ci2 starts bisection 2024-03-02 03:59:39.688941185 +0000 UTC m=+7102.241828785 bisecting fixing commit since 48c6c901fe0e68e176029738d829e0d01eabb0b2 building syzkaller on d80eec66c939240cfc674221138f637197659116 ensuring issue is reproducible on original commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 158b42e42e909387333cb0bf20d59a2d45da9a42f79cb8c9178ae9a3e5dde51f run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #10: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #11: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #12: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #13: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #14: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #15: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #16: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #17: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #18: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #19: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] check whether we can drop unnecessary instrumentation disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: da016c08dc49e04a483242f6f58d50c93e161f295d196bb9f2c98d99b99ec208 run #0: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in __skb_datagram_iter, types: [KASAN] the bug reproduces without the instrumentation disabling configs for [LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG], they are not needed kconfig minimization: base=5179 full=6485 leaves diff=250 split chunks (needed=false): <250> split chunk #0 of len 250 into 5 parts testing without sub-chunk 1/5 disabling configs for [BUG LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 69bab686a47a3f9742055c86541c111bdfd1e28057ce40ecbd3ce53b7eaccc95 run #0: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #8: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in __skb_datagram_iter, types: [KASAN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 82f9f7ccb3e1b5dc46365a09b0acd2036daf930c11f39e056f05ed678eab436a run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 7e2b3efbc9fc132319550c87387bb0bfbead1322557e8647bf2f1238c85246cf run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ceb4e1058445dd73cba6c738cee6e329b18054e58d382f39152a18bdb3bc2957 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [UBSAN BUG LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 48c6c901fe0e68e176029738d829e0d01eabb0b2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 failed building 48c6c901fe0e68e176029738d829e0d01eabb0b2: net/socket.c:1225: undefined reference to `wext_handle_ioctl' net/socket.c:3420: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:329: undefined reference to `wext_proc_init' net/core/net-procfs.c:345: undefined reference to `wext_proc_exit' minimized to 50 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF] disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing current HEAD 09ca5740fbbe445af407b1db7ceb5c53c191fe74 testing commit 09ca5740fbbe445af407b1db7ceb5c53c191fe74 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e6906121a1b4c149e430f0b014df48da87e187dc09d2125a17963129211f4c44 all runs: OK false negative chance: 0.000 # git bisect start 09ca5740fbbe445af407b1db7ceb5c53c191fe74 48c6c901fe0e68e176029738d829e0d01eabb0b2 Bisecting: 2069 revisions left to test after this (roughly 11 steps) [342f321af8333a5496ae47dc66f25a34f79bfa37] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning determine whether the revision contains the guilty commit checking the merge base 52a953d0934b17a88f403b4135eb3cdf83d19f91 no existing result, test the revision testing commit 52a953d0934b17a88f403b4135eb3cdf83d19f91 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cf72f00f5f7a2907bd42bbe145ec03f66936d65202bac4183661de560778dcd0 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] testing commit 342f321af8333a5496ae47dc66f25a34f79bfa37 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1a2146ed427d4e49f3a8419ac755b7cabb54548e52fe7ae45be4d0e766180cf1 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 342f321af8333a5496ae47dc66f25a34f79bfa37 Bisecting: 1034 revisions left to test after this (roughly 10 steps) [e5b0e2308088fa38a2afd68cc5a20eb989a6fc3f] tty: serial: meson: fix hard LOCKUP on crtscts mode determine whether the revision contains the guilty commit revision 342f321af8333a5496ae47dc66f25a34f79bfa37 crashed and is reachable testing commit e5b0e2308088fa38a2afd68cc5a20eb989a6fc3f gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 03ae5ad1b575b59a97a8a839de5f9000c3f1c2272a883bd05140f68ccf2c03c5 all runs: OK false negative chance: 0.000 # git bisect bad e5b0e2308088fa38a2afd68cc5a20eb989a6fc3f Bisecting: 517 revisions left to test after this (roughly 9 steps) [52ec0669f457fd4c4b597bb9b0e1a4c4f18a45ab] tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 52ec0669f457fd4c4b597bb9b0e1a4c4f18a45ab gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c18e8f09269fb8056f1c7a46ed7ae32af390b11679af995cb0247333f2b407f3 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #3: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 52ec0669f457fd4c4b597bb9b0e1a4c4f18a45ab Bisecting: 258 revisions left to test after this (roughly 8 steps) [a5b03f56d38d8e353d75803fa9bf04cdd15e5204] crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit a5b03f56d38d8e353d75803fa9bf04cdd15e5204 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 504195d40d62667922dcb010efd5c3448f312771b69dc3146f21f720bb9019cc run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good a5b03f56d38d8e353d75803fa9bf04cdd15e5204 Bisecting: 129 revisions left to test after this (roughly 7 steps) [33fb1a555354bd593f785935ddcb5d9dd4d3847f] drm/amdgpu/vkms: fix a possible null pointer dereference determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 33fb1a555354bd593f785935ddcb5d9dd4d3847f gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 5a2547ca405cffe0e6f9fc6a2a9dd4b90f3f03fca090ed6b4615be865df58e47 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #8: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 33fb1a555354bd593f785935ddcb5d9dd4d3847f Bisecting: 64 revisions left to test after this (roughly 6 steps) [3a6ad749e9ef5f40de344f3e750a9b73397375b7] wifi: iwlwifi: Use FW rate for non-data frames determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 3a6ad749e9ef5f40de344f3e750a9b73397375b7 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: bc0ae03a27049081f2439889e25e94dbe2eb9545e54922d57efa13e5b391adb6 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 3a6ad749e9ef5f40de344f3e750a9b73397375b7 Bisecting: 32 revisions left to test after this (roughly 5 steps) [18a169810cff769a7a697b35058c756805f589e0] netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 18a169810cff769a7a697b35058c756805f589e0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 937893428d6b83b4ab75931cf366de287be930f67a548f2de77041ded1d02c31 all runs: OK false negative chance: 0.000 # git bisect bad 18a169810cff769a7a697b35058c756805f589e0 Bisecting: 15 revisions left to test after this (roughly 4 steps) [83a177b942fa014c322143a5ddcb86d19eb3d475] net: hns3: fix incorrect capability bit display for copper port determine whether the revision contains the guilty commit revision 3a6ad749e9ef5f40de344f3e750a9b73397375b7 crashed and is reachable testing commit 83a177b942fa014c322143a5ddcb86d19eb3d475 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d0eed8afc8b5cc79c3e15056ec165cda68bf1f3b06c07d3b036ff2652ab7d6ac run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #7: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in __skb_datagram_iter representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 83a177b942fa014c322143a5ddcb86d19eb3d475 Bisecting: 7 revisions left to test after this (roughly 3 steps) [ceae93d76a51855aafa85b02e05f02a0f3eacc66] xen/events: fix delayed eoi list handling determine whether the revision contains the guilty commit revision 3a6ad749e9ef5f40de344f3e750a9b73397375b7 crashed and is reachable testing commit ceae93d76a51855aafa85b02e05f02a0f3eacc66 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 61388622b39eb8ba181feafa1a44894671763d4038b5518eb461276d03d96427 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #6: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #7: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #8: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good ceae93d76a51855aafa85b02e05f02a0f3eacc66 Bisecting: 3 revisions left to test after this (roughly 2 steps) [1a1efaed5fc2d3def0b6dfcea4e17609730415e3] net: ethernet: cortina: Handle large frames determine whether the revision contains the guilty commit revision 3a6ad749e9ef5f40de344f3e750a9b73397375b7 crashed and is reachable testing commit 1a1efaed5fc2d3def0b6dfcea4e17609730415e3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9529dee9fadfbab8cd55a9edc0493fec3a2d85639c9f93bd2c14616202be356a run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #5: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #6: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 1a1efaed5fc2d3def0b6dfcea4e17609730415e3 Bisecting: 1 revision left to test after this (roughly 1 step) [d179189eec426fe4801e4b91efa1889faed12700] af_unix: fix use-after-free in unix_stream_read_actor() determine whether the revision contains the guilty commit revision 83a177b942fa014c322143a5ddcb86d19eb3d475 crashed and is reachable testing commit d179189eec426fe4801e4b91efa1889faed12700 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 987326236fd17ff927049837831686ad18a48f082bc22fde5a674b7175be46cb all runs: OK false negative chance: 0.000 # git bisect bad d179189eec426fe4801e4b91efa1889faed12700 Bisecting: 0 revisions left to test after this (roughly 0 steps) [14b11892a6da85b8440ea5cc5ac4ed37b99a43a6] net: ethernet: cortina: Fix MTU max setting determine whether the revision contains the guilty commit revision 3a6ad749e9ef5f40de344f3e750a9b73397375b7 crashed and is reachable testing commit 14b11892a6da85b8440ea5cc5ac4ed37b99a43a6 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c7f8a268b26fab48391c644bf2a5fba9cfb70b1ee6dc9fa0f9d6bcef055323d0 run #0: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #1: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #2: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #3: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #4: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #5: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #6: crashed: KASAN: use-after-free Read in __skb_datagram_iter run #7: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #8: crashed: KASAN: use-after-free Read in unix_stream_read_actor run #9: crashed: KASAN: use-after-free Read in unix_stream_read_actor representative crash: KASAN: use-after-free Read in unix_stream_read_actor, types: [KASAN] # git bisect good 14b11892a6da85b8440ea5cc5ac4ed37b99a43a6 d179189eec426fe4801e4b91efa1889faed12700 is the first bad commit commit d179189eec426fe4801e4b91efa1889faed12700 Author: Eric Dumazet Date: Mon Nov 13 13:49:38 2023 +0000 af_unix: fix use-after-free in unix_stream_read_actor() [ Upstream commit 4b7b492615cf3017190f55444f7016812b66611d ] syzbot reported the following crash [1] After releasing unix socket lock, u->oob_skb can be changed by another thread. We must temporarily increase skb refcount to make sure this other thread will not free the skb under us. [1] BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 Read of size 4 at addr ffff88801f3b9cc4 by task syz-executor107/5297 CPU: 1 PID: 5297 Comm: syz-executor107 Not tainted 6.6.0-syzkaller-15910-gb8e3a87a627b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 unix_stream_recv_urg net/unix/af_unix.c:2587 [inline] unix_stream_read_generic+0x19a5/0x2480 net/unix/af_unix.c:2666 unix_stream_recvmsg+0x189/0x1b0 net/unix/af_unix.c:2903 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x170 net/socket.c:1066 ____sys_recvmsg+0x21f/0x5c0 net/socket.c:2803 ___sys_recvmsg+0x115/0x1a0 net/socket.c:2845 __sys_recvmsg+0x114/0x1e0 net/socket.c:2875 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fc67492c559 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6748ab228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007fc67492c559 RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 00007fc6749b6348 R08: 00007fc6748ab6c0 R09: 00007fc6748ab6c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc6749b6340 R13: 00007fc6749b634c R14: 00007ffe9fac52a0 R15: 00007ffe9fac5388 Allocated by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x180/0x3c0 mm/slub.c:3523 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] queue_oob net/unix/af_unix.c:2147 [inline] unix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1800 [inline] slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 slab_free mm/slub.c:3809 [inline] kmem_cache_free+0xf8/0x340 mm/slub.c:3831 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:1015 __kfree_skb net/core/skbuff.c:1073 [inline] consume_skb net/core/skbuff.c:1288 [inline] consume_skb+0xdf/0x170 net/core/skbuff.c:1282 queue_oob net/unix/af_unix.c:2178 [inline] unix_stream_sendmsg+0xd49/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88801f3b9c80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 68 bytes inside of freed 240-byte region [ffff88801f3b9c80, ffff88801f3b9d70) The buggy address belongs to the physical page: page:ffffea00007cee40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f3b9 flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888142a60640 dead000000000122 0000000000000000 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5299, tgid 5283 (syz-executor107), ts 103803840339, free_ts 103600093431 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1544 [inline] get_page_from_freelist+0xa25/0x36c0 mm/page_alloc.c:3312 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4568 alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133 alloc_slab_page mm/slub.c:1870 [inline] allocate_slab+0x251/0x380 mm/slub.c:2017 new_slab mm/slub.c:2070 [inline] ___slab_alloc+0x8c7/0x1580 mm/slub.c:3223 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322 __slab_alloc_node mm/slub.c:3375 [inline] slab_alloc_node mm/slub.c:3468 [inline] kmem_cache_alloc_node+0x132/0x3c0 mm/slub.c:3523 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] queue_oob net/unix/af_unix.c:2147 [inline] unix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1137 [inline] free_unref_page_prepare+0x4f8/0xa90 mm/page_alloc.c:2347 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2487 __unfreeze_partials+0x21d/0x240 mm/slub.c:2655 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] slab_alloc mm/slub.c:3486 [inline] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] kmem_cache_alloc+0x15d/0x380 mm/slub.c:3502 vm_area_dup+0x21/0x2f0 kernel/fork.c:500 __split_vma+0x17d/0x1070 mm/mmap.c:2365 split_vma mm/mmap.c:2437 [inline] vma_modify+0x25d/0x450 mm/mmap.c:2472 vma_modify_flags include/linux/mm.h:3271 [inline] mprotect_fixup+0x228/0xc80 mm/mprotect.c:635 do_mprotect_pkey+0x852/0xd60 mm/mprotect.c:809 __do_sys_mprotect mm/mprotect.c:830 [inline] __se_sys_mprotect mm/mprotect.c:827 [inline] __x64_sys_mprotect+0x78/0xb0 mm/mprotect.c:827 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Memory state around the buggy address: ffff88801f3b9b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801f3b9c00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88801f3b9c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801f3b9d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff88801f3b9d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb Fixes: 876c14ad014d ("af_unix: fix holding spinlock in oob handling") Reported-and-tested-by: syzbot+7a2d546fa43e49315ed3@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Rao Shoaib Reviewed-by: Rao shoaib Link: https://lore.kernel.org/r/20231113134938.168151-1-edumazet@google.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin net/unix/af_unix.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) accumulated error probability: 0.00 culprit signature: 987326236fd17ff927049837831686ad18a48f082bc22fde5a674b7175be46cb parent signature: c7f8a268b26fab48391c644bf2a5fba9cfb70b1ee6dc9fa0f9d6bcef055323d0 revisions tested: 20, total time: 3h15m39.677206367s (build: 1h6m18.832190239s, test: 2h2m5.513157027s) first good commit: d179189eec426fe4801e4b91efa1889faed12700 af_unix: fix use-after-free in unix_stream_read_actor() recipients (to): ["edumazet@google.com" "pabeni@redhat.com" "rao.shoaib@oracle.com" "sashal@kernel.org" "syzbot+7a2d546fa43e49315ed3@syzkaller.appspotmail.com"] recipients (cc): []