ci starts bisection 2023-06-28 03:19:19.310731693 +0000 UTC m=+125059.681248731 bisecting fixing commit since 59d0d52c30d4991ac4b329f049cc37118e00f5b0 building syzkaller on 3a127a3157fd19caabb023978737471213127590 ensuring issue is reproducible on original commit 59d0d52c30d4991ac4b329f049cc37118e00f5b0 testing commit 59d0d52c30d4991ac4b329f049cc37118e00f5b0 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 34c06f2e7444ed9188aa501ce58dbda54ad76b4b3bf9f244e35a0c045963756a all runs: crashed: kernel BUG in workingset_activation testing current HEAD 98be618ad03010b1173fc3c35f6cbb4447ee2b07 testing commit 98be618ad03010b1173fc3c35f6cbb4447ee2b07 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 82a05f76f31baaf60731a42900cc2309841d413a9f15977b61e5f4daf4fbf466 all runs: OK too many neither good nor bad results, skipping this commit # git bisect start 98be618ad03010b1173fc3c35f6cbb4447ee2b07 59d0d52c30d4991ac4b329f049cc37118e00f5b0 Bisecting: 25101 revisions left to test after this (roughly 15 steps) [a5c95ca18a98d742d0a4a04063c32556b5b66378] Merge tag 'drm-next-2023-02-23' of git://anongit.freedesktop.org/drm/drm testing commit a5c95ca18a98d742d0a4a04063c32556b5b66378 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5aa8d96b562e0cfaec5af24a12fe0bba4ec0117af57cb932c041701c149b1846 all runs: crashed: kernel BUG in workingset_activation # git bisect good a5c95ca18a98d742d0a4a04063c32556b5b66378 Bisecting: 12574 revisions left to test after this (roughly 14 steps) [5c7ecada25d2086aee607ff7deb69e77faa4aa92] Merge tag 'f2fs-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs testing commit 5c7ecada25d2086aee607ff7deb69e77faa4aa92 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2b23edd43168b24416d91cfb00b6000aef6f47966f7b6b901c7236cb7a8ef466 all runs: crashed: kernel BUG in workingset_activation # git bisect good 5c7ecada25d2086aee607ff7deb69e77faa4aa92 Bisecting: 6316 revisions left to test after this (roughly 13 steps) [af3877265dd88d7e333f94fb37bc09554544adca] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit af3877265dd88d7e333f94fb37bc09554544adca gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2ad60d9eefd57744288844d9a4bf889e89f7bb57aae0bd307dc9840aa6d35845 all runs: crashed: kernel BUG in workingset_activation # git bisect good af3877265dd88d7e333f94fb37bc09554544adca Bisecting: 3154 revisions left to test after this (roughly 12 steps) [029c77f89a15e0e2f209ac5be9ec1d9672b8b09a] Merge tag 'sound-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 029c77f89a15e0e2f209ac5be9ec1d9672b8b09a gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 66bcc53b0ca941235826f5ec1b4233d371f4c9908cdfb84b08876191b1d5d746 all runs: crashed: kernel BUG in workingset_activation # git bisect good 029c77f89a15e0e2f209ac5be9ec1d9672b8b09a Bisecting: 1561 revisions left to test after this (roughly 11 steps) [f7976a6493b3f00c4d057a37d9e63c322154ef8c] Merge tag 'nfsd-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux testing commit f7976a6493b3f00c4d057a37d9e63c322154ef8c gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2c598aab9634f9c58a3eedea6373dad9949e1a8134f785c0260a40ee8b533746 all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad f7976a6493b3f00c4d057a37d9e63c322154ef8c Bisecting: 796 revisions left to test after this (roughly 10 steps) [b403643d154d15176b060b82f7fc605210033edd] netlabel: fix shift wrapping bug in netlbl_catmap_setlong() testing commit b403643d154d15176b060b82f7fc605210033edd gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5a172e37afde4e018b71ac152c677f9b0a3e481efaf344c5189b218309728bf6 all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad b403643d154d15176b060b82f7fc605210033edd Bisecting: 436 revisions left to test after this (roughly 9 steps) [f9010dbdce911ee1f1af1398a24b1f9f992e0080] fork, vhost: Use CLONE_THREAD to fix freezer/ps regression testing commit f9010dbdce911ee1f1af1398a24b1f9f992e0080 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 41ec96bcac41b6f948cafdfe7c6d882a7a8a5d59ed389b07cc22efc135634fd0 all runs: crashed: kernel BUG in workingset_activation # git bisect good f9010dbdce911ee1f1af1398a24b1f9f992e0080 Bisecting: 219 revisions left to test after this (roughly 8 steps) [12c2f77b32b5de3f5cc4a9ae2eb2b1f68f86df31] Merge tag 'tty-6.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit 12c2f77b32b5de3f5cc4a9ae2eb2b1f68f86df31 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 04bea3af5c376c26c01781ec9c85520c54a770fae982fa305e486f1363022d2b all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad 12c2f77b32b5de3f5cc4a9ae2eb2b1f68f86df31 Bisecting: 110 revisions left to test after this (roughly 7 steps) [1419c3ba31446feecb728f49820ff2730d6deaed] Merge tag 'selinux-pr-20230601' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux testing commit 1419c3ba31446feecb728f49820ff2730d6deaed gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7f5f59bb3ccc122229a110cc2658b544433b31029f78e589c338c97977c01afb all runs: crashed: kernel BUG in workingset_activation # git bisect good 1419c3ba31446feecb728f49820ff2730d6deaed Bisecting: 54 revisions left to test after this (roughly 6 steps) [e0178b546d24f42a85f4d4da080fb801e0d49107] Merge tag 'for-6.4-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit e0178b546d24f42a85f4d4da080fb801e0d49107 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e208e5581e9b2791adb7f2eaac2d5a460fad894afae24ce18f5d2b363c55eb66 all runs: crashed: kernel BUG in workingset_activation # git bisect good e0178b546d24f42a85f4d4da080fb801e0d49107 Bisecting: 34 revisions left to test after this (roughly 5 steps) [f211b45057d8b0264b494f1acebf2e8d7f9432c9] Merge tag 'kvm-x86-fixes-6.4' of https://github.com/kvm-x86/linux into HEAD testing commit f211b45057d8b0264b494f1acebf2e8d7f9432c9 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: bb8b7f3fadbc48dccaf2d5c81a54796cd091e50e7ff0cd8f43caf48f9ce6f935 all runs: crashed: kernel BUG in workingset_activation # git bisect good f211b45057d8b0264b494f1acebf2e8d7f9432c9 Bisecting: 16 revisions left to test after this (roughly 4 steps) [9455b4b6db1e9b11d242595cc968332ecdd3cc91] Merge tag 'powerpc-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux testing commit 9455b4b6db1e9b11d242595cc968332ecdd3cc91 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 20059b340f17daf244cfe7d198c81c14c990c1e0ada6f99940154ddffd432ea6 all runs: crashed: kernel BUG in workingset_activation # git bisect good 9455b4b6db1e9b11d242595cc968332ecdd3cc91 Bisecting: 8 revisions left to test after this (roughly 3 steps) [44d0fb387b53e56c8a050bac5c7d460e21eb226f] mm: page_table_check: Ensure user pages are not slab pages testing commit 44d0fb387b53e56c8a050bac5c7d460e21eb226f gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fe96a14a6bf32a663ccd4aaf4ac83224b026b83edf98f92b6577161ff9c630fc all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad 44d0fb387b53e56c8a050bac5c7d460e21eb226f Bisecting: 3 revisions left to test after this (roughly 2 steps) [7b32040f6d7f885ffc09a6df7c17992d56d2eab8] dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type testing commit 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 36d636855df0fc90723faa49fee72101419c4cd6865c5fa73eb746e094ae9d87 all runs: crashed: kernel BUG in workingset_activation # git bisect good 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 Bisecting: 1 revision left to test after this (roughly 1 step) [d0b861653f8c16839c3035875b556afc4472f941] usb: usbfs: Use consistent mmap functions testing commit d0b861653f8c16839c3035875b556afc4472f941 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d848fa2403ee9a6bd34523110893f0de39ad4e6329d5923b63c78185afd2d4a6 all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad d0b861653f8c16839c3035875b556afc4472f941 Bisecting: 0 revisions left to test after this (roughly 0 steps) [0143d148d1e882fb1538dc9974c94d63961719b9] usb: usbfs: Enforce page requirements for mmap testing commit 0143d148d1e882fb1538dc9974c94d63961719b9 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e8f172b53b967048a54292afbf09ba1fa9bd1140fef6e6d9a113afdc2397a778 all runs: OK too many neither good nor bad results, skipping this commit # git bisect bad 0143d148d1e882fb1538dc9974c94d63961719b9 0143d148d1e882fb1538dc9974c94d63961719b9 is the first bad commit commit 0143d148d1e882fb1538dc9974c94d63961719b9 Author: Ruihan Li Date: Mon May 15 21:09:55 2023 +0800 usb: usbfs: Enforce page requirements for mmap The current implementation of usbdev_mmap uses usb_alloc_coherent to allocate memory pages that will later be mapped into the user space. Meanwhile, usb_alloc_coherent employs three different methods to allocate memory, as outlined below: * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to allocate memory; * If DMA is not available, it uses kmalloc to allocate memory; * Otherwise, it uses dma_alloc_coherent. However, it should be noted that gen_pool_dma_alloc does not guarantee that the resulting memory will be page-aligned. Furthermore, trying to map slab pages (i.e., memory allocated by kmalloc) into the user space is not resonable and can lead to problems, such as a type confusion bug when PAGE_TABLE_CHECK=y [1]. To address these issues, this patch introduces hcd_alloc_coherent_pages, which addresses the above two problems. Specifically, hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling __get_free_pages. Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.") Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations") Cc: stable@vger.kernel.org Signed-off-by: Ruihan Li Acked-by: Alan Stern Link: https://lore.kernel.org/r/20230515130958.32471-2-lrh2000@pku.edu.cn Signed-off-by: Greg Kroah-Hartman drivers/usb/core/buffer.c | 41 +++++++++++++++++++++++++++++++++++++++++ drivers/usb/core/devio.c | 9 +++++---- include/linux/usb/hcd.h | 5 +++++ 3 files changed, 51 insertions(+), 4 deletions(-) culprit signature: e8f172b53b967048a54292afbf09ba1fa9bd1140fef6e6d9a113afdc2397a778 parent signature: 36d636855df0fc90723faa49fee72101419c4cd6865c5fa73eb746e094ae9d87 revisions tested: 18, total time: 4h39m51.730370165s (build: 2h50m36.560983127s, test: 1h43m16.715102762s) first good commit: 0143d148d1e882fb1538dc9974c94d63961719b9 usb: usbfs: Enforce page requirements for mmap recipients (to): ["gregkh@linuxfoundation.org" "lrh2000@pku.edu.cn" "stern@rowland.harvard.edu"] recipients (cc): []