bisecting cause commit starting from 894d6f401b21865962aba776ecaa918b2f0abaa6 building syzkaller on 6972b10616d785401dea17cec890cca8916424a7 testing commit 894d6f401b21865962aba776ecaa918b2f0abaa6 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: e09c7bebb0fd471d5bd80584a65b0631cb6c6cc51ca87b9b106265744fa63bf9 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: WARNING in destroy_conntrack run #2: crashed: WARNING in destroy_conntrack run #3: crashed: WARNING in destroy_conntrack run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #9: crashed: WARNING in destroy_conntrack run #10: crashed: WARNING in destroy_conntrack run #11: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #12: crashed: WARNING in destroy_conntrack run #13: crashed: WARNING in destroy_conntrack run #14: crashed: WARNING in destroy_conntrack run #15: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.13 testing commit 62fb9874f5da54fdb243003b386128037319b219 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 909f5b513362d755e99068620c19525cb2afd91ca8725228219fd46574a48866 run #0: crashed: WARNING in destroy_conntrack run #1: crashed: WARNING in destroy_conntrack run #2: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #3: crashed: WARNING in destroy_conntrack run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #9: crashed: WARNING in destroy_conntrack testing release v5.12 testing commit 9f4ad9e425a1d3b6a34617b8ea226d56a119a717 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: bb4e26dd8f4a005b0fd76547575ef29621d4d502b5251ddaf0a5696974104629 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: WARNING in destroy_conntrack run #2: crashed: WARNING in destroy_conntrack run #3: crashed: WARNING in destroy_conntrack run #4: crashed: WARNING in destroy_conntrack run #5: crashed: WARNING in destroy_conntrack run #6: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #7: crashed: WARNING in destroy_conntrack run #8: crashed: WARNING in destroy_conntrack run #9: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 3222e6ed80513dd888ba5df1ed0bb0fed90b38311471a07f8ebfef14f678fd42 run #0: crashed: WARNING in destroy_conntrack run #1: crashed: WARNING in destroy_conntrack run #2: crashed: WARNING in destroy_conntrack run #3: crashed: WARNING in destroy_conntrack run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: WARNING in destroy_conntrack run #6: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #7: crashed: WARNING in destroy_conntrack run #8: crashed: WARNING in destroy_conntrack run #9: OK testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 35c88fb67e0626f0232c5254d6e9f188ff33bdc5ecf75a2e20b39b0354577e82 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #2: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #3: crashed: WARNING in destroy_conntrack run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: WARNING in destroy_conntrack run #6: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #7: OK run #8: OK run #9: OK testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 4753fc6113ccf19b73886623e431f1d42203e5df7900561c23ce4babeaf8f756 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: WARNING in destroy_conntrack run #2: crashed: WARNING in destroy_conntrack run #3: crashed: WARNING in destroy_conntrack run #4: crashed: WARNING in destroy_conntrack run #5: crashed: WARNING in destroy_conntrack run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: WARNING in destroy_conntrack run #9: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c compiler: gcc (GCC) 8.4.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: 64bef9c619e4f9660afe7c971d6b25d7fe2654ae1e3be1137534ef774e1b1619 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: WARNING in destroy_conntrack run #2: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #3: crashed: WARNING in destroy_conntrack run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: WARNING in destroy_conntrack run #6: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #7: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #8: crashed: WARNING in destroy_conntrack run #9: OK testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 compiler: gcc version 8.4.1 20210217 (GCC), GNU ld (GNU Binutils for Debian) 2.35.1 kernel signature: f76fe31c01316385978519b5b4e89add706a0c3d5fe63afc28097ce825bd70af run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: WARNING in destroy_conntrack run #2: crashed: WARNING in destroy_conntrack run #3: crashed: WARNING in destroy_conntrack run #4: crashed: WARNING in destroy_conntrack run #5: crashed: WARNING in destroy_conntrack run #6: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #7: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #8: crashed: WARNING in destroy_conntrack run #9: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ce1c40f29ea7dac1ab1efcb8a4c28e91d707e6db2dd3c7ba2f4d3ff05339b929 all runs: OK # git bisect start 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 7111951b8d4973bda27ff663f2cf18b663d15b48 Bisecting: 7542 revisions left to test after this (roughly 13 steps) [50a5de895dbe5df947b3a695777db5b2c313e065] Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit 50a5de895dbe5df947b3a695777db5b2c313e065 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: b3c4ba3df7c39a3fabac937e75bbde7b3e089468856b64ae00bf2f3c39382d92 failed: failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:PERMISSIONS_ERROR Location: Message:Required 'read' permission for 'disks/ci-upstream-kasan-gce-bisect-job-bisect-job-image.tar.gz' ForceSendFields:[] NullFields:[]}. # git bisect skip 50a5de895dbe5df947b3a695777db5b2c313e065 Bisecting: 7542 revisions left to test after this (roughly 13 steps) [422c032afcf57d5e8109a54912e22ffc53d99068] netfilter: flowtable: Use rw sem as flow block lock testing commit 422c032afcf57d5e8109a54912e22ffc53d99068 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 777b723a11a14a7c392639d14e72c3ef5939c8bb71516612cf459c66968f9233 run #0: crashed: WARNING in destroy_conntrack run #1: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #2: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #3: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: WARNING in destroy_conntrack run #9: crashed: WARNING in destroy_conntrack # git bisect bad 422c032afcf57d5e8109a54912e22ffc53d99068 Bisecting: 771 revisions left to test after this (roughly 10 steps) [6349021701d0ba2e84e2be440258d81e198c3392] Merge branch 'mlxsw-Offload-FIFO' testing commit 6349021701d0ba2e84e2be440258d81e198c3392 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 27bda0d548e59434e3610403149502768fe157bff43a60fd8acbad7a772c7a74 all runs: OK # git bisect good 6349021701d0ba2e84e2be440258d81e198c3392 Bisecting: 385 revisions left to test after this (roughly 9 steps) [d5e3c87d302cd08d01ac041cc3f8049c979cb97d] net: fec: reject unsupported coalescing params testing commit d5e3c87d302cd08d01ac041cc3f8049c979cb97d compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f75db7f549d45aad7afac709ab2394ede754e6c63dab87d360b9acba89095d8d all runs: OK # git bisect good d5e3c87d302cd08d01ac041cc3f8049c979cb97d Bisecting: 192 revisions left to test after this (roughly 8 steps) [fa83820e5c58d200f41d08003ecb5f61cad3113b] Merge branch 'net-phy-XLGMII-define-and-usage-in-PHYLINK' testing commit fa83820e5c58d200f41d08003ecb5f61cad3113b compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: c33f9e7b6b4216342c945a4d333f42f9566d785756658e74feb64ce4e9b3176a all runs: OK # git bisect good fa83820e5c58d200f41d08003ecb5f61cad3113b Bisecting: 96 revisions left to test after this (roughly 7 steps) [0419c450e1bb5eb1c68ba10efeefddaf556cde85] Merge branch 'stmmac-100GB-Enterprise-MAC-support' testing commit 0419c450e1bb5eb1c68ba10efeefddaf556cde85 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 790115a5058b5662ee1cb14ef80b22cf61acfcb5d579b232ec2240000c3d1eb6 all runs: OK # git bisect good 0419c450e1bb5eb1c68ba10efeefddaf556cde85 Bisecting: 47 revisions left to test after this (roughly 6 steps) [54e73b9c0a88f71ce041a69471b7c4ef9a6a4407] s390/qeth: don't report hard-coded driver version testing commit 54e73b9c0a88f71ce041a69471b7c4ef9a6a4407 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 4ba3cc2fbabbb512ed2850644b4150da6b2c3ccf612c547ebb1bb18b97a7022d all runs: OK # git bisect good 54e73b9c0a88f71ce041a69471b7c4ef9a6a4407 Bisecting: 29 revisions left to test after this (roughly 5 steps) [d445dff2df604e6c21480782f434f44128d06f1d] net: phy: realtek: read actual speed to detect downshift testing commit d445dff2df604e6c21480782f434f44128d06f1d compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 034c69c14f5ff2bde91daaf3d7f37e5cb2c8f00c478596dad90647f86fe7783f all runs: OK # git bisect good d445dff2df604e6c21480782f434f44128d06f1d Bisecting: 14 revisions left to test after this (roughly 4 steps) [79e28519ac78dde6d38fe6ea22286af574f5c7db] Merge tag 'mlx5-updates-2020-03-17' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux testing commit 79e28519ac78dde6d38fe6ea22286af574f5c7db compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 034c69c14f5ff2bde91daaf3d7f37e5cb2c8f00c478596dad90647f86fe7783f all runs: OK # git bisect good 79e28519ac78dde6d38fe6ea22286af574f5c7db Bisecting: 7 revisions left to test after this (roughly 3 steps) [19f8f717f620576ada10b0ba8f4d55ef1208571e] netfilter: ctnetlink: Add missing annotation for ctnetlink_parse_nat_setup() testing commit 19f8f717f620576ada10b0ba8f4d55ef1208571e compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 0090a7d0bebe8e4e56488a5417264e0337b3146dd38c768279576413bad3d798 run #0: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #1: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #2: crashed: WARNING in destroy_conntrack run #3: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #4: crashed: WARNING in destroy_conntrack run #5: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: WARNING in destroy_conntrack run #9: OK # git bisect bad 19f8f717f620576ada10b0ba8f4d55ef1208571e Bisecting: 3 revisions left to test after this (roughly 2 steps) [65038428b2c6c5be79d3f78a6b79c0cdc3a58a41] netfilter: nf_tables: allow to specify stateful expression in set definition testing commit 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 98fe12c6ecd61a94b8f062f2bf9460d4ea61fd364ffc4035acaae07e06ed7844 run #0: crashed: WARNING in destroy_conntrack run #1: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #2: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #3: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #4: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #5: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #6: crashed: WARNING in destroy_conntrack run #7: crashed: WARNING in destroy_conntrack run #8: crashed: KASAN: use-after-free Write in nft_ct_tmpl_put_pcpu run #9: crashed: WARNING in destroy_conntrack # git bisect bad 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Bisecting: 0 revisions left to test after this (roughly 1 step) [0c2a85edd143162b3a698f31e94bf8cdc041da87] netfilter: nf_tables: pass context to nft_set_destroy() testing commit 0c2a85edd143162b3a698f31e94bf8cdc041da87 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7aec2b59c09a2a379edfadd268c02104a8250d6bde70762e5933c2d745b7637f all runs: OK # git bisect good 0c2a85edd143162b3a698f31e94bf8cdc041da87 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 is the first bad commit commit 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 Author: Pablo Neira Ayuso Date: Tue Mar 17 14:13:46 2020 +0100 netfilter: nf_tables: allow to specify stateful expression in set definition This patch allows users to specify the stateful expression for the elements in this set via NFTA_SET_EXPR. This new feature allows you to turn on counters for all of the elements in this set. Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables.h | 2 ++ include/uapi/linux/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 60 +++++++++++++++++++++++++------- 3 files changed, 52 insertions(+), 12 deletions(-) culprit signature: 98fe12c6ecd61a94b8f062f2bf9460d4ea61fd364ffc4035acaae07e06ed7844 parent signature: 7aec2b59c09a2a379edfadd268c02104a8250d6bde70762e5933c2d745b7637f revisions tested: 21, total time: 5h33m46.424504624s (build: 2h17m12.232203001s, test: 3h13m43.886395164s) first bad commit: 65038428b2c6c5be79d3f78a6b79c0cdc3a58a41 netfilter: nf_tables: allow to specify stateful expression in set definition recipients (to): ["coreteam@netfilter.org" "davem@davemloft.net" "fw@strlen.de" "kadlec@netfilter.org" "kuba@kernel.org" "netdev@vger.kernel.org" "netfilter-devel@vger.kernel.org" "pablo@netfilter.org" "pablo@netfilter.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: WARNING in destroy_conntrack ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16470 at net/netfilter/nf_conntrack_core.c:600 nf_ct_tmpl_free net/netfilter/nf_conntrack_core.c:580 [inline] WARNING: CPU: 0 PID: 16470 at net/netfilter/nf_conntrack_core.c:600 destroy_conntrack+0x198/0x210 net/netfilter/nf_conntrack_core.c:603 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 16470 Comm: syz-executor.2 Not tainted 5.6.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x96/0xe0 lib/dump_stack.c:118 panic+0x2a1/0x52a kernel/panic.c:221 __warn.cold.10+0x25/0x2f kernel/panic.c:582 report_bug+0x1aa/0x260 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x12d/0x1e0 arch/x86/kernel/traps.c:267 do_invalid_op+0x31/0x40 arch/x86/kernel/traps.c:286 invalid_op+0x2d/0x40 arch/x86/entry/entry_64.S:1027 RIP: 0010:destroy_conntrack+0x198/0x210 net/netfilter/nf_conntrack_core.c:600 Code: 6e 69 dd fc 48 89 df 5b 5d e9 44 8e ff ff 48 89 ef e8 ec 62 fd ff eb ac 48 89 df e8 22 3a 02 00 48 89 df 5b 5d e9 f8 8b e7 fa <0f> 0b e9 ac fe ff ff 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 RSP: 0018:ffffc90002b17090 EFLAGS: 00010286 RAX: 00000000ffffffff RBX: ffff88809485ec00 RCX: ffffffff86b7bb97 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88809485ec00 RBP: ffffc90002b170c0 R08: ffffed101290bd81 R09: ffffed101290bd81 R10: ffffed101290bd80 R11: ffff88809485ec03 R12: 0000000000000000 R13: ffff88809485ec00 R14: ffff88809485ec00 R15: 0000000000000000 nf_conntrack_destroy+0x92/0x19d net/netfilter/core.c:600 nf_conntrack_put include/linux/netfilter/nf_conntrack_common.h:34 [inline] nf_ct_put include/net/netfilter/nf_conntrack.h:162 [inline] nft_ct_tmpl_put_pcpu+0x14e/0x260 net/netfilter/nft_ct.c:358 __nft_ct_set_destroy net/netfilter/nft_ct.c:523 [inline] nft_ct_set_init+0x385/0x710 net/netfilter/nft_ct.c:617 nf_tables_newexpr net/netfilter/nf_tables_api.c:2505 [inline] nft_expr_init+0x10e/0x280 net/netfilter/nf_tables_api.c:2543 nft_set_elem_expr_alloc+0x16/0x1e0 net/netfilter/nf_tables_api.c:4831 nf_tables_newset+0x12d3/0x2080 net/netfilter/nf_tables_api.c:4090 nfnetlink_rcv_batch+0x876/0x15e0 net/netfilter/nfnetlink.c:433 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:543 [inline] nfnetlink_rcv+0x2bc/0x340 net/netfilter/nfnetlink.c:561 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x434/0x630 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x766/0xc10 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:672 ____sys_sendmsg+0x54e/0x760 net/socket.c:2343 ___sys_sendmsg+0xe4/0x160 net/socket.c:2397 __sys_sendmsg+0xce/0x170 net/socket.c:2430 do_syscall_64+0x98/0x560 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4665e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f509962b188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80 R13: 00007ffdb2e87a2f R14: 00007f509962b300 R15: 0000000000022000 Kernel Offset: disabled Rebooting in 86400 seconds..