d8 49 39 c5 76 02 <0f> 0b 4c 29 e8 49 39 c7 77 f6 41 f6 c7 03 75 f0 48 8b 45 b8 48 8d RSP: 0018:ffff88809a98f398 EFLAGS: 00010202 RAX: 0000000000000078 RBX: 0000000020001000 RCX: 00000000000000e8 RDX: 1ffff110148ffe3b RSI: 0000000000000000 RDI: ffff8880a47ff1d8 RBP: ffff88809a98f410 R08: ffff88809a98f458 R09: 0000000000000008 R10: ffffed1013531f0c R11: ffff88809a98f867 R12: ffff8880a47ff180 R13: 0000000000000008 R14: ffff8880984d78d0 R15: 00000000000000e8 FS: 00007f736a776700(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000086eb9000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: binder_alloc_copy_from_buffer+0x11/0x13 drivers/android/binder_alloc.c:1187 binder_validate_ptr+0x98/0x160 drivers/android/binder.c:2132 binder_transaction+0x2d8d/0x51d0 drivers/android/binder.c:3307 binder_thread_write+0x504/0x1ee0 drivers/android/binder.c:3792 binder_ioctl_write_read drivers/android/binder.c:4825 [inline] binder_ioctl+0xc96/0x1349 drivers/android/binder.c:5002 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x196/0x10c0 fs/ioctl.c:696 ksys_ioctl+0x62/0x90 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x6e/0xb0 fs/ioctl.c:718 do_syscall_64+0xd0/0x4d0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4592c9 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f736a775c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004592c9 RDX: 0000000020000440 RSI: 00000000c0306201 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f736a7766d4 R13: 00000000004c078e R14: 00000000004d3248 R15: 00000000ffffffff Modules linked in: ---[ end trace a3d0881f917d39f9 ]--- IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready RIP: 0010:binder_alloc_do_buffer_copy+0xae/0x420 drivers/android/binder_alloc.c:1141 8021q: adding VLAN 0 to HW filter on device team0 Code: 24 58 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3a 03 00 00 49 8b 44 24 58 48 29 d8 49 39 c5 76 02 <0f> 0b 4c 29 e8 49 39 c7 77 f6 41 f6 c7 03 75 f0 48 8b 45 b8 48 8d 8021q: adding VLAN 0 to HW filter on device batadv0 RSP: 0018:ffff88809a98f398 EFLAGS: 00010202 kobject: 'vlan0' (0000000082f674f9): kobject_add_internal: parent: 'mesh', set: '' RAX: 0000000000000078 RBX: 0000000020001000 RCX: 00000000000000e8 RDX: 1ffff110148ffe3b RSI: 0000000000000000 RDI: ffff8880a47ff1d8 8021q: adding VLAN 0 to HW filter on device bond0 RBP: ffff88809a98f410 R08: ffff88809a98f458 R09: 0000000000000008 8021q: adding VLAN 0 to HW filter on device team0 R10: ffffed1013531f0c R11: ffff88809a98f867 R12: ffff8880a47ff180 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready kobject: 'loop5' (00000000a9d0e89c): kobject_uevent_env IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready R13: 0000000000000008 R14: ffff8880984d78d0 R15: 00000000000000e8 kobject: 'loop5' (00000000a9d0e89c): fill_kobj_path: path = '/devices/virtual/block/loop5' bridge0: port 1(bridge_slave_0) entered blocking state FS: 00007f736a776700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000 bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready CR2: 00000000004e77a0 CR3: 0000000086eb9000 CR4: 00000000001406f0 bridge0: port 2(bridge_slave_1) entered blocking state binder: BINDER_SET_CONTEXT_MGR already set bridge0: port 2(bridge_slave_1) entered forwarding state DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 binder: 7078:7079 ioctl 40046207 0 returned -16 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ------------[ cut here ]------------