bisecting fixing commit since ba5f4cfeac77fca981b199ec7f2396a3616e5216 building syzkaller on 2d5ea0cb6edb828803beea8af38dbc04dc80f028 testing commit ba5f4cfeac77fca981b199ec7f2396a3616e5216 compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 27f9281d524877ca3ad3f2b8c76e8ca153acaa6a2337d9da5593caebe5c30503 run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: WARNING in hrtimer_forward run #8: crashed: WARNING in hrtimer_forward run #9: crashed: WARNING in hrtimer_forward run #10: crashed: WARNING in hrtimer_forward run #11: crashed: WARNING in hrtimer_forward run #12: crashed: WARNING in hrtimer_forward run #13: crashed: WARNING in hrtimer_forward run #14: crashed: WARNING in hrtimer_forward run #15: crashed: WARNING in hrtimer_forward run #16: crashed: WARNING in hrtimer_forward run #17: crashed: WARNING in hrtimer_forward run #18: OK run #19: OK testing current HEAD cc0356d6a02e064387c16a83cb96fe43ef33181e testing commit cc0356d6a02e064387c16a83cb96fe43ef33181e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7356fafa476592dc095ed145eaf110409ed221b096aaea0de55916d985005a4a all runs: OK # git bisect start cc0356d6a02e064387c16a83cb96fe43ef33181e ba5f4cfeac77fca981b199ec7f2396a3616e5216 Bisecting: 48586 revisions left to test after this (roughly 16 steps) [ef1244124349fea36e4a7e260ecaf156b6b6b22a] Merge tag 'usb-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb testing commit ef1244124349fea36e4a7e260ecaf156b6b6b22a compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c05404ca3ae03d617d2b86c102964e583236b1b611d22ea2847945111da5f969 all runs: crashed: WARNING in hrtimer_forward # git bisect good ef1244124349fea36e4a7e260ecaf156b6b6b22a Bisecting: 24314 revisions left to test after this (roughly 15 steps) [303392fd5c160822bf778270b28ec5ea50cab2b4] Merge tag 'leds-5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds testing commit 303392fd5c160822bf778270b28ec5ea50cab2b4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: f57979905660629a02ff6489864d22dac92cf5aec1a9eae5fadc70edfef21533 all runs: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(NUM,NUM) # git bisect skip 303392fd5c160822bf778270b28ec5ea50cab2b4 Bisecting: 24313 revisions left to test after this (roughly 15 steps) [d2500a0c0e73d4387cde9185edcdf397f52e428b] scsi: blkcg: Fix application ID config options testing commit d2500a0c0e73d4387cde9185edcdf397f52e428b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: efab030bfcf4f52079f6423268d63e849236f14427abf09b916a10bf2eba12ce all runs: boot failed: kernel panic: VFS: Unable to mount root fs on unknown-block(NUM,NUM) # git bisect skip d2500a0c0e73d4387cde9185edcdf397f52e428b Bisecting: 24313 revisions left to test after this (roughly 15 steps) [f4ac73023449e6f2f74f69e38f4840c83edfa840] signal: Rename SIL_PERF_EVENT SIL_FAULT_PERF_EVENT for consistency testing commit f4ac73023449e6f2f74f69e38f4840c83edfa840 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ae4c7b371d0adc89a41a88c327f35627376975bbe104f00efcdcd068acd60774 run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: WARNING in hrtimer_forward run #8: crashed: WARNING in hrtimer_forward run #9: OK # git bisect good f4ac73023449e6f2f74f69e38f4840c83edfa840 Bisecting: 10080 revisions left to test after this (roughly 13 steps) [b5d6d2633c1b6b2b4599f658f8abe7eb1358cc77] Merge tag 'xtensa-20210902' of git://github.com/jcmvbkbc/linux-xtensa testing commit b5d6d2633c1b6b2b4599f658f8abe7eb1358cc77 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e50ed3657670701c280fca54fad63b18c940f5fb90b6c23ebcd9f95de98d15fc all runs: crashed: WARNING in hrtimer_forward # git bisect good b5d6d2633c1b6b2b4599f658f8abe7eb1358cc77 Bisecting: 5040 revisions left to test after this (roughly 12 steps) [061514dbfb79910ef60eb40dd9fc528be3f45d62] regulator: lp872x: Remove lp872x_dvs_state testing commit 061514dbfb79910ef60eb40dd9fc528be3f45d62 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: efa9d6e5364ee233051e5369b11669fd0895e5ebdb43a60438edf016f7b2cb12 all runs: OK # git bisect bad 061514dbfb79910ef60eb40dd9fc528be3f45d62 Bisecting: 2525 revisions left to test after this (roughly 11 steps) [6dcaf9fb623fb87b08e3896cdf6116744bf00668] Merge tag 'modules-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux testing commit 6dcaf9fb623fb87b08e3896cdf6116744bf00668 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9e6333c82c8f0b78936bc253198280f6b0938d1306a86183bc314551655d87da run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: KASAN: use-after-free Read in __d_alloc run #8: OK run #9: crashed: KASAN: use-after-free Read in __d_alloc # git bisect good 6dcaf9fb623fb87b08e3896cdf6116744bf00668 Bisecting: 1259 revisions left to test after this (roughly 10 steps) [5739844347518a0f4c327ae79e73fb101d864726] Merge tag 'for-linus-5.15b-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip testing commit 5739844347518a0f4c327ae79e73fb101d864726 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ab089258cb93ef7e0ffd70becb9ff2aff837b5f66431aad1df1fc056d1055592 run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: OK run #8: crashed: WARNING in hrtimer_forward run #9: OK # git bisect good 5739844347518a0f4c327ae79e73fb101d864726 Bisecting: 599 revisions left to test after this (roughly 9 steps) [3e899c7209dd8f7afca59518c5ace0f03385dbc3] Merge tag 'armsoc-fixes-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 3e899c7209dd8f7afca59518c5ace0f03385dbc3 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6491de861f3ac3690b0504e34663f3ce93caf4f3ae06bd46ad2ac5c4a143c050 all runs: OK # git bisect bad 3e899c7209dd8f7afca59518c5ace0f03385dbc3 Bisecting: 315 revisions left to test after this (roughly 8 steps) [4de593fb965fc2bd11a0b767e0c65ff43540a6e4] Merge tag 'net-5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 4de593fb965fc2bd11a0b767e0c65ff43540a6e4 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9fc900117ac6b2725e73136aa4e6d5ed7988b1cbc7bb751e0dc00f55b733c3af all runs: OK # git bisect bad 4de593fb965fc2bd11a0b767e0c65ff43540a6e4 Bisecting: 171 revisions left to test after this (roughly 8 steps) [0513e464f9007b70b96740271a948ca5ab6e7dd7] Merge tag 'perf-tools-fixes-for-v5.15-2021-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux testing commit 0513e464f9007b70b96740271a948ca5ab6e7dd7 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 03cd17b53c4abf9b6cc0753dbbcc78568b9c8e41f1d595c5d200da39125dbc87 all runs: crashed: WARNING in hrtimer_forward # git bisect good 0513e464f9007b70b96740271a948ca5ab6e7dd7 Bisecting: 84 revisions left to test after this (roughly 7 steps) [115f6134a050bb098414f38555a5ab780ebbfef0] Merge tag 'gpio-fixes-for-v5.15-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux testing commit 115f6134a050bb098414f38555a5ab780ebbfef0 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 01423500f0e8d2637a4e0cb83b412d38aec7cec7fa69233cb2b91a12b6307748 run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: OK run #7: crashed: WARNING in hrtimer_forward run #8: OK run #9: crashed: WARNING in hrtimer_forward # git bisect good 115f6134a050bb098414f38555a5ab780ebbfef0 Bisecting: 41 revisions left to test after this (roughly 5 steps) [ca48aa4ab8bfe0c235cf86cd0d3c11db0808132e] Merge tag 'mac80211-for-net-2021-09-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 testing commit ca48aa4ab8bfe0c235cf86cd0d3c11db0808132e compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9bd7c54b907245c3d983749d2b4b3ab1c21ccd61a7b3e03ecab5f512557e0b70 all runs: OK # git bisect bad ca48aa4ab8bfe0c235cf86cd0d3c11db0808132e Bisecting: 18 revisions left to test after this (roughly 5 steps) [7fe7f3182a0dd8f9bad463598ed103b3d8cfa739] Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf testing commit 7fe7f3182a0dd8f9bad463598ed103b3d8cfa739 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ae15d62232d7916862c77f1b18fe2b0a4d1eb797e8b7336810bcbe76d181b03f run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: WARNING in hrtimer_forward run #8: crashed: WARNING in hrtimer_forward run #9: OK # git bisect good 7fe7f3182a0dd8f9bad463598ed103b3d8cfa739 Bisecting: 9 revisions left to test after this (roughly 3 steps) [33092aca857bf35a8e9cac0e8340c685a4796e90] mac80211: Fix Ptk0 rekey documentation testing commit 33092aca857bf35a8e9cac0e8340c685a4796e90 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 97a80e27fd3c9ed283bd8d2ee5b7ba5d61957de8dfcb7ce12f9047d8d640d1fe all runs: OK # git bisect bad 33092aca857bf35a8e9cac0e8340c685a4796e90 Bisecting: 4 revisions left to test after this (roughly 2 steps) [13cb6d826e0ac0d144b0d48191ff1a111d32f0c6] mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap testing commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5eb4001e2f05130fe810a652fde33f75b456589a2adb903445345da3aee2e35d run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: WARNING in hrtimer_forward run #8: OK run #9: crashed: WARNING in hrtimer_forward # git bisect good 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 Bisecting: 2 revisions left to test after this (roughly 1 step) [313bbd1990b6ddfdaa7da098d0c56b098a833572] mac80211-hwsim: fix late beacon hrtimer handling testing commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5f7024c01eed1923eb903320711b30982e816d4d38d0bed410ec56567807a565 all runs: OK # git bisect bad 313bbd1990b6ddfdaa7da098d0c56b098a833572 Bisecting: 0 revisions left to test after this (roughly 0 steps) [b9731062ce8afd35cf723bf3a8ad55d208f915a5] mac80211: mesh: fix potentially unaligned access testing commit b9731062ce8afd35cf723bf3a8ad55d208f915a5 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 01620412aa7cebc6a04b5e30c16328c07f12155e82e427667a8f6976157e57c4 run #0: crashed: WARNING in hrtimer_forward run #1: crashed: WARNING in hrtimer_forward run #2: crashed: WARNING in hrtimer_forward run #3: crashed: WARNING in hrtimer_forward run #4: crashed: WARNING in hrtimer_forward run #5: crashed: WARNING in hrtimer_forward run #6: crashed: WARNING in hrtimer_forward run #7: crashed: WARNING in hrtimer_forward run #8: OK run #9: OK # git bisect good b9731062ce8afd35cf723bf3a8ad55d208f915a5 313bbd1990b6ddfdaa7da098d0c56b098a833572 is the first bad commit commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 Author: Johannes Berg Date: Wed Sep 15 11:29:37 2021 +0200 mac80211-hwsim: fix late beacon hrtimer handling Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already: 1 2 3 N N+1 | | | ... | | ^ intended to fire here (1) ^ next deadline here (2) ^ actually fired here The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc. Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point. Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time. Suggested-by: Thomas Gleixner Reported-by: Dmitry Vyukov Reported-by: syzbot+0e964fad69a9c462bc1e@syzkaller.appspotmail.com Fixes: 01e59e467ecf ("mac80211_hwsim: hrtimer beacon") Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/20210915112936.544f383472eb.I3f9712009027aa09244b65399bf18bf482a8c4f1@changeid Signed-off-by: Johannes Berg drivers/net/wireless/mac80211_hwsim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) culprit signature: 5f7024c01eed1923eb903320711b30982e816d4d38d0bed410ec56567807a565 parent signature: 01620412aa7cebc6a04b5e30c16328c07f12155e82e427667a8f6976157e57c4 revisions tested: 20, total time: 5h54m10.718781731s (build: 2h12m7.951433374s, test: 3h39m21.698522729s) first good commit: 313bbd1990b6ddfdaa7da098d0c56b098a833572 mac80211-hwsim: fix late beacon hrtimer handling recipients (to): ["davem@davemloft.net" "johannes.berg@intel.com" "johannes@sipsolutions.net" "kuba@kernel.org" "linux-wireless@vger.kernel.org" "netdev@vger.kernel.org" "tglx@linutronix.de"] recipients (cc): ["kvalo@codeaurora.org" "linux-kernel@vger.kernel.org"]