bisecting cause commit starting from b4f20b70784aabf97e1727561e775500f6e294c7 building syzkaller on 6a383ecfb767c80c9fa63c7708b25e568a4ebfec testing commit b4f20b70784aabf97e1727561e775500f6e294c7 with gcc (GCC) 10.2.1 20210217 kernel signature: 1bbdb3f28a0f8ae38733774f46c6bd42774fecfc733bdbb5cce72a20e8359782 run #0: crashed: INFO: task can't die in msleep run #1: crashed: INFO: task can't die in msleep run #2: crashed: INFO: task can't die in msleep run #3: crashed: INFO: task can't die in msleep run #4: crashed: INFO: task can't die in msleep run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing release v5.11 testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217 kernel signature: c91dd831bdc1478ecd8ea364b531db7675d35de370153360d0789f854c5ca7bb run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK testing release v5.10 testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 10.2.1 20210217 kernel signature: 66e2b48b5b78a2ecccf2b8acc506223155a1ca4f462fb0b40f73d696cdf5c6f3 all runs: OK # git bisect start f40ddce88593482919761f74910f42f4b84c004b 2c85ebc57b3e1817b6ce1a6b703928e113a90442 Bisecting: 7761 revisions left to test after this (roughly 13 steps) [538fcf57aaee6ad78a05f52b69a99baa22b33418] Merge branches 'acpi-scan', 'acpi-pnp' and 'acpi-sleep' testing commit 538fcf57aaee6ad78a05f52b69a99baa22b33418 with gcc (GCC) 10.2.1 20210217 kernel signature: 97d9c96934853f297999aa4d2a265b567c8a59574546394f434059aa23a9cd04 all runs: OK # git bisect good 538fcf57aaee6ad78a05f52b69a99baa22b33418 Bisecting: 3868 revisions left to test after this (roughly 12 steps) [d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214] Merge tag 'net-5.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214 with gcc (GCC) 10.2.1 20210217 kernel signature: 9828909d9813a9cc629e0901129c8d83d766f24402ae2b0f0435ebfcc257eb29 all runs: OK # git bisect good d64c6f96ba86bd8b97ed8d6762a8c8cc1770d214 Bisecting: 1934 revisions left to test after this (roughly 11 steps) [70b6ff35d62050d1573876cc0e1e078acd3e6008] cfg80211/mac80211: fix kernel-doc for SAR APIs testing commit 70b6ff35d62050d1573876cc0e1e078acd3e6008 with gcc (GCC) 10.2.1 20210217 kernel signature: 1eb8f4331ca13a53664d01dd91e923a3420cffb333f7739143211d1a3b0c4a2c all runs: OK # git bisect good 70b6ff35d62050d1573876cc0e1e078acd3e6008 Bisecting: 965 revisions left to test after this (roughly 10 steps) [17b6c49da37f5d57d76bf352d32b0ac498e7c133] Merge tag 'x86_urgent_for_v5.11_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 17b6c49da37f5d57d76bf352d32b0ac498e7c133 with gcc (GCC) 10.2.1 20210217 kernel signature: 3c69f30c73838dd29bfde2a21ce693dddddb3a2f533ce0fcbdb855a35650dde8 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 17b6c49da37f5d57d76bf352d32b0ac498e7c133 Bisecting: 464 revisions left to test after this (roughly 9 steps) [e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b] Merge tag 'net-5.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b with gcc (GCC) 10.2.1 20210217 kernel signature: 3ea1ecce1ac879055df730f8ba002e779ee48dd04ea060a21edb8ce70aa03ad7 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad e8c13a6bc8ebbef7bd099ec1061633d1c9c94d5b Bisecting: 241 revisions left to test after this (roughly 8 steps) [e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e] Merge tag 'char-misc-5.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc testing commit e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e with gcc (GCC) 10.2.1 20210217 kernel signature: 73fc58ef479540f5c46ec932b82365878cd09f48060fee28572c5de78dbbc347 all runs: OK # git bisect good e07cd2f3e7e525fa8df334d11beceb4c1bdcc74e Bisecting: 126 revisions left to test after this (roughly 7 steps) [ea49c88f4071e2bdd55e78987f251ea54aa11004] Merge tag 'mkp-scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi testing commit ea49c88f4071e2bdd55e78987f251ea54aa11004 with gcc (GCC) 10.2.1 20210217 kernel signature: 0954ee4a6fa7a4067bc8e0d0d775dfef8c52ae7a2c1224b5cdfc9cf2b27477a4 all runs: OK # git bisect good ea49c88f4071e2bdd55e78987f251ea54aa11004 Bisecting: 63 revisions left to test after this (roughly 6 steps) [4f3786e011940d83d7a9c365730936db96a0b233] MAINTAINERS: ipvs: move Wensong Zhang to CREDITS testing commit 4f3786e011940d83d7a9c365730936db96a0b233 with gcc (GCC) 10.2.1 20210217 kernel signature: 78a59e79963edcf6ac1d6b8fdc2c7b4d7a5f7ab56c745ea7139edb48f6d33552 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: crashed: unregister_netdevice: waiting for DEV to become free run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 4f3786e011940d83d7a9c365730936db96a0b233 Bisecting: 30 revisions left to test after this (roughly 5 steps) [ece9ab2a78afa1424c1aff45b1a95748dbc1f100] Merge branch 'bnxt_en-bug-fixes' testing commit ece9ab2a78afa1424c1aff45b1a95748dbc1f100 with gcc (GCC) 10.2.1 20210217 kernel signature: 0e91506585c6d9171434f75cbda3aae16c58d304c6ba943017652a1181f10a6b run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad ece9ab2a78afa1424c1aff45b1a95748dbc1f100 Bisecting: 15 revisions left to test after this (roughly 4 steps) [f97844f9c518172f813b7ece18a9956b1f70c1bb] dt-bindings: net: renesas,etheravb: RZ/G2H needs tx-internal-delay-ps testing commit f97844f9c518172f813b7ece18a9956b1f70c1bb with gcc (GCC) 10.2.1 20210217 kernel signature: 5208a70d2914b94800443747268a3781dac3867acc4b6ca433cb401ca8e01b04 run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: crashed: unregister_netdevice: waiting for DEV to become free run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad f97844f9c518172f813b7ece18a9956b1f70c1bb Bisecting: 7 revisions left to test after this (roughly 3 steps) [c49243e8898233de18edfaaa5b7b261ea457f221] Merge branch 'net-fix-issues-around-register_netdevice-failures' testing commit c49243e8898233de18edfaaa5b7b261ea457f221 with gcc (GCC) 10.2.1 20210217 kernel signature: 7703079bfb2f094ff88f7888630cc4b51fdc5bcfe304b28b8aed61c6556683ff run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: OK run #8: OK run #9: OK run #10: crashed: unregister_netdevice: waiting for DEV to become free run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad c49243e8898233de18edfaaa5b7b261ea457f221 Bisecting: 3 revisions left to test after this (roughly 2 steps) [c1787ffd0d24eb93eefac2dbba0eac5700da9ff1] ppp: fix refcount underflow on channel unbridge testing commit c1787ffd0d24eb93eefac2dbba0eac5700da9ff1 with gcc (GCC) 10.2.1 20210217 kernel signature: 2f37353fa816fa17ee4f927a02368e1d30e00bebdea57d9af98a79a3c10b88fb all runs: OK # git bisect good c1787ffd0d24eb93eefac2dbba0eac5700da9ff1 Bisecting: 1 revision left to test after this (roughly 1 step) [c269a24ce057abfc31130960e96ab197ef6ab196] net: make free_netdev() more lenient with unregistering devices testing commit c269a24ce057abfc31130960e96ab197ef6ab196 with gcc (GCC) 10.2.1 20210217 kernel signature: baa7fbf4fc5f8133452ee7f3fe91f456f6117ae1b27ca1b305194a8d80c84911 all runs: OK # git bisect good c269a24ce057abfc31130960e96ab197ef6ab196 Bisecting: 0 revisions left to test after this (roughly 0 steps) [766b0515d5bec4b780750773ed3009b148df8c0a] net: make sure devices go through netdev_wait_all_refs testing commit 766b0515d5bec4b780750773ed3009b148df8c0a with gcc (GCC) 10.2.1 20210217 kernel signature: 7703079bfb2f094ff88f7888630cc4b51fdc5bcfe304b28b8aed61c6556683ff run #0: crashed: unregister_netdevice: waiting for DEV to become free run #1: crashed: unregister_netdevice: waiting for DEV to become free run #2: crashed: unregister_netdevice: waiting for DEV to become free run #3: crashed: unregister_netdevice: waiting for DEV to become free run #4: crashed: unregister_netdevice: waiting for DEV to become free run #5: crashed: unregister_netdevice: waiting for DEV to become free run #6: crashed: unregister_netdevice: waiting for DEV to become free run #7: crashed: unregister_netdevice: waiting for DEV to become free run #8: crashed: unregister_netdevice: waiting for DEV to become free run #9: crashed: unregister_netdevice: waiting for DEV to become free run #10: crashed: unregister_netdevice: waiting for DEV to become free run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 766b0515d5bec4b780750773ed3009b148df8c0a 766b0515d5bec4b780750773ed3009b148df8c0a is the first bad commit commit 766b0515d5bec4b780750773ed3009b148df8c0a Author: Jakub Kicinski Date: Wed Jan 6 10:40:07 2021 -0800 net: make sure devices go through netdev_wait_all_refs If register_netdevice() fails at the very last stage - the notifier call - some subsystems may have already seen it and grabbed a reference. struct net_device can't be freed right away without calling netdev_wait_all_refs(). Now that we have a clean interface in form of dev->needs_free_netdev and lenient free_netdev() we can undo what commit 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.") has done and complete the unregistration path by bringing the net_set_todo() call back. After registration fails user is still expected to explicitly free the net_device, so make sure ->needs_free_netdev is cleared, otherwise rolling back the registration will cause the old double free for callers who release rtnl_lock before the free. This also solves the problem of priv_destructor not being called on notifier error. net_set_todo() will be moved back into unregister_netdevice_queue() in a follow up. Reported-by: Hulk Robot Reported-by: Yang Yingliang Signed-off-by: Jakub Kicinski net/core/dev.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) culprit signature: 7703079bfb2f094ff88f7888630cc4b51fdc5bcfe304b28b8aed61c6556683ff parent signature: baa7fbf4fc5f8133452ee7f3fe91f456f6117ae1b27ca1b305194a8d80c84911 Reproducer flagged being flaky revisions tested: 17, total time: 5h18m47.169696431s (build: 1h54m54.983938626s, test: 3h21m49.305765534s) first bad commit: 766b0515d5bec4b780750773ed3009b148df8c0a net: make sure devices go through netdev_wait_all_refs recipients (to): ["davem@davemloft.net" "kuba@kernel.org" "kuba@kernel.org" "netdev@vger.kernel.org"] recipients (cc): ["andriin@fb.com" "ast@kernel.org" "linux-kernel@vger.kernel.org"] crash: unregister_netdevice: waiting for DEV to become free unregister_netdevice: waiting for sit0 to become free. Usage count = -1