ci2 starts bisection 2024-09-17 00:09:20.868012772 +0000 UTC m=+34246.358440333 bisecting fixing commit since ad06eaf051cd0bdfd330f378c91f537107ce938e building syzkaller on af24b0505c748561efb50f1d03c824d6642f6c0b ensuring issue is reproducible on original commit ad06eaf051cd0bdfd330f378c91f537107ce938e testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b3aa40435bc3e6dfb4f3e9372ae317de6ea6cae8f263c44626b9552b85931053 run #0: crashed: BUG: soft lockup in inet_release run #1: crashed: BUG: soft lockup in sys_recvmsg run #2: crashed: BUG: soft lockup in inet_release run #3: crashed: BUG: soft lockup in rcu_core_si run #4: crashed: BUG: soft lockup in sys_recvmsg run #5: crashed: BUG: soft lockup in ipv6_rcv run #6: crashed: BUG: soft lockup in inet_release run #7: crashed: BUG: soft lockup in inet_release run #8: crashed: BUG: soft lockup in ipv6_rcv run #9: crashed: BUG: soft lockup in inet_release run #10: crashed: BUG: soft lockup in sock_read_iter run #11: crashed: BUG: soft lockup in inet_release run #12: crashed: BUG: soft lockup in rcu_core_si run #13: crashed: BUG: soft lockup in inotify_read run #14: crashed: BUG: soft lockup in inet_release run #15: crashed: BUG: soft lockup in inet_release run #16: crashed: BUG: soft lockup in ipv6_rcv run #17: crashed: BUG: soft lockup in sys_recvmsg run #18: crashed: no output from test machine run #19: crashed: no output from test machine representative crash: BUG: soft lockup in inet_release, types: [HANG] check whether we can drop unnecessary instrumentation disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 43e4503312df0dd2940f8995602b0bcaa998f54fd1e03252cddf0542a1ac91e0 run #0: crashed: BUG: soft lockup in rcu_core_si run #1: crashed: BUG: soft lockup in net_rx_action run #2: crashed: BUG: soft lockup in ipv6_rcv run #3: crashed: BUG: soft lockup in ipv6_rcv run #4: crashed: BUG: soft lockup in ipv6_rcv run #5: crashed: BUG: soft lockup in inet_release run #6: crashed: BUG: soft lockup in srcu_invoke_callbacks run #7: crashed: BUG: soft lockup in inet_release run #8: crashed: BUG: soft lockup in rcu_core_si run #9: crashed: BUG: soft lockup in sys_syslog representative crash: BUG: soft lockup in rcu_core_si, types: [HANG] the bug reproduces without the instrumentation disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed kconfig minimization: base=4920 full=6159 leaves diff=242 split chunks (needed=false): <242> split chunk #0 of len 242 into 5 parts testing without sub-chunk 1/5 disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 08ddd15b60a1edc1e07d6fb907a4d96ede4da2ba905c3046698c145d415e2530 run #0: crashed: BUG: soft lockup in bpf_prog_free_deferred run #1: crashed: BUG: soft lockup in sys_recvmsg run #2: crashed: BUG: soft lockup in inet_release run #3: crashed: BUG: soft lockup in sys_syslog run #4: crashed: BUG: soft lockup in bpf_prog_free_deferred run #5: crashed: BUG: soft lockup in ipv6_rcv run #6: crashed: BUG: soft lockup in inet_release run #7: crashed: BUG: soft lockup in sock_read_iter run #8: crashed: BUG: soft lockup in sys_syslog run #9: crashed: BUG: soft lockup in sock_read_iter representative crash: BUG: soft lockup in bpf_prog_free_deferred, types: [HANG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cf110c11dc51568501f4f1ac2051f50b86fcf2cd08a3262dc8d4493226c6be6f run #0: crashed: BUG: soft lockup in rcu_core_si run #1: crashed: BUG: soft lockup in ipv6_rcv run #2: crashed: BUG: soft lockup in inet_release run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in bpf_map_free_deferred run #5: crashed: BUG: soft lockup in ipv6_rcv run #6: crashed: BUG: soft lockup in inet_release run #7: crashed: BUG: soft lockup in kauditd_thread run #8: crashed: BUG: soft lockup in sock_read_iter run #9: crashed: BUG: soft lockup in rcu_core_si representative crash: BUG: soft lockup in rcu_core_si, types: [HANG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9c08880f57056cbd79f50670ce722e4c5c25e80bcb51753d81ee889bdde76aff run #0: crashed: BUG: soft lockup in rcu_core_si run #1: crashed: BUG: soft lockup in rcu_core_si run #2: crashed: BUG: soft lockup in sk_psock_destroy run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in inet_release run #5: crashed: BUG: soft lockup in rcu_core_si run #6: crashed: BUG: soft lockup in ipv6_rcv run #7: crashed: BUG: soft lockup in sock_read_iter run #8: crashed: BUG: soft lockup in inet_release run #9: crashed: no output from test machine representative crash: BUG: soft lockup in rcu_core_si, types: [HANG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP LEAK UBSAN BUG], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c7d8def83af4dfd4665fe706f518c7c4b849f466e3dc1d30a6c4d85246ea567b run #0: crashed: BUG: soft lockup in inet_release run #1: crashed: BUG: soft lockup in ipv6_rcv run #2: crashed: BUG: soft lockup in inet_release run #3: crashed: BUG: soft lockup in sys_syslog run #4: crashed: BUG: soft lockup in sys_syslog run #5: crashed: BUG: soft lockup in inet_release run #6: crashed: BUG: soft lockup in ipv6_rcv run #7: crashed: BUG: soft lockup in inet_release run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: soft lockup in inet_release, types: [HANG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit ad06eaf051cd0bdfd330f378c91f537107ce938e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building ad06eaf051cd0bdfd330f378c91f537107ce938e: net/socket.c:1191: undefined reference to `wext_handle_ioctl' net/socket.c:3385: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 46 configs; suspects: [HID_ZEROPLUS USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing current HEAD b92c0d35d015044124da6005ed3065becc8d98d9 testing commit b92c0d35d015044124da6005ed3065becc8d98d9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: dd63890cdcee2bf57ebd9a2c467cb34ebd2cba30d0bf8f3972a807a735317cad all runs: OK false negative chance: 0.000 # git bisect start b92c0d35d015044124da6005ed3065becc8d98d9 ad06eaf051cd0bdfd330f378c91f537107ce938e Bisecting: 1460 revisions left to test after this (roughly 11 steps) [fd7de66b50b5bd9d2434bb71e4f05a968beea898] fsnotify: optimize FS_MODIFY events with no ignored masks determine whether the revision contains the guilty commit checking the merge base 6139f2a02fe0ac7a08389b4eb786e0c659039ddd no existing result, test the revision testing commit 6139f2a02fe0ac7a08389b4eb786e0c659039ddd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c91a7c2ce8f736d04e64c15a48dc4a7a703276abe8fa26254ad92447f6196032 run #0: crashed: BUG: soft lockup in ipv6_rcv run #1: crashed: BUG: soft lockup in rcu_core_si run #2: crashed: BUG: soft lockup in ipv6_rcv run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in bpf_prog_free_deferred run #5: crashed: BUG: soft lockup in mld_ifc_work run #6: crashed: BUG: soft lockup in bpf_prog_free_deferred run #7: crashed: BUG: soft lockup in bpf_map_free_deferred run #8: crashed: BUG: soft lockup in sock_read_iter run #9: crashed: no output from test machine representative crash: BUG: soft lockup in ipv6_rcv, types: [HANG] testing commit fd7de66b50b5bd9d2434bb71e4f05a968beea898 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 213fe3199acc6d5caeb0a565bd719ac73777120ccf1f75d37653e58debaa2d84 run #0: crashed: BUG: soft lockup in kauditd_thread run #1: crashed: BUG: soft lockup in rcu_core_si run #2: crashed: BUG: soft lockup in ipv6_rcv run #3: crashed: BUG: soft lockup in bpf_map_free_deferred run #4: crashed: BUG: soft lockup in inet_release run #5: crashed: BUG: soft lockup in bpf_prog_free_deferred run #6: crashed: BUG: soft lockup in kernfs_fop_read_iter run #7: crashed: BUG: soft lockup in bpf_prog_free_deferred run #8: crashed: BUG: soft lockup in ipv6_rcv run #9: crashed: no output from test machine representative crash: BUG: soft lockup in kauditd_thread, types: [HANG] # git bisect good fd7de66b50b5bd9d2434bb71e4f05a968beea898 Bisecting: 730 revisions left to test after this (roughly 10 steps) [f1fa9a9816204ac4b118b2e613d3a7c981355019] clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change determine whether the revision contains the guilty commit revision 6139f2a02fe0ac7a08389b4eb786e0c659039ddd crashed and is reachable testing commit f1fa9a9816204ac4b118b2e613d3a7c981355019 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4f80ed236dcc3acd88f2b10f4fa214812875dda89a26d53a2653fbea844e19c8 run #0: crashed: BUG: soft lockup in rcu_core_si run #1: crashed: BUG: soft lockup in rcu_core_si run #2: crashed: BUG: soft lockup in ipv6_rcv run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in rcu_core_si run #5: crashed: BUG: soft lockup in ipv6_rcv run #6: crashed: BUG: soft lockup in bpf_map_free_deferred run #7: crashed: BUG: soft lockup in x64_sys_call run #8: crashed: BUG: soft lockup in ipv6_rcv run #9: crashed: BUG: soft lockup in bpf_map_free_deferred representative crash: BUG: soft lockup in rcu_core_si, types: [HANG] # git bisect good f1fa9a9816204ac4b118b2e613d3a7c981355019 Bisecting: 365 revisions left to test after this (roughly 9 steps) [e1e40928b78bd9c4be6c76509981dbea64279dd0] s390/boot: Remove alt_stfle_fac_list from decompressor determine whether the revision contains the guilty commit revision 6139f2a02fe0ac7a08389b4eb786e0c659039ddd crashed and is reachable testing commit e1e40928b78bd9c4be6c76509981dbea64279dd0 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4d1bfb778a2f8bdc282f0e237d53c01e34c98f6bcb1a08c77005d73c7979d8ba run #0: crashed: BUG: soft lockup in handle_softirqs run #1: crashed: BUG: soft lockup in bpf_prog_free_deferred run #2: crashed: BUG: soft lockup in bpf_map_free_deferred run #3: crashed: BUG: soft lockup in handle_softirqs run #4: crashed: BUG: soft lockup in inet_release run #5: crashed: BUG: soft lockup in kauditd_thread run #6: crashed: BUG: soft lockup in kernfs_fop_read_iter run #7: crashed: BUG: soft lockup in kauditd_thread run #8: crashed: BUG: soft lockup in x64_sys_call run #9: crashed: no output from test machine representative crash: BUG: soft lockup in handle_softirqs, types: [HANG] # git bisect good e1e40928b78bd9c4be6c76509981dbea64279dd0 Bisecting: 182 revisions left to test after this (roughly 8 steps) [522341158b106187e849daf5061091a668f018c1] Revert "USB: UAS: return ENODEV when submit urbs fail with device not attached" determine whether the revision contains the guilty commit revision ad06eaf051cd0bdfd330f378c91f537107ce938e crashed and is reachable testing commit 522341158b106187e849daf5061091a668f018c1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building 522341158b106187e849daf5061091a668f018c1: drivers/usb/storage/uas.c:257:2: error: implicit declaration of function 'scsi_done'; did you mean 'scsi_lock'? [-Werror=implicit-function-declaration] # git bisect skip 522341158b106187e849daf5061091a668f018c1 Bisecting: 182 revisions left to test after this (roughly 8 steps) [8d49ca19727b46a39a70bb9780f07825ebd67f0b] net: ena: Fix DMA syncing in XDP path when SWIOTLB is on determine whether the revision contains the guilty commit revision 6139f2a02fe0ac7a08389b4eb786e0c659039ddd crashed and is reachable testing commit 8d49ca19727b46a39a70bb9780f07825ebd67f0b gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 607ef6b759fa6faa0143ac3aba85337c2a8b589d925dec5d3622c31a2b1cc4f9 all runs: OK false negative chance: 0.000 # git bisect bad 8d49ca19727b46a39a70bb9780f07825ebd67f0b Bisecting: 45 revisions left to test after this (roughly 6 steps) [518a994aa0b87d96f1bc6678a7035df5d1fcd7a1] af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. determine whether the revision contains the guilty commit revision 6139f2a02fe0ac7a08389b4eb786e0c659039ddd crashed and is reachable testing commit 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 94a8c27f2e2944e9968f9513fccfe5fd208906bd3eb652d85f62f0214503e1ad run #0: crashed: BUG: soft lockup in ipv6_rcv run #1: crashed: BUG: soft lockup in handle_softirqs run #2: crashed: BUG: soft lockup in ipv6_rcv run #3: crashed: BUG: soft lockup in kauditd_thread run #4: crashed: BUG: soft lockup in inet_release run #5: crashed: BUG: soft lockup in x64_sys_call run #6: crashed: BUG: soft lockup in x64_sys_call run #7: crashed: BUG: soft lockup in handle_softirqs run #8: crashed: BUG: soft lockup in handle_softirqs run #9: crashed: BUG: soft lockup in sock_read_iter representative crash: BUG: soft lockup in ipv6_rcv, types: [HANG] # git bisect good 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 Bisecting: 22 revisions left to test after this (roughly 5 steps) [e5138f43c97de3330f4eb58cbc21e9b226e2605e] bpf: Fix potential integer overflow in resolve_btfids determine whether the revision contains the guilty commit revision f1fa9a9816204ac4b118b2e613d3a7c981355019 crashed and is reachable testing commit e5138f43c97de3330f4eb58cbc21e9b226e2605e gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 74401d345f8423008145ef5183bce308b3ecb7a1e1f6214f8710ec92ee61b361 run #0: crashed: BUG: soft lockup in sk_psock_destroy run #1: crashed: BUG: soft lockup in handle_softirqs run #2: crashed: BUG: soft lockup in handle_softirqs run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in inet_release run #5: crashed: BUG: soft lockup in inet_release run #6: crashed: BUG: soft lockup in inet_release run #7: crashed: BUG: soft lockup in x64_sys_call run #8: crashed: BUG: soft lockup in bpf_prog_free_deferred run #9: crashed: BUG: soft lockup in handle_softirqs representative crash: BUG: soft lockup in sk_psock_destroy, types: [HANG] # git bisect good e5138f43c97de3330f4eb58cbc21e9b226e2605e Bisecting: 10 revisions left to test after this (roughly 4 steps) [4ad48d7f26bb1a68e65941646a71441d12d15ee3] net: ena: Add capabilities field with support for ENI stats capability determine whether the revision contains the guilty commit revision 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 crashed and is reachable testing commit 4ad48d7f26bb1a68e65941646a71441d12d15ee3 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1d08cd334a5ca3fb6c42a4d613da37ac20a86f4fc928cff9c23eba049ab9a7fd all runs: OK false negative chance: 0.000 # git bisect bad 4ad48d7f26bb1a68e65941646a71441d12d15ee3 Bisecting: 5 revisions left to test after this (roughly 3 steps) [ae4053a6d4e38665604fbddd77488a710576fedf] netfilter: nft_payload: rebuild vlan header when needed determine whether the revision contains the guilty commit revision 6139f2a02fe0ac7a08389b4eb786e0c659039ddd crashed and is reachable testing commit ae4053a6d4e38665604fbddd77488a710576fedf gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 547d88f5b72015e04d3b032e52834f9da7cddaa44b53b30d486fe01692267cf3 all runs: OK false negative chance: 0.000 # git bisect bad ae4053a6d4e38665604fbddd77488a710576fedf Bisecting: 2 revisions left to test after this (roughly 2 steps) [11e8ecc5b86037fec43d07b1c162e233e131b1d9] bpf: Allow delete from sockmap/sockhash only if update is allowed determine whether the revision contains the guilty commit revision fd7de66b50b5bd9d2434bb71e4f05a968beea898 crashed and is reachable testing commit 11e8ecc5b86037fec43d07b1c162e233e131b1d9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 37b3680be4df2d5632560774e62fe8cfa13cf11bf362811fc6261819e2fa0867 all runs: OK false negative chance: 0.000 # git bisect bad 11e8ecc5b86037fec43d07b1c162e233e131b1d9 Bisecting: 1 revision left to test after this (roughly 1 step) [25571a12fbc8a1283bd8380d461267956fd426f7] enic: Validate length of nl attributes in enic_set_vf_port determine whether the revision contains the guilty commit revision fd7de66b50b5bd9d2434bb71e4f05a968beea898 crashed and is reachable testing commit 25571a12fbc8a1283bd8380d461267956fd426f7 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6b6c6e1c638459edd54dc5ac27f540a2ea6543c3a1e9975e81b0ec300e910d8b run #0: crashed: BUG: soft lockup in inet_release run #1: crashed: BUG: soft lockup in handle_softirqs run #2: crashed: BUG: soft lockup in handle_softirqs run #3: crashed: BUG: soft lockup in inet_release run #4: crashed: BUG: soft lockup in ipv6_rcv run #5: crashed: BUG: soft lockup in sock_read_iter run #6: crashed: BUG: soft lockup in kernfs_fop_release run #7: crashed: BUG: soft lockup in inet_release run #8: crashed: BUG: soft lockup in x64_sys_call run #9: crashed: no output from test machine representative crash: BUG: soft lockup in inet_release, types: [HANG] # git bisect good 25571a12fbc8a1283bd8380d461267956fd426f7 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a1f34dd7b8bbf4422cb09b5642aba3c178d88ef9] net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM determine whether the revision contains the guilty commit revision fd7de66b50b5bd9d2434bb71e4f05a968beea898 crashed and is reachable testing commit a1f34dd7b8bbf4422cb09b5642aba3c178d88ef9 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a44d6150396434e9dbde529ae321396b8d63bb4534a1fd0344133f0f383d8077 run #0: crashed: BUG: soft lockup in handle_softirqs run #1: crashed: BUG: soft lockup in ipv6_rcv run #2: crashed: BUG: soft lockup in handle_softirqs run #3: crashed: BUG: soft lockup in kauditd_thread run #4: crashed: BUG: soft lockup in handle_softirqs run #5: crashed: BUG: soft lockup in inet_release run #6: crashed: BUG: soft lockup in handle_softirqs run #7: crashed: BUG: soft lockup in sock_read_iter run #8: crashed: BUG: soft lockup in sock_read_iter run #9: crashed: BUG: soft lockup in x64_sys_call representative crash: BUG: soft lockup in handle_softirqs, types: [HANG] # git bisect good a1f34dd7b8bbf4422cb09b5642aba3c178d88ef9 11e8ecc5b86037fec43d07b1c162e233e131b1d9 is the first bad commit commit 11e8ecc5b86037fec43d07b1c162e233e131b1d9 Author: Jakub Sitnicki Date: Mon May 27 13:20:07 2024 +0200 bpf: Allow delete from sockmap/sockhash only if update is allowed [ Upstream commit 98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d ] We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash. We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types. Fixes: ff9105993240 ("bpf, sockmap: Prevent lock inversion deadlock in map delete elem") Reported-by: Tetsuo Handa Reported-by: syzbot+ec941d6e24f633a59172@syzkaller.appspotmail.com Signed-off-by: Jakub Sitnicki Signed-off-by: Daniel Borkmann Tested-by: syzbot+ec941d6e24f633a59172@syzkaller.appspotmail.com Acked-by: John Fastabend Closes: https://syzkaller.appspot.com/bug?extid=ec941d6e24f633a59172 Link: https://lore.kernel.org/bpf/20240527-sockmap-verify-deletes-v1-1-944b372f2101@cloudflare.com Signed-off-by: Sasha Levin kernel/bpf/verifier.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) accumulated error probability: 0.00 culprit signature: 37b3680be4df2d5632560774e62fe8cfa13cf11bf362811fc6261819e2fa0867 parent signature: a44d6150396434e9dbde529ae321396b8d63bb4534a1fd0344133f0f383d8077 revisions tested: 19, total time: 3h14m4.574415272s (build: 32m33.51512052s, test: 2h37m37.347911492s) first good commit: 11e8ecc5b86037fec43d07b1c162e233e131b1d9 bpf: Allow delete from sockmap/sockhash only if update is allowed recipients (to): ["daniel@iogearbox.net" "jakub@cloudflare.com" "john.fastabend@gmail.com" "sashal@kernel.org" "syzbot+ec941d6e24f633a59172@syzkaller.appspotmail.com"] recipients (cc): []