bisecting cause commit starting from 2c523b344dfa65a3738e7039832044aa133c75fb building syzkaller on 35f53e457420e79fa28e3260cdbbf9f37b9f97e4 testing commit 2c523b344dfa65a3738e7039832044aa133c75fb with gcc (GCC) 8.1.0 kernel signature: 6e7f8a8b651bf70555653d3163932ad8ef4a7ba74ee89b63a080371de402a0ec all runs: crashed: WARNING: refcount bug in sctp_wfree testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: d585d2dd99478d5cbc6e604a3ff7141da23374d77f313c2cff0e84b8310b3d33 all runs: crashed: WARNING: refcount bug in sctp_wfree testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: e3735d3272c3f85175f024e77d84354aa93c9355ea15334f67b1a5ee59f68f2e all runs: OK # git bisect start d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 219d54332a09e8d8741c1e1982f5eae56099de85 Bisecting: 8639 revisions left to test after this (roughly 13 steps) [8c39f71ee2019e77ee14f88b1321b2348db51820] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 8c39f71ee2019e77ee14f88b1321b2348db51820 with gcc (GCC) 8.1.0 kernel signature: d5565e51dc6d6ddc8bf7825c555aba05636d3371d16615080516693d2a3ac39b all runs: crashed: WARNING: refcount bug in sctp_wfree # git bisect bad 8c39f71ee2019e77ee14f88b1321b2348db51820 Bisecting: 3435 revisions left to test after this (roughly 12 steps) [3b397c7ccafe0624018cb09fc96729f8f6165573] Merge tag 'regmap-v5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap testing commit 3b397c7ccafe0624018cb09fc96729f8f6165573 with gcc (GCC) 8.1.0 kernel signature: 03fc55a7a6dccb0e027b9e8007d793f5c8088464200f7ce8b678a54a37c7ca02 all runs: OK # git bisect good 3b397c7ccafe0624018cb09fc96729f8f6165573 Bisecting: 1576 revisions left to test after this (roughly 11 steps) [89d57dddd7d319ded00415790a0bb3c954b7e386] Merge tag 'media/v5.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media testing commit 89d57dddd7d319ded00415790a0bb3c954b7e386 with gcc (GCC) 8.1.0 kernel signature: b06240566a8bfbeb9c144bf074cf71e6fb63ce5a832b0c5324423fc98e12f0fd all runs: crashed: WARNING: refcount bug in sctp_wfree # git bisect bad 89d57dddd7d319ded00415790a0bb3c954b7e386 Bisecting: 949 revisions left to test after this (roughly 10 steps) [9e7a03233e02afd3ee061e373355f34d7254f1e6] Merge tag 'pm-5.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm testing commit 9e7a03233e02afd3ee061e373355f34d7254f1e6 with gcc (GCC) 8.1.0 kernel signature: b935adc7ec1c04f59058c7c4dda3e90f99c5b09991ef444f4a7035166bed17ea all runs: crashed: WARNING: refcount bug in sctp_wfree # git bisect bad 9e7a03233e02afd3ee061e373355f34d7254f1e6 Bisecting: 521 revisions left to test after this (roughly 9 steps) [df28204bb0f29cc475c0a8893c99b46a11a4903f] Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit df28204bb0f29cc475c0a8893c99b46a11a4903f with gcc (GCC) 8.1.0 kernel signature: 22facb48d6c798d304b953edc2bac127c0fd72694f50af9774f768646b243a82 all runs: OK # git bisect good df28204bb0f29cc475c0a8893c99b46a11a4903f Bisecting: 260 revisions left to test after this (roughly 8 steps) [0e3149f86b99ddabde8c5029eea0a9267e34f1a0] perf dso: Move dso_id from 'struct map' to 'struct dso' testing commit 0e3149f86b99ddabde8c5029eea0a9267e34f1a0 with gcc (GCC) 8.1.0 kernel signature: 2bd4c125b8f6d85cbd949df5bdf3f7a66e137d428b74e622ca117de5be6cf823 all runs: OK # git bisect good 0e3149f86b99ddabde8c5029eea0a9267e34f1a0 Bisecting: 125 revisions left to test after this (roughly 7 steps) [1ae78780eda54023a0fb49ee743dbba39da148e0] Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 1ae78780eda54023a0fb49ee743dbba39da148e0 with gcc (GCC) 8.1.0 kernel signature: 014287a99cc1b471b9ea720939b5dad66f165802a0e188999adcd0b25d2d64dc all runs: OK # git bisect good 1ae78780eda54023a0fb49ee743dbba39da148e0 Bisecting: 54 revisions left to test after this (roughly 6 steps) [fa6a599eb34dec23aadccda6e374cc3ec3e9b7ee] Merge branch 'pm-devfreq' testing commit fa6a599eb34dec23aadccda6e374cc3ec3e9b7ee with gcc (GCC) 8.1.0 kernel signature: 5d4d374e16496005ea8c07bc378c38cc34b972ac5a3b07e031654906b501b3ac all runs: OK # git bisect good fa6a599eb34dec23aadccda6e374cc3ec3e9b7ee Bisecting: 27 revisions left to test after this (roughly 5 steps) [500543c53a54134ced386aed85cd93cf1363f981] lkdtm: Remove references to CONFIG_REFCOUNT_FULL testing commit 500543c53a54134ced386aed85cd93cf1363f981 with gcc (GCC) 8.1.0 kernel signature: f90ceb67175aa3c01eaf7b5a8cb4cd0afaf6d1a26daf3ce491616ef2cdb720cf all runs: crashed: WARNING: refcount bug in sock_wfree # git bisect bad 500543c53a54134ced386aed85cd93cf1363f981 Bisecting: 13 revisions left to test after this (roughly 4 steps) [4a8e991b91aca9e20705d434677ac013974e0e30] futex: Sanitize exit state handling testing commit 4a8e991b91aca9e20705d434677ac013974e0e30 with gcc (GCC) 8.1.0 kernel signature: 770f60b8294301e0db9a24eb8feb6ae442ed8f01a3ac8dfe276d86c4cefa4ecd all runs: OK # git bisect good 4a8e991b91aca9e20705d434677ac013974e0e30 Bisecting: 6 revisions left to test after this (roughly 3 steps) [7221762c48c6bbbcc6cc51d8b803c06930215e34] locking/refcount: Remove unused refcount_*_checked() variants testing commit 7221762c48c6bbbcc6cc51d8b803c06930215e34 with gcc (GCC) 8.1.0 kernel signature: e4ec5f2b3501c2b694717493dc279ec9a290581c9e5dc15684094fbd0453d80a all runs: OK # git bisect good 7221762c48c6bbbcc6cc51d8b803c06930215e34 Bisecting: 3 revisions left to test after this (roughly 2 steps) [1eb085d94256aaa69b00cf5a86e3c5f5bb2bc460] locking/refcount: Move saturation warnings out of line testing commit 1eb085d94256aaa69b00cf5a86e3c5f5bb2bc460 with gcc (GCC) 8.1.0 kernel signature: 515888669f46917c8dcc3a55fb7a6d68b58fd51c719da9f9ac45349ccd6663e0 all runs: OK # git bisect good 1eb085d94256aaa69b00cf5a86e3c5f5bb2bc460 Bisecting: 1 revision left to test after this (roughly 1 step) [fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca] locking/refcount: Consolidate implementations of refcount_t testing commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca with gcc (GCC) 8.1.0 kernel signature: 05b9393a046a246db3d0ed4a282ff095829f5b816af34950bf1f1ba502bbcc25 all runs: crashed: WARNING: refcount bug in sock_wfree # git bisect bad fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca Bisecting: 0 revisions left to test after this (roughly 0 steps) [65b008552469f1c37f5e06e0016924502e40b4f5] locking/refcount: Consolidate REFCOUNT_{MAX,SATURATED} definitions testing commit 65b008552469f1c37f5e06e0016924502e40b4f5 with gcc (GCC) 8.1.0 kernel signature: 88c20eff7cfe6836e23db63302b26f005bc38f690a496be72ba682c7199e8b1f all runs: OK # git bisect good 65b008552469f1c37f5e06e0016924502e40b4f5 fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca is the first bad commit commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca Author: Will Deacon Date: Thu Nov 21 11:59:00 2019 +0000 locking/refcount: Consolidate implementations of refcount_t The generic implementation of refcount_t should be good enough for everybody, so remove ARCH_HAS_REFCOUNT and REFCOUNT_FULL entirely, leaving the generic implementation enabled unconditionally. Signed-off-by: Will Deacon Reviewed-by: Ard Biesheuvel Acked-by: Kees Cook Tested-by: Hanjun Guo Cc: Ard Biesheuvel Cc: Elena Reshetova Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: https://lkml.kernel.org/r/20191121115902.2551-9-will@kernel.org Signed-off-by: Ingo Molnar arch/Kconfig | 21 ----- arch/arm/Kconfig | 1 - arch/arm64/Kconfig | 1 - arch/s390/configs/debug_defconfig | 1 - arch/x86/Kconfig | 1 - arch/x86/include/asm/asm.h | 6 -- arch/x86/include/asm/refcount.h | 126 ----------------------------- arch/x86/mm/extable.c | 49 ------------ drivers/gpu/drm/i915/Kconfig.debug | 1 - include/linux/refcount.h | 158 ++++++++++++++----------------------- lib/refcount.c | 2 +- 11 files changed, 59 insertions(+), 308 deletions(-) delete mode 100644 arch/x86/include/asm/refcount.h culprit signature: 05b9393a046a246db3d0ed4a282ff095829f5b816af34950bf1f1ba502bbcc25 parent signature: 88c20eff7cfe6836e23db63302b26f005bc38f690a496be72ba682c7199e8b1f revisions tested: 17, total time: 4h4m46.680327586s (build: 1h52m3.667155975s, test: 2h11m32.03792536s) first bad commit: fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca locking/refcount: Consolidate implementations of refcount_t cc: ["ardb@kernel.org" "guohanjun@huawei.com" "keescook@chromium.org" "mingo@kernel.org" "will@kernel.org"] crash: WARNING: refcount bug in sock_wfree ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 8210 at lib/refcount.c:28 refcount_warn_saturate+0x135/0x140 lib/refcount.c:28 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 8210 Comm: syz-executor.5 Not tainted 5.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 panic+0x22a/0x4e3 kernel/panic.c:221 __warn.cold.10+0x25/0x2a kernel/panic.c:582 report_bug+0x1b0/0x270 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:179 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028 RIP: 0010:refcount_warn_saturate+0x135/0x140 lib/refcount.c:28 Code: 83 ee fd 0f 0b e9 51 ff ff ff 48 89 df e8 83 96 4c fe e9 1f ff ff ff 48 c7 c7 c0 48 cc 87 c6 05 98 d1 58 06 01 e8 b3 83 ee fd <0f> 0b e9 2a ff ff ff 0f 1f 40 00 55 be 04 00 00 00 48 89 e5 41 57 RSP: 0018:ffff888099867758 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880a7081a44 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff8a8f8360 RBP: ffff888099867768 R08: ffffed1015d06159 R09: ffffed1015d06159 R10: ffffed1015d06158 R11: ffff8880ae830ac7 R12: 0000000000000003 R13: 0000000000008100 R14: ffff8880a7081a44 R15: ffff88809305f580 refcount_sub_and_test include/linux/refcount.h:261 [inline] sock_wfree+0x15a/0x1a0 net/core/sock.c:1965 sctp_wfree+0x30b/0x960 net/sctp/socket.c:8998 skb_release_head_state+0x9f/0x1a0 net/core/skbuff.c:652 skb_release_all+0xd/0x50 net/core/skbuff.c:663 __kfree_skb net/core/skbuff.c:679 [inline] consume_skb+0xad/0x2d0 net/core/skbuff.c:838 sctp_chunk_destroy net/sctp/sm_make_chunk.c:1454 [inline] sctp_chunk_put+0x16b/0x260 net/sctp/sm_make_chunk.c:1481 sctp_chunk_free+0x3f/0x50 net/sctp/sm_make_chunk.c:1468 __sctp_outq_teardown+0x68e/0xc30 net/sctp/outqueue.c:256 sctp_outq_free+0x9/0x10 net/sctp/outqueue.c:276 sctp_association_free+0x1d5/0x711 net/sctp/associola.c:336 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:929 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1317 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1184 [inline] sctp_do_sm+0x2f74/0x4b00 net/sctp/sm_sideeffect.c:1155 sctp_primitive_ABORT+0x7c/0xc0 net/sctp/primitive.c:104 sctp_close+0x227/0x7e0 net/sctp/socket.c:1513 inet_release+0xc1/0x1c0 net/ipv4/af_inet.c:427 __sock_release+0xc2/0x270 net/socket.c:590 sock_close+0x13/0x20 net/socket.c:1268 __fput+0x25a/0x770 fs/file_table.c:280 ____fput+0x9/0x10 fs/file_table.c:313 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x24e/0x2e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x4e8/0x5d0 arch/x86/entry/common.c:300 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x416041 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffff5219220 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000416041 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 0000000000000001 R08: 00ffffffffffffff R09: 00ffffffffffffff R10: 00007ffff5219300 R11: 0000000000000293 R12: 000000000076bf20 R13: 0000000000770850 R14: 0000000000010487 R15: 000000000076bf2c Kernel Offset: disabled Rebooting in 86400 seconds..