ci2 starts bisection 2023-09-28 21:50:30.691312009 +0000 UTC m=+21986.879901539 bisecting fixing commit since c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc building syzkaller on 7ba13a158b1ad89a23920bb64208ba34fed27b08 ensuring issue is reproducible on original commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 96236f65c7852018774e351a02daca6e4264f7e0bfdc11219d91050bdc93d14e run #0: crashed: BUG: soft lockup in tc_modify_qdisc run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: BUG: soft lockup in tc_modify_qdisc run #8: crashed: BUG: soft lockup in tc_modify_qdisc run #9: crashed: BUG: soft lockup in tc_modify_qdisc run #10: crashed: BUG: soft lockup in tc_modify_qdisc run #11: crashed: BUG: soft lockup in tc_modify_qdisc run #12: crashed: BUG: soft lockup in tc_modify_qdisc run #13: crashed: BUG: soft lockup in tc_modify_qdisc run #14: crashed: BUG: soft lockup in tc_modify_qdisc run #15: crashed: BUG: soft lockup in tc_modify_qdisc run #16: crashed: no output from test machine run #17: crashed: no output from test machine run #18: crashed: BUG: soft lockup in tc_modify_qdisc run #19: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0b6eec3b7bdc59451850e4cb59c3e9ae2f4fbae76201ff9322ab80798d597c55 all runs: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] the bug reproduces without the instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed kconfig minimization: base=4789 full=6024 leaves diff=238 split chunks (needed=false): <238> split chunk #0 of len 238 into 5 parts testing without sub-chunk 1/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e49b4b42d045d3a4bfab657aedab6f95d2ed98e6de5e76a469ce7f11adbac42b all runs: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 62bdf2b178ab23fbf20e327b62b2d7a03cf6b813c8c55afa25ddecc88c2b4dbc run #0: crashed: BUG: soft lockup in tc_modify_qdisc run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: BUG: soft lockup in tc_modify_qdisc run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 72f08fab50587fd90001c3edf9ef892979d2072a00cc6c3e179b6202daa2fcfd run #0: crashed: BUG: workqueue lockup run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: no output from test machine run #8: crashed: BUG: soft lockup in tc_modify_qdisc run #9: crashed: no output from test machine representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG UNKNOWN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e43e66d1701c917502a3572042c47609e86670ddde5fb3c1bb78b9ed09ad4774 run #0: crashed: BUG: soft lockup in tc_modify_qdisc run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: BUG: soft lockup in corrupted run #8: crashed: no output from test machine run #9: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed testing commit c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc: net/socket.c:1109: undefined reference to `wext_handle_ioctl' net/socket.c:3378: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:346: undefined reference to `wext_proc_exit' net/core/net-procfs.c:330: undefined reference to `wext_proc_init' minimized to 46 configs; suspects: [HID_ZEROPLUS USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG KASAN], they are not needed testing current HEAD a27512601c2d65569fdd5a843246dc8da96b6408 testing commit a27512601c2d65569fdd5a843246dc8da96b6408 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8febb1adfd7bd1a3cf871f80202d6f29f83e3e82a0df33e91f15711d97a35cd3 all runs: OK false negative chance: 0.000 # git bisect start a27512601c2d65569fdd5a843246dc8da96b6408 c6a1fbd8e4aa8828b4c16b525f0bdc1106931ddc Bisecting: 253 revisions left to test after this (roughly 8 steps) [d4750cea76f7bfedca7922fe5237676c431d3150] ibmvnic: Enforce stronger sanity checks on login response determine whether the revision contains the guilty commit checking the merge base de5f63612d1631c89e72ecffc089f948392cf24a no existing result, test the revision testing commit de5f63612d1631c89e72ecffc089f948392cf24a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a38f0dcae0107bd503f02ed63a44d9ff3a223e838be4c5993031cf9e256d7df4 run #0: crashed: BUG: workqueue lockup run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: no output from test machine run #8: crashed: no output from test machine run #9: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG UNKNOWN] testing commit d4750cea76f7bfedca7922fe5237676c431d3150 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8e4bcf7810da82ebb095d4fff5146d8eacbcd6c946ef15064aebc0be361c07a4 run #0: crashed: BUG: workqueue lockup run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: BUG: soft lockup in tc_modify_qdisc run #8: crashed: BUG: soft lockup in corrupted run #9: crashed: no output from test machine representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] # git bisect good d4750cea76f7bfedca7922fe5237676c431d3150 Bisecting: 126 revisions left to test after this (roughly 7 steps) [9aead733f5e0d40e3d2798f4d2fd4a5d7930111c] virtio-net: set queues after driver_ok determine whether the revision contains the guilty commit revision d4750cea76f7bfedca7922fe5237676c431d3150 crashed and is reachable testing commit 9aead733f5e0d40e3d2798f4d2fd4a5d7930111c gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7bcca418334a898d970abefcecb301331752d2be7a78e746a104aabd1dd43d25 all runs: OK false negative chance: 0.000 # git bisect bad 9aead733f5e0d40e3d2798f4d2fd4a5d7930111c Bisecting: 63 revisions left to test after this (roughly 6 steps) [aeecd8d97da758b9cc41cacfd45de0e76237b674] iio: addac: stx104: Fix race condition for stx104_write_raw() determine whether the revision contains the guilty commit revision de5f63612d1631c89e72ecffc089f948392cf24a crashed and is reachable testing commit aeecd8d97da758b9cc41cacfd45de0e76237b674 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: dc81d60bd6797e8ae42bbb7d8035430a4f5213eb5dfe63cf77caa5c53fc54178 all runs: OK false negative chance: 0.000 # git bisect bad aeecd8d97da758b9cc41cacfd45de0e76237b674 Bisecting: 31 revisions left to test after this (roughly 5 steps) [df907501ba543a2adb8ef224a8f9b0c8f9786328] iopoll: Call cpu_relax() in busy loops determine whether the revision contains the guilty commit revision de5f63612d1631c89e72ecffc089f948392cf24a crashed and is reachable testing commit df907501ba543a2adb8ef224a8f9b0c8f9786328 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 087916002d1f7ee8f75af760bfce6f7696b56ed3c3d29301b59f213c845d7f15 all runs: OK false negative chance: 0.000 # git bisect bad df907501ba543a2adb8ef224a8f9b0c8f9786328 Bisecting: 15 revisions left to test after this (roughly 4 steps) [db9d161a04078fd8e83b30cf1e6a49204f7b967f] alpha: remove __init annotation from exported page_is_ram() determine whether the revision contains the guilty commit revision de5f63612d1631c89e72ecffc089f948392cf24a crashed and is reachable testing commit db9d161a04078fd8e83b30cf1e6a49204f7b967f gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 66376861361a2e6ef597197ff6c7d83096bbbae251f08d28135bedd7c01db606 run #0: crashed: BUG: soft lockup in tc_modify_qdisc run #1: crashed: BUG: soft lockup in tc_modify_qdisc run #2: crashed: BUG: soft lockup in tc_modify_qdisc run #3: crashed: BUG: soft lockup in tc_modify_qdisc run #4: crashed: BUG: soft lockup in tc_modify_qdisc run #5: crashed: BUG: soft lockup in tc_modify_qdisc run #6: crashed: BUG: soft lockup in tc_modify_qdisc run #7: crashed: BUG: soft lockup in corrupted run #8: crashed: no output from test machine run #9: crashed: BUG: soft lockup in tc_modify_qdisc representative crash: BUG: soft lockup in tc_modify_qdisc, types: [HANG] # git bisect good db9d161a04078fd8e83b30cf1e6a49204f7b967f Bisecting: 7 revisions left to test after this (roughly 3 steps) [e6c0a9728e3ad1b930364b79468207fb46c090fe] net/mlx5: Skip clock update work when device is in error state determine whether the revision contains the guilty commit revision de5f63612d1631c89e72ecffc089f948392cf24a crashed and is reachable testing commit e6c0a9728e3ad1b930364b79468207fb46c090fe gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7845e1441c896866cf9f72d8fd4a72f3000f07d59488949849eb5a051b9519fc all runs: OK false negative chance: 0.000 # git bisect bad e6c0a9728e3ad1b930364b79468207fb46c090fe Bisecting: 3 revisions left to test after this (roughly 2 steps) [ecf0e627fbbbc7d1b1cb8dc117c2a79a6c5d24e5] macsec: Fix traffic counters/statistics determine whether the revision contains the guilty commit revision db9d161a04078fd8e83b30cf1e6a49204f7b967f crashed and is reachable testing commit ecf0e627fbbbc7d1b1cb8dc117c2a79a6c5d24e5 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: fc945592a16e3ba630f53fe2583b1e3574f576329342ed0c46bc4b8cf8afc101 all runs: OK false negative chance: 0.000 # git bisect bad ecf0e627fbbbc7d1b1cb8dc117c2a79a6c5d24e5 Bisecting: 1 revision left to test after this (roughly 1 step) [da742ebfa00c3add4a358dd79ec92161c07e1435] Linux 5.10.191 determine whether the revision contains the guilty commit revision db9d161a04078fd8e83b30cf1e6a49204f7b967f crashed and is reachable testing commit da742ebfa00c3add4a358dd79ec92161c07e1435 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 886550c6bdc82ae0e4833ebda45c8e001433e4b310f3502aad8e048b876bf54f all runs: OK false negative chance: 0.000 # git bisect bad da742ebfa00c3add4a358dd79ec92161c07e1435 Bisecting: 0 revisions left to test after this (roughly 0 steps) [3b55ce96efc5e6722d8374e04d9f721cc29e4d4b] sch_netem: fix issues in netem_change() vs get_dist_table() determine whether the revision contains the guilty commit revision db9d161a04078fd8e83b30cf1e6a49204f7b967f crashed and is reachable testing commit 3b55ce96efc5e6722d8374e04d9f721cc29e4d4b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1015c7bf712b9b3f6b98b72fac82018d9233b38ab45d18199184ff1fe497ae07 all runs: OK false negative chance: 0.000 # git bisect bad 3b55ce96efc5e6722d8374e04d9f721cc29e4d4b 3b55ce96efc5e6722d8374e04d9f721cc29e4d4b is the first bad commit commit 3b55ce96efc5e6722d8374e04d9f721cc29e4d4b Author: Eric Dumazet Date: Thu Jun 22 18:15:03 2023 +0000 sch_netem: fix issues in netem_change() vs get_dist_table() commit 11b73313c12403f617b47752db0ab3deef201af7 upstream. In blamed commit, I missed that get_dist_table() was allocating memory using GFP_KERNEL, and acquiring qdisc lock to perform the swap of newly allocated table with current one. In this patch, get_dist_table() is allocating memory and copy user data before we acquire the qdisc lock. Then we perform swap operations while being protected by the lock. Note that after this patch netem_change() no longer can do partial changes. If an error is returned, qdisc conf is left unchanged. Fixes: 2174a08db80d ("sch_netem: acquire qdisc lock in netem_change()") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Stephen Hemminger Acked-by: Jamal Hadi Salim Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230622181503.2327695-1-edumazet@google.com Signed-off-by: Jakub Kicinski Signed-off-by: Fedor Pchelkin Signed-off-by: Greg Kroah-Hartman net/sched/sch_netem.c | 59 ++++++++++++++++++++++----------------------------- 1 file changed, 25 insertions(+), 34 deletions(-) accumulated error probability: 0.00 culprit signature: 1015c7bf712b9b3f6b98b72fac82018d9233b38ab45d18199184ff1fe497ae07 parent signature: 66376861361a2e6ef597197ff6c7d83096bbbae251f08d28135bedd7c01db606 revisions tested: 17, total time: 3h35m23.855225988s (build: 38m54.272550019s, test: 2h53m14.268709185s) first good commit: 3b55ce96efc5e6722d8374e04d9f721cc29e4d4b sch_netem: fix issues in netem_change() vs get_dist_table() recipients (to): ["edumazet@google.com" "gregkh@linuxfoundation.org" "jhs@mojatatu.com" "kuba@kernel.org" "pchelkin@ispras.ru" "simon.horman@corigine.com"] recipients (cc): []