bisecting fixing commit since b81b1829e7e39f6cebdf6e4d5484eacbceda8554 building syzkaller on 8b9ca619df135211a89cc19719f2705d0016045d testing commit b81b1829e7e39f6cebdf6e4d5484eacbceda8554 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 38fcbfc8b96e7db72540eb416481e1921d06ac451605f764e7ee0949da56d8c1 run #0: crashed: general protection fault in reweight_entity run #1: crashed: general protection fault in reweight_entity run #2: crashed: general protection fault in reweight_entity run #3: crashed: general protection fault in reweight_entity run #4: crashed: general protection fault in reweight_entity run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing current HEAD 09688c0166e76ce2fb85e86b9d99be8b0084cdf9 testing commit 09688c0166e76ce2fb85e86b9d99be8b0084cdf9 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 097ce682db872b53f265206bc98ceb2fae2e3e738fab83f92a249aec33a52bc2 all runs: OK # git bisect start 09688c0166e76ce2fb85e86b9d99be8b0084cdf9 b81b1829e7e39f6cebdf6e4d5484eacbceda8554 Bisecting: 563 revisions left to test after this (roughly 9 steps) [c0419188b5c1a7735b12cf1405cafc3f8d722819] Merge tag 'for-5.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit c0419188b5c1a7735b12cf1405cafc3f8d722819 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8a7036dfe8ca5770e2db01654f95878e77cbb1373c07cfd48780bfd9d42eaba7 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: EOF run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad c0419188b5c1a7735b12cf1405cafc3f8d722819 Bisecting: 283 revisions left to test after this (roughly 8 steps) [77478077349f14c78e30faeac358cf1187c0f0c1] Merge tag 'dmaengine-fix-5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine testing commit 77478077349f14c78e30faeac358cf1187c0f0c1 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 017b364f79859d693dbc98c590ada2682cd5525c530216dee919b51a10a3cca9 all runs: OK # git bisect bad 77478077349f14c78e30faeac358cf1187c0f0c1 Bisecting: 126 revisions left to test after this (roughly 7 steps) [8b97cae315cafd7debf3601f88621e2aa8956ef3] Merge tag 'net-5.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 8b97cae315cafd7debf3601f88621e2aa8956ef3 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 182d671379174d0b027910ac2924c42c2b20d62f2bb50009f2e81147f84a9559 run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: EOF run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 8b97cae315cafd7debf3601f88621e2aa8956ef3 Bisecting: 80 revisions left to test after this (roughly 6 steps) [edbd6c628ef194ebef6e7b82ec9e396f57695d06] Merge tag 'modules-5.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux testing commit edbd6c628ef194ebef6e7b82ec9e396f57695d06 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 03d34d445a1e47948c5bab3341927b37ed961f768ac44c0f5c349b768d58ba6a all runs: OK # git bisect bad edbd6c628ef194ebef6e7b82ec9e396f57695d06 Bisecting: 41 revisions left to test after this (roughly 5 steps) [2572da44a51192ad181482c1989e66e5eb47dcbe] Merge tag 'for-5.17/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux testing commit 2572da44a51192ad181482c1989e66e5eb47dcbe compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7aa6e4126ae8ef2de47b02cd40250c8c079da2fd5b232762fc2e873987440cb2 failed: failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:PERMISSIONS_ERROR Location: Message:Required 'read' permission for 'disks/ci-upstream-kasan-gce-bisect-job-bisect-job-image.tar.gz' ForceSendFields:[] NullFields:[]}. # git bisect skip 2572da44a51192ad181482c1989e66e5eb47dcbe Bisecting: 41 revisions left to test after this (roughly 5 steps) [d567f5db412ed52de0b3b3efca4a451263de6108] Merge tag 'regulator-fix-v5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator testing commit d567f5db412ed52de0b3b3efca4a451263de6108 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a4c053a2c5fc736cb353279478b161d2fc5697d2d0a78332e90d89265387f3a6 all runs: OK # git bisect bad d567f5db412ed52de0b3b3efca4a451263de6108 Bisecting: 12 revisions left to test after this (roughly 4 steps) [42964a18f81c9e514dce2d11277b7cc546146723] Merge tag 'objtool_urgent_for_v5.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 42964a18f81c9e514dce2d11277b7cc546146723 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3c2f9ebcda6661e39d69f7561c403619c5a5b2e23d1e8673e2572d6169bb86ac all runs: OK # git bisect bad 42964a18f81c9e514dce2d11277b7cc546146723 Bisecting: 5 revisions left to test after this (roughly 3 steps) [808f0ab22106d2305b33a2b3e4df559a92679615] Merge tag 'x86_urgent_for_v5.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 808f0ab22106d2305b33a2b3e4df559a92679615 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5d536bcf558260343abfceab664495c04234b14a54a3c428e7dea3639db54f88 run #0: crashed: general protection fault in reweight_entity run #1: crashed: general protection fault in reweight_entity run #2: crashed: general protection fault in reweight_entity run #3: crashed: general protection fault in reweight_entity run #4: crashed: general protection fault in reweight_entity run #5: crashed: general protection fault in reweight_entity run #6: crashed: general protection fault in reweight_entity run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect good 808f0ab22106d2305b33a2b3e4df559a92679615 Bisecting: 1 revision left to test after this (roughly 2 steps) [6f3573672324b6391014680dd6e2cf7298aaea22] Merge tag 'sched_urgent_for_v5.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 6f3573672324b6391014680dd6e2cf7298aaea22 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 77af62037ea11f4af47c96101f7f5ea45448e8af01bc83209f22a7f924e36962 all runs: OK # git bisect bad 6f3573672324b6391014680dd6e2cf7298aaea22 Bisecting: 1 revision left to test after this (roughly 1 step) [f5e02656b19fa4e38180a08faadd631858a02877] Merge tag 'perf_urgent_for_v5.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit f5e02656b19fa4e38180a08faadd631858a02877 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 687855aa2fca0de0288ce8d0e4dba3c02a2c379c1460054376fc9e573fe82f77 run #0: crashed: general protection fault in reweight_entity run #1: crashed: general protection fault in reweight_entity run #2: crashed: general protection fault in reweight_entity run #3: crashed: general protection fault in reweight_entity run #4: crashed: general protection fault in reweight_entity run #5: crashed: general protection fault in reweight_entity run #6: crashed: general protection fault in reweight_entity run #7: crashed: general protection fault in reweight_entity run #8: crashed: general protection fault in reweight_entity run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: crashed: general protection fault in reweight_entity run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect good f5e02656b19fa4e38180a08faadd631858a02877 Bisecting: 0 revisions left to test after this (roughly 0 steps) [13765de8148f71fa795e0a6607de37c49ea5915a] sched/fair: Fix fault in reweight_entity testing commit 13765de8148f71fa795e0a6607de37c49ea5915a compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: edd6706da70a51a8590a98581cc4e1824768fc6ccf281c9b0902f76b89c1d69d all runs: OK # git bisect bad 13765de8148f71fa795e0a6607de37c49ea5915a 13765de8148f71fa795e0a6607de37c49ea5915a is the first bad commit commit 13765de8148f71fa795e0a6607de37c49ea5915a Author: Tadeusz Struk Date: Thu Feb 3 08:18:46 2022 -0800 sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") There is a race between sched_post_fork() and setpriority(PRIO_PGRP) within a thread group that causes a null-ptr-deref in reweight_entity() in CFS. The scenario is that the main process spawns number of new threads, which then call setpriority(PRIO_PGRP, 0, -20), wait, and exit. For each of the new threads the copy_process() gets invoked, which adds the new task_struct and calls sched_post_fork() for it. In the above scenario there is a possibility that setpriority(PRIO_PGRP) and set_one_prio() will be called for a thread in the group that is just being created by copy_process(), and for which the sched_post_fork() has not been executed yet. This will trigger a null pointer dereference in reweight_entity(), as it will try to access the run queue pointer, which hasn't been set. Before the mentioned change the cfs_rq pointer for the task has been set in sched_fork(), which is called much earlier in copy_process(), before the new task is added to the thread_group. Now it is done in the sched_post_fork(), which is called after that. To fix the issue the remove the update_load param from the update_load param() function and call reweight_task() only if the task flag doesn't have the TASK_NEW flag set. Fixes: 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Reported-by: syzbot+af7a719bc92395ee41b3@syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dietmar Eggemann Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20220203161846.1160750-1-tadeusz.struk@linaro.org kernel/sched/core.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) parent commit 26291c54e111ff6ba87a164d85d4a4e134b7315c wasn't tested testing commit 26291c54e111ff6ba87a164d85d4a4e134b7315c compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 6841c34d0860e39a962646099cf04144ad17ef5db2a086fe009b1db62eb8d578 culprit signature: edd6706da70a51a8590a98581cc4e1824768fc6ccf281c9b0902f76b89c1d69d parent signature: 6841c34d0860e39a962646099cf04144ad17ef5db2a086fe009b1db62eb8d578 Reproducer flagged being flaky revisions tested: 13, total time: 2h34m45.368509377s (build: 1h25m6.601479389s, test: 1h8m29.865311945s) first good commit: 13765de8148f71fa795e0a6607de37c49ea5915a sched/fair: Fix fault in reweight_entity recipients (to): ["dietmar.eggemann@arm.com" "peterz@infradead.org" "tadeusz.struk@linaro.org"] recipients (cc): []