bisecting fixing commit since c10b57a567e4333b9fdf60b5ec36de9859263ca2 building syzkaller on 9f7c6d12944cebe5a50edd9194b336d28e141892 testing commit c10b57a567e4333b9fdf60b5ec36de9859263ca2 with gcc (GCC) 8.1.0 kernel signature: e8c6c0c301ea51199e97f4dda85a53b7a72103ab66355c9a88c085aeccaf763a all runs: crashed: KASAN: use-after-free Read in do_blk_trace_setup testing current HEAD b850307b279cbd12ab8c654d1a3dfe55319cc475 testing commit b850307b279cbd12ab8c654d1a3dfe55319cc475 with gcc (GCC) 8.1.0 kernel signature: 376ec8200d4d9e28d143fbb1dcceb377527d913598dbb511e3defc9bd34b49d8 all runs: OK # git bisect start b850307b279cbd12ab8c654d1a3dfe55319cc475 c10b57a567e4333b9fdf60b5ec36de9859263ca2 Bisecting: 332 revisions left to test after this (roughly 8 steps) [2b6131e8316df2235dc0f63c03008376e027cee8] RDMA/mlx5: Set GRH fields in query QP on RoCE testing commit 2b6131e8316df2235dc0f63c03008376e027cee8 with gcc (GCC) 8.1.0 kernel signature: dfdabed1c0aad2e1c5cb0023c22e0ef8e9965fa21e480826daa78739272d9877 all runs: crashed: KASAN: use-after-free Read in do_blk_trace_setup # git bisect good 2b6131e8316df2235dc0f63c03008376e027cee8 Bisecting: 166 revisions left to test after this (roughly 7 steps) [486a24502c9ac33bb3bc05ba598fb3b43134e3ab] vhost/vsock: fix packet delivery order to monitoring devices testing commit 486a24502c9ac33bb3bc05ba598fb3b43134e3ab with gcc (GCC) 8.1.0 kernel signature: 9b25af5c0a1ccf4c162fe2432ae8ab752feb36e7f5716fbf68342b92d067fffd all runs: OK # git bisect bad 486a24502c9ac33bb3bc05ba598fb3b43134e3ab Bisecting: 82 revisions left to test after this (roughly 6 steps) [5bb1c0f27e8b3c83c1ccb249d812545a3b5cfc8b] shmem: fix possible deadlocks on shmlock_user_lock testing commit 5bb1c0f27e8b3c83c1ccb249d812545a3b5cfc8b with gcc (GCC) 8.1.0 kernel signature: 32350b9a064f882fc3580485c458d698374e9b0336e770cacf8a07ea6c0f6fd6 all runs: OK # git bisect bad 5bb1c0f27e8b3c83c1ccb249d812545a3b5cfc8b Bisecting: 41 revisions left to test after this (roughly 5 steps) [4836eb6b59657a383fa97d3d301da77581ec8f0c] sch_choke: avoid potential panic in choke_reset() testing commit 4836eb6b59657a383fa97d3d301da77581ec8f0c with gcc (GCC) 8.1.0 kernel signature: aa39f7a196fd665a01addf99d5ca924d6ac43b7356430d41dd1481b96eed2656 all runs: crashed: KASAN: use-after-free Read in do_blk_trace_setup # git bisect good 4836eb6b59657a383fa97d3d301da77581ec8f0c Bisecting: 20 revisions left to test after this (roughly 4 steps) [81f4be8be78d54b7c8db0ab4e1a6cef6281ca1f3] batman-adv: Fix refcnt leak in batadv_v_ogm_process testing commit 81f4be8be78d54b7c8db0ab4e1a6cef6281ca1f3 with gcc (GCC) 8.1.0 kernel signature: f988b6bac0f33dc35c70fa2c8aef30132688951d581991ec535c4a7c6fe2249a all runs: crashed: KASAN: use-after-free Read in do_blk_trace_setup # git bisect good 81f4be8be78d54b7c8db0ab4e1a6cef6281ca1f3 Bisecting: 10 revisions left to test after this (roughly 3 steps) [8ab8786f78c3fc930f9abf6d6d85e95567de4e1f] net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup testing commit 8ab8786f78c3fc930f9abf6d6d85e95567de4e1f with gcc (GCC) 8.1.0 kernel signature: e471b957ec7861e1254f83d4a3fc8c6e6515edb9e50f75078f100801104e036c all runs: crashed: KASAN: use-after-free Read in do_blk_trace_setup # git bisect good 8ab8786f78c3fc930f9abf6d6d85e95567de4e1f Bisecting: 5 revisions left to test after this (roughly 3 steps) [a289f82f6a7e7751c03604d6efe63c5121a3ec0f] f2fs: introduce read_inline_xattr testing commit a289f82f6a7e7751c03604d6efe63c5121a3ec0f with gcc (GCC) 8.1.0 kernel signature: 09cf86465323a8b01d7913700cd6c33b8779d3b5da4d5ca4b881e28cbe147498 all runs: OK # git bisect bad a289f82f6a7e7751c03604d6efe63c5121a3ec0f Bisecting: 2 revisions left to test after this (roughly 1 step) [f7216a2ebed6492254ea0e72994289400ac86ce4] blktrace: fix trace mutex deadlock testing commit f7216a2ebed6492254ea0e72994289400ac86ce4 with gcc (GCC) 8.1.0 kernel signature: 882d133ded3b3c2a3c39eee41d34b89bbb4adce04b5cb205799449556cd5f610 all runs: OK # git bisect bad f7216a2ebed6492254ea0e72994289400ac86ce4 Bisecting: 0 revisions left to test after this (roughly 0 steps) [b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa] blktrace: fix unlocked access to init/start-stop/teardown testing commit b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa with gcc (GCC) 8.1.0 kernel signature: a6fcbe539a12d863d9574d05f053a427a7b483329e70eaadc2457f646e8aa6c4 all runs: OK # git bisect bad b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa is the first bad commit commit b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa Author: Jens Axboe Date: Sun Nov 5 09:13:48 2017 -0700 blktrace: fix unlocked access to init/start-stop/teardown commit 1f2cac107c591c24b60b115d6050adc213d10fc0 upstream. sg.c calls into the blktrace functions without holding the proper queue mutex for doing setup, start/stop, or teardown. Add internal unlocked variants, and export the ones that do the proper locking. Fixes: 6da127ad0918 ("blktrace: Add blktrace ioctls to SCSI generic devices") Tested-by: Dmitry Vyukov Signed-off-by: Jens Axboe Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman kernel/trace/blktrace.c | 58 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 48 insertions(+), 10 deletions(-) culprit signature: a6fcbe539a12d863d9574d05f053a427a7b483329e70eaadc2457f646e8aa6c4 parent signature: e471b957ec7861e1254f83d4a3fc8c6e6515edb9e50f75078f100801104e036c revisions tested: 11, total time: 2h57m38.946299457s (build: 1h31m56.509451221s, test: 1h24m35.832258678s) first good commit: b390c22c0bc7582e2cd3ee9f3f85606e6ebc78fa blktrace: fix unlocked access to init/start-stop/teardown cc: ["axboe@kernel.dk" "ben.hutchings@codethink.co.uk" "dvyukov@google.com" "gregkh@linuxfoundation.org"]