bisecting cause commit starting from 15ac8fdb74403772780be1a8c4f7c1eff1040fc4 building syzkaller on 51a9082e064119316893e12187cab2843283ed4d testing commit 15ac8fdb74403772780be1a8c4f7c1eff1040fc4 with gcc (GCC) 8.1.0 kernel signature: a7b140657b98ecf533a868ed61174dd64cd1d917d6d463dffbb1410e5df15ee3 all runs: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 8.1.0 kernel signature: 0a239a63f936e094afcdc973a4a1640a49766a3338df273434ed919c9d53b108 all runs: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: 43a299fc537e8c714d4f291e0dd750ca62379f64f4e403b6386c91532496a188 run #0: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #1: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #2: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #3: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #4: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #5: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #6: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #7: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #8: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked run #9: boot failed: can't ssh into the instance testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.1.0 kernel signature: 9d59fff760a571f9aef85675458244dad39af3409ec46744bf8b4640c1f90dc9 all runs: crashed: UBSAN: shift-out-of-bounds in snd_pcm_oss_change_params_locked testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 5a651a957f7b2d0a6c6a5e0d01901f2c562ec4a7117c85fb3ead69e0c7d7e9d0 all runs: crashed: UBSAN: undefined-behaviour in snd_pcm_oss_change_params_locked testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: 45db3359cea7d227a48aa67f77f64e309fe5579e273b03525727363462e79b2e all runs: crashed: UBSAN: undefined-behaviour in snd_pcm_oss_change_params_locked testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: 8c05250c5f3378271bc4a038b521dee136b4ac7982c41a849b91d0eb16099fa4 all runs: crashed: UBSAN: undefined-behaviour in snd_pcm_oss_change_params_locked testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 20ba57603f6377c5e073ce6a66b762e7782253146a352daa80104ec2b5a98d86 all runs: crashed: UBSAN: undefined-behaviour in snd_pcm_oss_change_params_locked testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: 671d4b1d247e018930d04001b74feca42e2262a7ea06aaa729f3b7bbc46790d8 all runs: OK # git bisect start 4d856f72c10ecb060868ed10ff1b1453943fc6c8 0ecfebd2b52404ae0c54a878c872bb93363ada36 Bisecting: 7848 revisions left to test after this (roughly 13 steps) [43c95d3694cc448fdf50bd53b7ff3a5bb4655883] Merge tag 'pinctrl-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 with gcc (GCC) 8.1.0 kernel signature: 1fa48a1d331e76f77ab8c7b908b754a2ec4120e98ae55ebb13cdc6a25a55a834 all runs: OK # git bisect good 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 Bisecting: 3922 revisions left to test after this (roughly 12 steps) [0e2a5b5bd9a6aaec85df347dd71432a1d2d10763] Merge branch 'parisc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux testing commit 0e2a5b5bd9a6aaec85df347dd71432a1d2d10763 with gcc (GCC) 8.1.0 kernel signature: 7de33c1c225a10aa3844eb58a4cbb476e5bb68e1c858357eb8b766973746a566 all runs: OK # git bisect good 0e2a5b5bd9a6aaec85df347dd71432a1d2d10763 Bisecting: 1961 revisions left to test after this (roughly 11 steps) [12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea] perf record: Fix module size on s390 testing commit 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea with gcc (GCC) 8.1.0 kernel signature: 71359ffa06d1eff8b0f09570522aa494f7c78683b1f14a898febcc641236b955 all runs: OK # git bisect good 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea Bisecting: 984 revisions left to test after this (roughly 10 steps) [85d8d3b172eb37b23dcdbe9fa7a85e343642bfea] Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux testing commit 85d8d3b172eb37b23dcdbe9fa7a85e343642bfea with gcc (GCC) 8.1.0 kernel signature: 8d46389f3ea340b80df42ae8716f8021cf535dd28832e5c1ab38730132f5ceaf all runs: OK # git bisect good 85d8d3b172eb37b23dcdbe9fa7a85e343642bfea Bisecting: 496 revisions left to test after this (roughly 9 steps) [6525771f58cbc6ab97b5cff9069865cde8283346] Merge tag 'arc-5.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc testing commit 6525771f58cbc6ab97b5cff9069865cde8283346 with gcc (GCC) 8.1.0 kernel signature: a1252c84657efff60a0183187022cd7c77751b082283ead1715c2c1dcd703e0f all runs: OK # git bisect good 6525771f58cbc6ab97b5cff9069865cde8283346 Bisecting: 251 revisions left to test after this (roughly 8 steps) [345464fb760d1b772e891538b498e111c588b692] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 345464fb760d1b772e891538b498e111c588b692 with gcc (GCC) 8.1.0 kernel signature: fce5439189a5ed25bb69a4915fcb1c7210b70475a605a97be1f2150213be546d all runs: OK # git bisect good 345464fb760d1b772e891538b498e111c588b692 Bisecting: 126 revisions left to test after this (roughly 7 steps) [840ce8f8073edb3ff3d2c2c7a6ef211f4176961c] Merge tag 'pinctrl-v5.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 840ce8f8073edb3ff3d2c2c7a6ef211f4176961c with gcc (GCC) 8.1.0 kernel signature: 84d3e346b4aa70afe93514fd532b33554ad4bc47cfbae24b445930156b72f726 all runs: OK # git bisect good 840ce8f8073edb3ff3d2c2c7a6ef211f4176961c Bisecting: 63 revisions left to test after this (roughly 6 steps) [c3dc1fa72249e4472b90ecef4dbafe25f0f07889] net: hns3: fix spelling mistake "undeflow" -> "underflow" testing commit c3dc1fa72249e4472b90ecef4dbafe25f0f07889 with gcc (GCC) 8.1.0 kernel signature: fdf50ac52c103418455d0e76508cdc1c6890c2f6a6d848c8f2531d917ed4dd1c all runs: OK # git bisect good c3dc1fa72249e4472b90ecef4dbafe25f0f07889 Bisecting: 30 revisions left to test after this (roughly 5 steps) [1c4c5e2528af0c803fb1171632074f4070229a75] Merge tag 'mmc-v5.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc testing commit 1c4c5e2528af0c803fb1171632074f4070229a75 with gcc (GCC) 8.1.0 kernel signature: 1f42d483ae6f51d937221b325279e1905dea0d312725385536c4bcece8695089 all runs: OK # git bisect good 1c4c5e2528af0c803fb1171632074f4070229a75 Bisecting: 14 revisions left to test after this (roughly 4 steps) [ae3b06ed55b1554e9a91bf959c6b0b5e212e7f4d] Merge branch 'sctp_do_bind-leak' testing commit ae3b06ed55b1554e9a91bf959c6b0b5e212e7f4d with gcc (GCC) 8.1.0 kernel signature: 99c9dfce9f62a5e18765bc581729dedbadd68a7c463b2e668066ab5676a70b56 all runs: OK # git bisect good ae3b06ed55b1554e9a91bf959c6b0b5e212e7f4d Bisecting: 8 revisions left to test after this (roughly 3 steps) [a9c20bb0206ae9384bd470a6832dd8913730add9] Merge tag 'kvm-s390-master-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master testing commit a9c20bb0206ae9384bd470a6832dd8913730add9 with gcc (GCC) 8.1.0 kernel signature: ef56954196981f3b756c4e32abbe19bcc312240c9cd30762f3afae629908f82d run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: general protection fault in batadv_iv_ogm_queue_add reproducer seems to be flaky # git bisect bad a9c20bb0206ae9384bd470a6832dd8913730add9 Bisecting: 2 revisions left to test after this (roughly 2 steps) [002c5f73c508f7df5681bda339831c27f3c1aef4] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot testing commit 002c5f73c508f7df5681bda339831c27f3c1aef4 with gcc (GCC) 8.1.0 kernel signature: ef56954196981f3b756c4e32abbe19bcc312240c9cd30762f3afae629908f82d all runs: OK # git bisect good 002c5f73c508f7df5681bda339831c27f3c1aef4 Bisecting: 0 revisions left to test after this (roughly 1 step) [53936b5bf35e140ae27e4bbf0447a61063f400da] KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl testing commit 53936b5bf35e140ae27e4bbf0447a61063f400da with gcc (GCC) 8.1.0 kernel signature: 91cd89752b117da7768dcf098d8d14da1156df425822b60fbaac1b43d596b449 all runs: OK # git bisect good 53936b5bf35e140ae27e4bbf0447a61063f400da a9c20bb0206ae9384bd470a6832dd8913730add9 is the first bad commit commit a9c20bb0206ae9384bd470a6832dd8913730add9 Merge: 002c5f73c508 53936b5bf35e Author: Paolo Bonzini Date: Sat Sep 14 09:25:30 2019 +0200 Merge tag 'kvm-s390-master-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: Fixes for 5.3 - prevent a user triggerable oops in the migration code - do not leak kernel stack content arch/s390/kvm/interrupt.c | 10 ++++++++++ arch/s390/kvm/kvm-s390.c | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-) Reproducer flagged being flaky revisions tested: 22, total time: 4h46m8.43557877s (build: 1h59m43.967233799s, test: 2h43m50.078758305s) first bad commit: a9c20bb0206ae9384bd470a6832dd8913730add9 Merge tag 'kvm-s390-master-5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master recipients (to): ["pbonzini@redhat.com"] recipients (cc): [] crash: general protection fault in batadv_iv_ogm_queue_add kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.3.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:batadv_iv_ogm_queue_add+0x9b/0xe50 net/batman-adv/bat_iv_ogm.c:605 Code: 44 89 8d 64 ff ff ff c7 02 f1 f1 f1 f1 c7 42 04 04 f2 f2 f2 48 89 fa 65 48 8b 0c 25 28 00 00 00 48 89 4d d0 31 c9 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 99 0b 00 00 RSP: 0018:ffff8880b57c7aa8 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8880a2222c40 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: ffff8880b57c7bc0 R08: ffff8880a0839400 R09: 0000000000000001 R10: ffffed1016af8f8c R11: 0000000000000003 R12: ffff8880a0839400 R13: dffffc0000000000 R14: ffffed101410728e R15: 000000000000003c FS: 0000000000000000(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005646efc2b130 CR3: 00000000a6762000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_iv_ogm_schedule+0xb47/0xe80 net/batman-adv/bat_iv_ogm.c:813 batadv_iv_send_outstanding_bat_ogm_packet+0x570/0x7d0 net/batman-adv/bat_iv_ogm.c:1675 process_one_work+0x7d2/0x1560 kernel/workqueue.c:2269 worker_thread+0x85/0xb60 kernel/workqueue.c:2415 kthread+0x331/0x3f0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 222d5e1c8699ea84 ]--- RIP: 0010:batadv_iv_ogm_queue_add+0x9b/0xe50 net/batman-adv/bat_iv_ogm.c:605 Code: 44 89 8d 64 ff ff ff c7 02 f1 f1 f1 f1 c7 42 04 04 f2 f2 f2 48 89 fa 65 48 8b 0c 25 28 00 00 00 48 89 4d d0 31 c9 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 99 0b 00 00 RSP: 0018:ffff8880b57c7aa8 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff8880a2222c40 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: ffff8880b57c7bc0 R08: ffff8880a0839400 R09: 0000000000000001 R10: ffffed1016af8f8c R11: 0000000000000003 R12: ffff8880a0839400 R13: dffffc0000000000 R14: ffffed101410728e R15: 000000000000003c FS: 0000000000000000(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005646efc2b130 CR3: 00000000a6762000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400