ci starts bisection 2023-01-10 06:15:10.169867068 +0000 UTC m=+408825.464602057 bisecting cause commit starting from 60ea6f00c57dae5e7ba2c52ed407cb24fdb11ebe building syzkaller on 1dac8c7a01e2bdd35cb04eb4901ddb157291ac2d ensuring issue is reproducible on original commit 60ea6f00c57dae5e7ba2c52ed407cb24fdb11ebe testing commit 60ea6f00c57dae5e7ba2c52ed407cb24fdb11ebe gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b463cd980b264655104a94371e6758a4f4efb35a1818da19ab7d5f502efdfcc7 all runs: crashed: kernel BUG in rxrpc_put_call testing release v6.1 testing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c48f1b64c572735c733402c51e2da926d34e913b37f7e4417bd83ddca4f123d2 all runs: OK # git bisect start 60ea6f00c57dae5e7ba2c52ed407cb24fdb11ebe 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 Bisecting: 7528 revisions left to test after this (roughly 13 steps) [1ca06f1c1acecbe02124f14a37cce347b8c1a90c] Merge tag 'xtensa-20221213' of https://github.com/jcmvbkbc/linux-xtensa testing commit 1ca06f1c1acecbe02124f14a37cce347b8c1a90c gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 30b39fb526765d9719cf5af325e2b9aa900619d6e2380d0d47692ef5cc93c4fd all runs: OK # git bisect good 1ca06f1c1acecbe02124f14a37cce347b8c1a90c Bisecting: 3802 revisions left to test after this (roughly 12 steps) [0948a9ef1d59d1bc7fae29f32058e463bbff4a6c] Merge branches 'acpi-resource' and 'acpi-video' testing commit 0948a9ef1d59d1bc7fae29f32058e463bbff4a6c gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 9d5cb68e353b341f26de4e77158b2554149d7080fa67d3c08cbe74a085945a93 run #0: crashed: kernel BUG in rxrpc_put_peer run #1: crashed: kernel BUG in rxrpc_put_peer run #2: crashed: kernel BUG in rxrpc_put_peer run #3: crashed: kernel BUG in rxrpc_put_peer run #4: crashed: kernel BUG in rxrpc_put_peer run #5: crashed: INFO: task hung in rxrpc_destroy_all_calls run #6: crashed: INFO: task hung in rxrpc_destroy_all_calls run #7: crashed: INFO: task hung in rxrpc_destroy_all_calls run #8: crashed: INFO: task hung in rxrpc_destroy_all_calls run #9: crashed: INFO: task hung in rxrpc_destroy_all_calls # git bisect bad 0948a9ef1d59d1bc7fae29f32058e463bbff4a6c Bisecting: 1843 revisions left to test after this (roughly 11 steps) [dd8b3a802b64adf059a49a68f1bdca7846e492fc] Merge tag 'ipsec-next-2022-12-09' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next testing commit dd8b3a802b64adf059a49a68f1bdca7846e492fc gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 96ab6f5b9da151a5d54be15a85cca68f1b85245c2339d3485993e4b07b2388d1 run #0: crashed: kernel BUG in rxrpc_put_peer run #1: crashed: kernel BUG in rxrpc_put_peer run #2: crashed: INFO: task hung in rxrpc_destroy_all_calls run #3: crashed: INFO: task hung in rxrpc_destroy_all_calls run #4: crashed: INFO: task hung in rxrpc_destroy_all_calls run #5: crashed: INFO: task hung in rxrpc_destroy_all_calls run #6: crashed: INFO: task hung in rxrpc_destroy_all_calls run #7: crashed: INFO: task hung in rxrpc_destroy_all_calls run #8: crashed: INFO: task hung in rxrpc_destroy_all_calls run #9: crashed: INFO: task hung in rxrpc_destroy_all_calls # git bisect bad dd8b3a802b64adf059a49a68f1bdca7846e492fc Bisecting: 940 revisions left to test after this (roughly 10 steps) [50f8f2f7fbf2f237a7938890f46c3edce0f51501] sfc: implement counters readout to TC stats testing commit 50f8f2f7fbf2f237a7938890f46c3edce0f51501 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8c09751a91af224dac737a2a367f8251672a08f88038fb8026ec683eda040547 all runs: OK # git bisect good 50f8f2f7fbf2f237a7938890f46c3edce0f51501 Bisecting: 467 revisions left to test after this (roughly 9 steps) [5cb0c51fe366cf96b7911d25db3e678401732246] Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next testing commit 5cb0c51fe366cf96b7911d25db3e678401732246 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: d6f51c4988601c752b1377eeac42d877f645896df19089b3e0ef077eb3ea925a all runs: OK # git bisect good 5cb0c51fe366cf96b7911d25db3e678401732246 Bisecting: 223 revisions left to test after this (roughly 8 steps) [edd4e25a230dc8a977fca667db788424917ca2f3] Merge tag 'wireless-next-2022-12-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next testing commit edd4e25a230dc8a977fca667db788424917ca2f3 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 780cee04afe0949edca135609b335b9e5a1ad9c14809f13d3720db9a65a3d98d all runs: OK # git bisect good edd4e25a230dc8a977fca667db788424917ca2f3 Bisecting: 111 revisions left to test after this (roughly 7 steps) [6b1ff5d392283b737abc038f7ab1509d9b8311c7] ice: always call ice_ptp_link_change and make it void testing commit 6b1ff5d392283b737abc038f7ab1509d9b8311c7 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e774b5ef519f127a80de4e2d4c6404ad025b8a613b33d2852e7ba571605252f6 all runs: crashed: INFO: task hung in rxrpc_destroy_all_calls # git bisect bad 6b1ff5d392283b737abc038f7ab1509d9b8311c7 Bisecting: 55 revisions left to test after this (roughly 6 steps) [15309fb26b87767b4c8b017a628424e3c3b2f69e] net: sfp: clean up i2c-bus property parsing testing commit 15309fb26b87767b4c8b017a628424e3c3b2f69e gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 35572446295b98cc7a6d81e4419731c3f79382cde351f4d289893d80ee47a027 run #0: crashed: KASAN: use-after-free Read in rxrpc_lookup_local run #1: crashed: kernel BUG in rxrpc_put_peer run #2: crashed: kernel BUG in rxrpc_put_peer run #3: crashed: kernel BUG in rxrpc_put_peer run #4: crashed: INFO: task hung in rxrpc_destroy_all_calls run #5: crashed: INFO: task hung in rxrpc_destroy_all_calls run #6: crashed: INFO: task hung in rxrpc_destroy_all_calls run #7: crashed: INFO: task hung in rxrpc_destroy_all_calls run #8: crashed: INFO: task hung in rxrpc_destroy_all_calls run #9: crashed: INFO: task hung in rxrpc_destroy_all_calls # git bisect bad 15309fb26b87767b4c8b017a628424e3c3b2f69e Bisecting: 27 revisions left to test after this (roughly 5 steps) [2d1faf7a0ca3c0b327cf064c80e4e775532c9319] rxrpc: Simplify skbuff accounting in receive path testing commit 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 3e6905eb15efb4b3d1b121bdcbc3d29ca36b44e9f0aba7a21750320d2048cc82 all runs: crashed: INFO: task hung in rxrpc_destroy_all_calls # git bisect bad 2d1faf7a0ca3c0b327cf064c80e4e775532c9319 Bisecting: 13 revisions left to test after this (roughly 4 steps) [fa3492abb64b93b2b5d6fdf7a5b687a1fa810d74] rxrpc: Trace rxrpc_bundle refcount testing commit fa3492abb64b93b2b5d6fdf7a5b687a1fa810d74 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 94f7208633bda3dbd8fef469ea7f72845974a5852a71171e1edee16b17add57c all runs: OK # git bisect good fa3492abb64b93b2b5d6fdf7a5b687a1fa810d74 Bisecting: 6 revisions left to test after this (roughly 3 steps) [ff7348254e704b6d0121970e311a6b699268e1ac] rxrpc: Move error processing into the local endpoint I/O thread testing commit ff7348254e704b6d0121970e311a6b699268e1ac gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 30db82b3524630b8ca7d9cc0bd64eeeda8136da9b0ede19b776227dcedeb5ca6 all runs: crashed: WARNING in cleanup_net # git bisect bad ff7348254e704b6d0121970e311a6b699268e1ac Bisecting: 3 revisions left to test after this (roughly 2 steps) [3cec055c56958c5498eeb3ed9fb2aef2d28c030f] rxrpc: Don't hold a ref for connection workqueue testing commit 3cec055c56958c5498eeb3ed9fb2aef2d28c030f gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b259bbc9a2a7e2f2d81bde3cf8af0aa21a0c91cca9d75b584124ec885bc30771 all runs: OK # git bisect good 3cec055c56958c5498eeb3ed9fb2aef2d28c030f Bisecting: 1 revision left to test after this (roughly 1 step) [a275da62e8c111b897b9cb73eb91df2f4e475ca5] rxrpc: Create a per-local endpoint receive queue and I/O thread testing commit a275da62e8c111b897b9cb73eb91df2f4e475ca5 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 84ddbba051e74d0c356a6f9e525189d1d4937f8d7fce713ebf103c1197191bb1 all runs: crashed: WARNING in cleanup_net # git bisect bad a275da62e8c111b897b9cb73eb91df2f4e475ca5 Bisecting: 0 revisions left to test after this (roughly 0 steps) [96b2d69b43a075a38df600597133f17d28525f24] rxrpc: Split the receive code testing commit 96b2d69b43a075a38df600597133f17d28525f24 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e8728e1c14a3d6fbe6d4604decb40f99ee0f05277db1a9b62d4cac9a1ce5e1bd all runs: OK # git bisect good 96b2d69b43a075a38df600597133f17d28525f24 a275da62e8c111b897b9cb73eb91df2f4e475ca5 is the first bad commit commit a275da62e8c111b897b9cb73eb91df2f4e475ca5 Author: David Howells Date: Mon Oct 10 08:45:20 2022 +0100 rxrpc: Create a per-local endpoint receive queue and I/O thread Create a per-local receive queue to which, in a future patch, all incoming packets will be directed and an I/O thread that will process those packets and perform all transmission of packets. Destruction of the local endpoint is also moved from the local processor work item (which will be absorbed) to the thread. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org net/rxrpc/ar-internal.h | 10 ++++++++++ net/rxrpc/io_thread.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++- net/rxrpc/local_object.c | 39 ++++++++++++++++++++---------------- net/rxrpc/proc.c | 12 +++++++++--- 4 files changed, 91 insertions(+), 21 deletions(-) culprit signature: 84ddbba051e74d0c356a6f9e525189d1d4937f8d7fce713ebf103c1197191bb1 parent signature: e8728e1c14a3d6fbe6d4604decb40f99ee0f05277db1a9b62d4cac9a1ce5e1bd revisions tested: 16, total time: 5h28m58.913033745s (build: 2h36m22.811160287s, test: 2h49m51.22738246s) first bad commit: a275da62e8c111b897b9cb73eb91df2f4e475ca5 rxrpc: Create a per-local endpoint receive queue and I/O thread recipients (to): ["davem@davemloft.net" "dhowells@redhat.com" "edumazet@google.com" "kuba@kernel.org" "netdev@vger.kernel.org" "pabeni@redhat.com"] recipients (cc): ["dhowells@redhat.com" "linux-afs@lists.infradead.org" "linux-kernel@vger.kernel.org" "marc.dionne@auristor.com"] crash: WARNING in cleanup_net ____sys_sendmsg+0x5f7/0x8a0 net/socket.c:2476 ___sys_sendmsg+0xdb/0x160 net/socket.c:2530 __sys_sendmsg+0xc7/0x160 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at lib/ref_tracker.c:39 spin_unlock_irqrestore include/linux/spinlock.h:405 [inline] WARNING: CPU: 0 PID: 11 at lib/ref_tracker.c:39 ref_tracker_dir_exit.cold+0x163/0x1b4 lib/ref_tracker.c:38 Modules linked in: CPU: 0 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: netns cleanup_net RIP: 0010:ref_tracker_dir_exit.cold+0x163/0x1b4 lib/ref_tracker.c:39 Code: c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 0d c4 d3 f8 4d 39 e6 49 8b 04 24 4d 89 e7 75 3f 48 8b 74 24 08 48 89 ef e8 24 85 35 00 <0f> 0b e9 7d 5c f1 fa 4c 89 ff e8 e5 c3 d3 f8 e9 a3 fe ff ff e8 bb RSP: 0018:ffffc90000107c08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff896b7be0 RDI: 0000000000000001 RBP: ffff8880737381c0 R08: 0000000000000001 R09: ffffffff901d9b4f R10: 0000000000000001 R11: 0000000000084080 R12: ffff888073738210 R13: ffff888073738210 R14: ffff888073738210 R15: ffff888073738210 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055eef8850950 CR3: 00000000782e2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: net_free net/core/net_namespace.c:442 [inline] net_free net/core/net_namespace.c:436 [inline] cleanup_net+0x6fd/0x990 net/core/net_namespace.c:627 process_one_work+0x8ba/0x14c0 kernel/workqueue.c:2289 worker_thread+0x59c/0xec0 kernel/workqueue.c:2436 kthread+0x298/0x340 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306