bisecting fixing commit since 1c200f832e14420fa770193f9871f4ce2df00d07 building syzkaller on aba2b2fb3544d9e42991237c13d8cada421deda5 testing commit 1c200f832e14420fa770193f9871f4ce2df00d07 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 1dfbeb8bb6e81f05a3e2e8943b093273ff3ae3a25bde93d630d322147a3fee57 all runs: crashed: WARNING: ODEBUG bug in __sk_destruct testing current HEAD c7d102232649226a69dddd58a4942cf13cff4f7c testing commit c7d102232649226a69dddd58a4942cf13cff4f7c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 310edb608e9a850ba69a54bfd9d49f41aef0c8999b0dd8b40f6829afd55975b3 all runs: OK # git bisect start c7d102232649226a69dddd58a4942cf13cff4f7c 1c200f832e14420fa770193f9871f4ce2df00d07 Bisecting: 7711 revisions left to test after this (roughly 13 steps) [e058a84bfddc42ba356a2316f2cf1141974625c9] Merge tag 'drm-next-2021-07-01' of git://anongit.freedesktop.org/drm/drm testing commit e058a84bfddc42ba356a2316f2cf1141974625c9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: a7828917da89033a80bbe69cf71bdc476d0812ab09026871c91769e0d74f0232 run #0: basic kernel testing failed: BUG: sleeping function called from invalid context in stack_depot_save run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad e058a84bfddc42ba356a2316f2cf1141974625c9 Bisecting: 4140 revisions left to test after this (roughly 12 steps) [a6eaf3850cb171c328a8b0db6d3c79286a1eba9d] Merge tag 'sched-urgent-2021-06-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit a6eaf3850cb171c328a8b0db6d3c79286a1eba9d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 0e0bb753111e9b0666743bcd8d23b2cd0ef6eef1c9d528dd9eb0dd9813758d65 run #0: basic kernel testing failed: BUG: sleeping function called from invalid context in stack_depot_save run #1: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #2: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #3: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #4: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #5: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #6: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #7: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #8: crashed: WARNING: ODEBUG bug in free_pcp_prepare run #9: crashed: WARNING: ODEBUG bug in free_pcp_prepare # git bisect good a6eaf3850cb171c328a8b0db6d3c79286a1eba9d Bisecting: 2072 revisions left to test after this (roughly 11 steps) [007b312c6f294770de01fbc0643610145012d244] Merge tag 'mac80211-next-for-net-next-2021-06-25' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next testing commit 007b312c6f294770de01fbc0643610145012d244 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 1acc136d844a704e94ea9cf635123cd44f8c2e195258029edb8113121c337f54 all runs: crashed: WARNING: ODEBUG bug in __sk_destruct # git bisect good 007b312c6f294770de01fbc0643610145012d244 Bisecting: 1036 revisions left to test after this (roughly 10 steps) [18703923a66aecf6f7ded0e16d22eb412ddae72f] drm/amdgpu: Fix incorrect register offsets for Sienna Cichlid testing commit 18703923a66aecf6f7ded0e16d22eb412ddae72f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 9fac2a6c1c892a46effb3a725f3104f80d1654b5c98b80a5474178dace4a71fd run #0: crashed: WARNING: ODEBUG bug in __sk_destruct run #1: crashed: WARNING: ODEBUG bug in __sk_destruct run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK reproducer seems to be flaky # git bisect good 18703923a66aecf6f7ded0e16d22eb412ddae72f Bisecting: 509 revisions left to test after this (roughly 9 steps) [334200bf52f0637a5ab8331c557dfcecbb9c30fa] Merge tag 'drm-msm-next-2021-06-23b' of https://gitlab.freedesktop.org/drm/msm into drm-next testing commit 334200bf52f0637a5ab8331c557dfcecbb9c30fa compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 953ea248e03f3590c1ecfb698486008f2e86a5418a794fdb82ec44b994734ba0 run #0: crashed: WARNING: ODEBUG bug in __sk_destruct run #1: crashed: WARNING: ODEBUG bug in __sk_destruct run #2: crashed: WARNING: ODEBUG bug in __sk_destruct run #3: crashed: WARNING: ODEBUG bug in __sk_destruct run #4: crashed: WARNING: ODEBUG bug in __sk_destruct run #5: crashed: WARNING: ODEBUG bug in __sk_destruct run #6: crashed: WARNING: ODEBUG bug in __sk_destruct run #7: crashed: WARNING: ODEBUG bug in __sk_destruct run #8: crashed: WARNING: ODEBUG bug in __sk_destruct run #9: crashed: WARNING: ODEBUG bug in __sk_destruct run #10: crashed: WARNING: ODEBUG bug in __sk_destruct run #11: crashed: WARNING: ODEBUG bug in __sk_destruct run #12: crashed: WARNING: ODEBUG bug in __sk_destruct run #13: crashed: WARNING: ODEBUG bug in __sk_destruct run #14: crashed: WARNING: ODEBUG bug in __sk_destruct run #15: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #16: crashed: WARNING: ODEBUG bug in __sk_destruct run #17: crashed: WARNING: ODEBUG bug in __sk_destruct run #18: crashed: WARNING: ODEBUG bug in __sk_destruct run #19: crashed: WARNING: ODEBUG bug in __sk_destruct # git bisect good 334200bf52f0637a5ab8331c557dfcecbb9c30fa Bisecting: 206 revisions left to test after this (roughly 8 steps) [b6df00789e2831fff7a2c65aa7164b2a4dcbe599] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit b6df00789e2831fff7a2c65aa7164b2a4dcbe599 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: e79b189c058bf2e629f95a52a7b3b1791c45f2826f034f36cd7e4160e64119aa all runs: OK # git bisect bad b6df00789e2831fff7a2c65aa7164b2a4dcbe599 Bisecting: 151 revisions left to test after this (roughly 7 steps) [f0305e732a1a144dcdb1536b828ee4a5cc1d212f] Merge tag 'for-net-next-2021-06-28' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next testing commit f0305e732a1a144dcdb1536b828ee4a5cc1d212f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 34a91ba990bff08ce441622b2f4f72f874d72f884bc12d78cda894219fe3d9d3 run #0: crashed: WARNING: ODEBUG bug in __sk_destruct run #1: crashed: WARNING: ODEBUG bug in __sk_destruct run #2: crashed: WARNING: ODEBUG bug in __sk_destruct run #3: crashed: WARNING: ODEBUG bug in __sk_destruct run #4: crashed: WARNING: ODEBUG bug in __sk_destruct run #5: crashed: WARNING: ODEBUG bug in __sk_destruct run #6: crashed: WARNING: ODEBUG bug in __sk_destruct run #7: crashed: WARNING: ODEBUG bug in __sk_destruct run #8: crashed: WARNING: ODEBUG bug in __sk_destruct run #9: crashed: WARNING: ODEBUG bug in __sk_destruct run #10: crashed: WARNING: ODEBUG bug in __sk_destruct run #11: crashed: WARNING: ODEBUG bug in __sk_destruct run #12: crashed: WARNING: ODEBUG bug in __sk_destruct run #13: crashed: WARNING: ODEBUG bug in __sk_destruct run #14: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #15: crashed: WARNING: ODEBUG bug in __sk_destruct run #16: crashed: WARNING: ODEBUG bug in __sk_destruct run #17: crashed: WARNING: ODEBUG bug in __sk_destruct run #18: crashed: WARNING: ODEBUG bug in __sk_destruct run #19: crashed: WARNING: ODEBUG bug in __sk_destruct # git bisect good f0305e732a1a144dcdb1536b828ee4a5cc1d212f Bisecting: 75 revisions left to test after this (roughly 6 steps) [aaf473d0100f64abc88560e2bea905805bcf2a8e] can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0 testing commit aaf473d0100f64abc88560e2bea905805bcf2a8e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: e2b262cc7aae53e7eb089fb5c041649e07b5c61b9268a0e0a910aa73272462c7 all runs: OK # git bisect bad aaf473d0100f64abc88560e2bea905805bcf2a8e Bisecting: 37 revisions left to test after this (roughly 5 steps) [3c9ef511b9fa128a4c62e3aa0aac4c6b190f0d55] bonding: avoid adding slave device with IFF_MASTER flag testing commit 3c9ef511b9fa128a4c62e3aa0aac4c6b190f0d55 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 7751b1502ef9a515736b07b77562d2abdf274a691b6434630339439a5d71618c all runs: OK # git bisect bad 3c9ef511b9fa128a4c62e3aa0aac4c6b190f0d55 Bisecting: 18 revisions left to test after this (roughly 4 steps) [1502328f17ab0684ca5ed6764433aa0a83bdaf95] mptcp: fix bad handling of 32 bit ack wrap-around testing commit 1502328f17ab0684ca5ed6764433aa0a83bdaf95 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 215d0ac71c27d5d18c2e502f7ff1e0cc37e88afc6ca7e0de361134a4665a58da all runs: OK # git bisect bad 1502328f17ab0684ca5ed6764433aa0a83bdaf95 Bisecting: 9 revisions left to test after this (roughly 3 steps) [22c696fed25c63c7f67508309820358b94a96b6d] can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done testing commit 22c696fed25c63c7f67508309820358b94a96b6d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 6196969fae3464999ced731cad9f5bd87066222c5b3127df9438e5b66d79501c all runs: OK # git bisect bad 22c696fed25c63c7f67508309820358b94a96b6d Bisecting: 3 revisions left to test after this (roughly 2 steps) [dda2626b86c2c1813b7bfdd10d2fdd849611fc97] Merge branch 'ezchip-fixes' testing commit dda2626b86c2c1813b7bfdd10d2fdd849611fc97 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 252c0d26bae41f53ab4ce4c1a2b13753854516b4150f9534bfabec885d6980d1 run #0: crashed: WARNING: ODEBUG bug in __sk_destruct run #1: crashed: WARNING: ODEBUG bug in __sk_destruct run #2: crashed: WARNING: ODEBUG bug in __sk_destruct run #3: crashed: WARNING: ODEBUG bug in __sk_destruct run #4: crashed: WARNING: ODEBUG bug in __sk_destruct run #5: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #6: crashed: WARNING: ODEBUG bug in __sk_destruct run #7: crashed: WARNING: ODEBUG bug in __sk_destruct run #8: crashed: WARNING: ODEBUG bug in __sk_destruct run #9: crashed: WARNING: ODEBUG bug in __sk_destruct run #10: crashed: WARNING: ODEBUG bug in __sk_destruct run #11: crashed: WARNING: ODEBUG bug in __sk_destruct run #12: crashed: WARNING: ODEBUG bug in __sk_destruct run #13: crashed: WARNING: ODEBUG bug in __sk_destruct run #14: crashed: WARNING: ODEBUG bug in __sk_destruct run #15: crashed: WARNING: ODEBUG bug in __sk_destruct run #16: crashed: WARNING: ODEBUG bug in __sk_destruct run #17: crashed: WARNING: ODEBUG bug in __sk_destruct run #18: crashed: WARNING: ODEBUG bug in __sk_destruct run #19: crashed: WARNING: ODEBUG bug in __sk_destruct # git bisect good dda2626b86c2c1813b7bfdd10d2fdd849611fc97 Bisecting: 1 revision left to test after this (roughly 1 step) [fb8696ab14adadb2e3f6c17c18ed26b3ecd96691] can: gw: synchronize rcu operations before removing gw job entry testing commit fb8696ab14adadb2e3f6c17c18ed26b3ecd96691 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 1e9e7ff0a117cd095f927889aff6bc9f340fbc22cac8207b57f5cb4cb3183478 all runs: crashed: WARNING: ODEBUG bug in __sk_destruct # git bisect good fb8696ab14adadb2e3f6c17c18ed26b3ecd96691 Bisecting: 0 revisions left to test after this (roughly 0 steps) [14a4696bc3118ba49da28f79280e1d55603aa737] can: isotp: isotp_release(): omit unintended hrtimer restart on socket release testing commit 14a4696bc3118ba49da28f79280e1d55603aa737 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 26e6416a475307f0134f9a6e8de29e7f9651a933dffbec3da51ee830bc3a35d9 all runs: OK # git bisect bad 14a4696bc3118ba49da28f79280e1d55603aa737 14a4696bc3118ba49da28f79280e1d55603aa737 is the first bad commit commit 14a4696bc3118ba49da28f79280e1d55603aa737 Author: Oliver Hartkopp Date: Fri Jun 18 19:37:13 2021 +0200 can: isotp: isotp_release(): omit unintended hrtimer restart on socket release When closing the isotp socket, the potentially running hrtimers are canceled before removing the subscription for CAN identifiers via can_rx_unregister(). This may lead to an unintended (re)start of a hrtimer in isotp_rcv_cf() and isotp_rcv_fc() in the case that a CAN frame is received by isotp_rcv() while the subscription removal is processed. However, isotp_rcv() is called under RCU protection, so after calling can_rx_unregister, we may call synchronize_rcu in order to wait for any RCU read-side critical sections to finish. This prevents the reception of CAN frames after hrtimer_cancel() and therefore the unintended (re)start of the hrtimers. Link: https://lore.kernel.org/r/20210618173713.2296-1-socketcan@hartkopp.net Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Cc: linux-stable Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/isotp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) culprit signature: 26e6416a475307f0134f9a6e8de29e7f9651a933dffbec3da51ee830bc3a35d9 parent signature: 1e9e7ff0a117cd095f927889aff6bc9f340fbc22cac8207b57f5cb4cb3183478 Reproducer flagged being flaky revisions tested: 16, total time: 4h6m20.974973837s (build: 1h53m16.827381929s, test: 2h11m22.445866353s) first good commit: 14a4696bc3118ba49da28f79280e1d55603aa737 can: isotp: isotp_release(): omit unintended hrtimer restart on socket release recipients (to): ["davem@davemloft.net" "kuba@kernel.org" "linux-can@vger.kernel.org" "mkl@pengutronix.de" "mkl@pengutronix.de" "netdev@vger.kernel.org" "socketcan@hartkopp.net" "socketcan@hartkopp.net"] recipients (cc): ["linux-kernel@vger.kernel.org"]