bisecting fixing commit since 4fccc2503536a564a4ba31a1d50439854201659f building syzkaller on 2c36e7a75f8689b3da20e1a81a2ee5391f3af6e5 testing commit 4fccc2503536a564a4ba31a1d50439854201659f with gcc (GCC) 8.1.0 kernel signature: fb1cc8273657392d9bf2729864a9137731031cba65447b21932d6180f2d3c88d all runs: crashed: INFO: task hung in htable_put testing current HEAD 14cfdbd39e316efd91ae6e403ef8211f0b022603 testing commit 14cfdbd39e316efd91ae6e403ef8211f0b022603 with gcc (GCC) 8.1.0 kernel signature: 816a625e1ac786773cb8379a747b4c86e27f2764223a18fa89dda788105c6f63 all runs: OK # git bisect start 14cfdbd39e316efd91ae6e403ef8211f0b022603 4fccc2503536a564a4ba31a1d50439854201659f Bisecting: 294 revisions left to test after this (roughly 8 steps) [7fb440c5c3524194864e0d65f8f8c9ee74c09ee2] soc/tegra: fuse: Fix build with Tegra194 configuration testing commit 7fb440c5c3524194864e0d65f8f8c9ee74c09ee2 with gcc (GCC) 8.1.0 kernel signature: 1a5b2a679eff2395096537ac917790505d5fa5282f956e4abc7ee8e82f68fe03 all runs: OK # git bisect bad 7fb440c5c3524194864e0d65f8f8c9ee74c09ee2 Bisecting: 146 revisions left to test after this (roughly 7 steps) [149412daa253bd38ac4c213dc2de1ddfb7839d80] s390/ftrace: generate traced function stack frame testing commit 149412daa253bd38ac4c213dc2de1ddfb7839d80 with gcc (GCC) 8.1.0 kernel signature: 7eb3e0657c37af772555bf389acdfd878fcff65b1ecd2733dcd6ac352cd60af8 run #0: crashed: INFO: task hung in htable_put run #1: crashed: INFO: task hung in htable_put run #2: crashed: INFO: task hung in htable_put run #3: crashed: INFO: task hung in htable_put run #4: crashed: INFO: task hung in synchronize_rcu run #5: crashed: INFO: task hung in htable_put run #6: crashed: INFO: task hung in htable_put run #7: crashed: INFO: task hung in htable_put run #8: crashed: INFO: task hung in htable_put run #9: crashed: INFO: task hung in htable_put # git bisect good 149412daa253bd38ac4c213dc2de1ddfb7839d80 Bisecting: 73 revisions left to test after this (roughly 6 steps) [4512119ac90a9d438837f4b528a9e7d7d26e8bef] jbd2: fix ocfs2 corrupt when clearing block group bits testing commit 4512119ac90a9d438837f4b528a9e7d7d26e8bef with gcc (GCC) 8.1.0 kernel signature: 9efaf5bc0979dda93140f50fc8c49c64a6ab24905073a35eeeafdb9a34f97391 all runs: crashed: INFO: task hung in htable_put # git bisect good 4512119ac90a9d438837f4b528a9e7d7d26e8bef Bisecting: 36 revisions left to test after this (roughly 5 steps) [e541982a6e5f5933ec2108f6a41feeb711e8ec82] KVM: apic: avoid calculating pending eoi from an uninitialized val testing commit e541982a6e5f5933ec2108f6a41feeb711e8ec82 with gcc (GCC) 8.1.0 kernel signature: c68e21d39ef62e0a46d4dbc13ba4187bed9483f313815f4b819ca7a85a75626e all runs: crashed: INFO: task hung in htable_put # git bisect good e541982a6e5f5933ec2108f6a41feeb711e8ec82 Bisecting: 18 revisions left to test after this (roughly 4 steps) [5a2972600a2f845d860f2a4c51b979c608cb1e9b] ALSA: seq: Fix concurrent access to queue current tick/time testing commit 5a2972600a2f845d860f2a4c51b979c608cb1e9b with gcc (GCC) 8.1.0 kernel signature: f65e3c242f381c5f0cb53d62c720f3ff1dff27302c7e443ce718eee080d80db6 all runs: crashed: INFO: task hung in htable_put # git bisect good 5a2972600a2f845d860f2a4c51b979c608cb1e9b Bisecting: 9 revisions left to test after this (roughly 3 steps) [1d8780188c8d7f009a05d40fbb8a111eab89746d] iwlwifi: pcie: fix rb_allocator workqueue allocation testing commit 1d8780188c8d7f009a05d40fbb8a111eab89746d with gcc (GCC) 8.1.0 kernel signature: f7b234b90cf561621684b8d96e4d45db1ec6d0a2ade6d923aca6160875f64aa2 all runs: OK # git bisect bad 1d8780188c8d7f009a05d40fbb8a111eab89746d Bisecting: 4 revisions left to test after this (roughly 2 steps) [fee87e931cc58435463975730a892d83af21d98c] xen: Enable interrupts when calling _cond_resched() testing commit fee87e931cc58435463975730a892d83af21d98c with gcc (GCC) 8.1.0 kernel signature: 54633a37fd0aac21efbd8d908817ba6058e0cb96a90342f7c8a9ebb6f4322154 all runs: OK # git bisect bad fee87e931cc58435463975730a892d83af21d98c Bisecting: 1 revision left to test after this (roughly 1 step) [43cac315bec132e962e04c31fe888caac257ec0a] rxrpc: Fix call RCU cleanup using non-bh-safe locks testing commit 43cac315bec132e962e04c31fe888caac257ec0a with gcc (GCC) 8.1.0 kernel signature: 988825c3dd39a622e47cf547cae5277991c7f241c97243431de5fd66de2e967c all runs: OK # git bisect bad 43cac315bec132e962e04c31fe888caac257ec0a Bisecting: 0 revisions left to test after this (roughly 0 steps) [acbc5071f073bc368d7d4f63902adf536cf37772] netfilter: xt_hashlimit: limit the max size of hashtable testing commit acbc5071f073bc368d7d4f63902adf536cf37772 with gcc (GCC) 8.1.0 kernel signature: fdfca8c137d83079abebf51884b0454359f6d3cb143e006dc96b65ab3d8601fc all runs: OK # git bisect bad acbc5071f073bc368d7d4f63902adf536cf37772 acbc5071f073bc368d7d4f63902adf536cf37772 is the first bad commit commit acbc5071f073bc368d7d4f63902adf536cf37772 Author: Cong Wang Date: Sun Feb 2 20:30:53 2020 -0800 netfilter: xt_hashlimit: limit the max size of hashtable commit 8d0015a7ab76b8b1e89a3e5f5710a6e5103f2dd5 upstream. The user-specified hashtable size is unbound, this could easily lead to an OOM or a hung task as we hold the global mutex while allocating and initializing the new hashtable. Add a max value to cap both cfg->size and cfg->max, as suggested by Florian. Reported-and-tested-by: syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com Signed-off-by: Cong Wang Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman net/netfilter/xt_hashlimit.c | 10 ++++++++++ 1 file changed, 10 insertions(+) culprit signature: fdfca8c137d83079abebf51884b0454359f6d3cb143e006dc96b65ab3d8601fc parent signature: f65e3c242f381c5f0cb53d62c720f3ff1dff27302c7e443ce718eee080d80db6 revisions tested: 11, total time: 3h22m49.707670915s (build: 1h45m54.682208304s, test: 1h35m24.47969791s) first good commit: acbc5071f073bc368d7d4f63902adf536cf37772 netfilter: xt_hashlimit: limit the max size of hashtable cc: ["fw@strlen.de" "gregkh@linuxfoundation.org" "pablo@netfilter.org" "syzbot+adf6c6c2be1c3a718121@syzkaller.appspotmail.com" "xiyou.wangcong@gmail.com"]