bisecting cause commit starting from bc88f85c6c09306bd21917e1ae28205e9cd775a7
building syzkaller on 8c88c9c1c99c8cd8dabc951164c820b9c9f25114
testing commit bc88f85c6c09306bd21917e1ae28205e9cd775a7 with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: crashed: WARNING: refcount bug in find_key_to_update
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v5.3
testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: crashed: WARNING: refcount bug in find_key_to_update
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0
all runs: OK
# git bisect start v5.3 v5.2
Bisecting: 7848 revisions left to test after this (roughly 13 steps)
[43c95d3694cc448fdf50bd53b7ff3a5bb4655883] Merge tag 'pinctrl-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
testing commit 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 43c95d3694cc448fdf50bd53b7ff3a5bb4655883
Bisecting: 3922 revisions left to test after this (roughly 12 steps)
[0e2a5b5bd9a6aaec85df347dd71432a1d2d10763] Merge branch 'parisc-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux
testing commit 0e2a5b5bd9a6aaec85df347dd71432a1d2d10763 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 0e2a5b5bd9a6aaec85df347dd71432a1d2d10763
Bisecting: 1961 revisions left to test after this (roughly 11 steps)
[12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea] perf record: Fix module size on s390
testing commit 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 12a6d2940b5f02b4b9f71ce098e3bb02bc24a9ea
Bisecting: 721 revisions left to test after this (roughly 10 steps)
[af6af87d7e4ff67324425daa699b9cda32e3161d] Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
testing commit af6af87d7e4ff67324425daa699b9cda32e3161d with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: crashed: WARNING: refcount bug in find_key_to_update
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: crashed: WARNING: refcount bug in find_key_to_update
run #7: OK
run #8: OK
run #9: OK
# git bisect bad af6af87d7e4ff67324425daa699b9cda32e3161d
Bisecting: 619 revisions left to test after this (roughly 9 steps)
[72ce9b7cab96d2b08d13b4f018c3625ae74a5d9d] Merge tag 'qcom-arm64-for-5.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt
testing commit 72ce9b7cab96d2b08d13b4f018c3625ae74a5d9d with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 72ce9b7cab96d2b08d13b4f018c3625ae74a5d9d
Bisecting: 309 revisions left to test after this (roughly 8 steps)
[d2fbf4b6d585e40f2369675148777abce3abd0e7] Merge branch 'work.adfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
testing commit d2fbf4b6d585e40f2369675148777abce3abd0e7 with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad d2fbf4b6d585e40f2369675148777abce3abd0e7
Bisecting: 175 revisions left to test after this (roughly 7 steps)
[249be8511b269495bc95cb8bdfdd5840b2ba73c0] Merge branch 'akpm' (patches from Andrew)
testing commit 249be8511b269495bc95cb8bdfdd5840b2ba73c0 with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 249be8511b269495bc95cb8bdfdd5840b2ba73c0
Bisecting: 66 revisions left to test after this (roughly 6 steps)
[7402a4fedc2bc448100c2d086406c708451b16dc] SUNRPC: Fix up backchannel slot table accounting
testing commit 7402a4fedc2bc448100c2d086406c708451b16dc with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 7402a4fedc2bc448100c2d086406c708451b16dc
Bisecting: 33 revisions left to test after this (roughly 5 steps)
[7cc7867fb06166ac113eda9cf20d3c15d95ff6f5] mm/devm_memremap_pages: enable sub-section remap
testing commit 7cc7867fb06166ac113eda9cf20d3c15d95ff6f5 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 7cc7867fb06166ac113eda9cf20d3c15d95ff6f5
Bisecting: 17 revisions left to test after this (roughly 4 steps)
[0570bc8b7c9b41deba6f61ac218922e7168ad648] Merge tag 'riscv/for-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
testing commit 0570bc8b7c9b41deba6f61ac218922e7168ad648 with gcc (GCC) 8.1.0
run #0: crashed: WARNING: refcount bug in find_key_to_update
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad 0570bc8b7c9b41deba6f61ac218922e7168ad648
Bisecting: 7 revisions left to test after this (roughly 3 steps)
[d90d45d7dcb732f0d4fbb3b99164ae54999612d5] RISC-V: Fix memory reservation in setup_bootmem()
testing commit d90d45d7dcb732f0d4fbb3b99164ae54999612d5 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good d90d45d7dcb732f0d4fbb3b99164ae54999612d5
Bisecting: 3 revisions left to test after this (roughly 2 steps)
[2ebca1cbb4a5a31f8d89f22d9d410b432a97f7a7] riscv: remove free_initrd_mem
testing commit 2ebca1cbb4a5a31f8d89f22d9d410b432a97f7a7 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 2ebca1cbb4a5a31f8d89f22d9d410b432a97f7a7
Bisecting: 1 revision left to test after this (roughly 1 step)
[0f327f2aaad6a87356cbccfa390d4d3b64d0d3b6] RISC-V: Add an Image header that boot loader can parse.
testing commit 0f327f2aaad6a87356cbccfa390d4d3b64d0d3b6 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 0f327f2aaad6a87356cbccfa390d4d3b64d0d3b6
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[2d69fbf3d01a5b71e98137e2406d4087960c512e] riscv: fix build break after macro-to-function conversion in generic cacheflush.h
testing commit 2d69fbf3d01a5b71e98137e2406d4087960c512e with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 2d69fbf3d01a5b71e98137e2406d4087960c512e
0570bc8b7c9b41deba6f61ac218922e7168ad648 is the first bad commit
revisions tested: 17, total time: 4h36m11.804953739s (build: 1h38m7.058297602s, test: 2h52m27.316116261s)
first bad commit: 0570bc8b7c9b41deba6f61ac218922e7168ad648 Merge tag 'riscv/for-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
cc: ["aou@eecs.berkeley.edu" "linux-kernel@vger.kernel.org" "linux-riscv@lists.infradead.org" "palmer@sifive.com" "torvalds@linux-foundation.org"]
crash: WARNING: refcount bug in find_key_to_update
------------[ cut here ]------------
refcount_t: increment on 0; use-after-free.
WARNING: CPU: 1 PID: 15540 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30 lib/refcount.c:156
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 15540 Comm: syz-executor.0 Not tainted 5.2.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x113/0x167 lib/dump_stack.c:113
 panic+0x223/0x4dc kernel/panic.c:219
 __warn.cold.10+0x1b/0x37 kernel/panic.c:576
 report_bug+0x1a4/0x200 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1008
RIP: 0010:refcount_inc_checked+0x2b/0x30 lib/refcount.c:156
Code: 48 89 e5 e8 97 fe ff ff 84 c0 74 02 5d c3 80 3d b8 4e f3 05 00 75 f5 48 c7 c7 60 5f 42 87 c6 05 a8 4e f3 05 01 e8 07 aa 3a fe <0f> 0b 5d c3 90 55 48 89 e5 41 56 41 55 49 89 fd 48 c7 c7 c0 5f 42
RSP: 0018:ffff888079037c60 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8880a96e2dc0 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff89d98140
RBP: ffff888079037c60 R08: ffffed1015d660b1 R09: ffffed1015d660b1
R10: ffffed1015d660b0 R11: ffff8880aeb30587 R12: 0000000000000001
R13: ffff888093d586c0 R14: ffff888079037d38 R15: ffffffff88695f80
 __key_get include/linux/key.h:281 [inline]
 find_key_to_update+0x67/0x80 security/keys/keyring.c:1127
 key_create_or_update+0x4e5/0xb20 security/keys/key.c:905
 __do_sys_add_key security/keys/keyctl.c:132 [inline]
 __se_sys_add_key security/keys/keyctl.c:72 [inline]
 __x64_sys_add_key+0x219/0x3f0 security/keys/keyctl.c:72
 do_syscall_64+0xd0/0x540 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459a59
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2424413c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000459a59
RDX: 0000000020000440 RSI: 0000000020000000 RDI: 0000000020000040
RBP: 000000000075bf20 R08: fffffffffffffffe R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 00007f24244146d4
R13: 00000000004bfab8 R14: 00000000004d1ad8 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..