ci starts bisection 2023-06-10 01:38:06.737229126 +0000 UTC m=+231199.025656008 bisecting cause commit starting from e7c5433c5aaab52ddd5448967a9a5db94a3939cc building syzkaller on 7086cdb95114c57c35cee9db87b80d4225d8795d ensuring issue is reproducible on original commit e7c5433c5aaab52ddd5448967a9a5db94a3939cc testing commit e7c5433c5aaab52ddd5448967a9a5db94a3939cc gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5bf0b3446f50f7b84df1967ad48aac07d64a4133275050e648af7c3c67a1076c all runs: crashed: general protection fault in splice_to_socket testing release v6.3 testing commit 457391b0380335d5e9a5babdec90ac53928b23b4 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b07fc26d1c7f5090895bb25b97fc0b332fa4370737ebc6fa77fdf27c27b83b8c all runs: OK # git bisect start e7c5433c5aaab52ddd5448967a9a5db94a3939cc 457391b0380335d5e9a5babdec90ac53928b23b4 Bisecting: 8059 revisions left to test after this (roughly 13 steps) [cb6fe2ceb667eb78f252d473b03deb23999ab1cf] Merge tag 'devicetree-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux testing commit cb6fe2ceb667eb78f252d473b03deb23999ab1cf gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 2a3c667210a36f70e8a1053509149665b90470a6df5310c8d5deebf89b761323 all runs: OK # git bisect good cb6fe2ceb667eb78f252d473b03deb23999ab1cf Bisecting: 4031 revisions left to test after this (roughly 12 steps) [26c009dffca89b0f8fe7facc41d1ccf88a66825a] Merge tag '6.4-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 testing commit 26c009dffca89b0f8fe7facc41d1ccf88a66825a gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b67930cc657a937b580c867bf96bbd9bce19802c618dddba14d0b63b41a4b498 all runs: OK # git bisect good 26c009dffca89b0f8fe7facc41d1ccf88a66825a Bisecting: 2015 revisions left to test after this (roughly 11 steps) [cba582631ee40772c6dbe24e945b9173572dfca0] Merge tag 'tpmdd-v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd testing commit cba582631ee40772c6dbe24e945b9173572dfca0 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 17f2e01a2d3d445d2601ce256d50a021e77d936e6fc036713d6935ff036dd6ad all runs: OK # git bisect good cba582631ee40772c6dbe24e945b9173572dfca0 Bisecting: 1006 revisions left to test after this (roughly 10 steps) [9455b4b6db1e9b11d242595cc968332ecdd3cc91] Merge tag 'powerpc-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux testing commit 9455b4b6db1e9b11d242595cc968332ecdd3cc91 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 49cc648bf952b9e3e3c7fc6a404714b12befd88ef485bf481d1a1aea45a00651 all runs: OK # git bisect good 9455b4b6db1e9b11d242595cc968332ecdd3cc91 Bisecting: 503 revisions left to test after this (roughly 9 steps) [ca33db4a86023f1158dc2b3587ca3c90d2a0705e] net: phy: microchip_t1s: modify driver description to be more generic testing commit ca33db4a86023f1158dc2b3587ca3c90d2a0705e gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e1284992039d20195f99599ecf27b58eb75b2bb2615bfa98b396e49578607d61 all runs: OK # git bisect good ca33db4a86023f1158dc2b3587ca3c90d2a0705e Bisecting: 278 revisions left to test after this (roughly 8 steps) [25041a4c02c7cf774d8b6ed60586fd64f1cdaa81] Merge tag 'net-6.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 25041a4c02c7cf774d8b6ed60586fd64f1cdaa81 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c8e19f656153d557616e7d5118daf01c705a85c865a7574cceb25b3e43ba8625 all runs: OK # git bisect good 25041a4c02c7cf774d8b6ed60586fd64f1cdaa81 Bisecting: 143 revisions left to test after this (roughly 7 steps) [c422ac94e6daa3607319a08be89f133cb48aa42b] Merge branch 'drm-i915-use-ref_tracker-library-for-tracking-wakerefs' testing commit c422ac94e6daa3607319a08be89f133cb48aa42b gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8fea5564a25b62bd9bc9c3505e3696ecf8beabdc77639300e4087cade5e960a0 all runs: OK # git bisect good c422ac94e6daa3607319a08be89f133cb48aa42b Bisecting: 71 revisions left to test after this (roughly 6 steps) [fb800fa4c1f5aee1238267252e88a7837e645c02] crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES testing commit fb800fa4c1f5aee1238267252e88a7837e645c02 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 86224de7d03889fedf97ab92ec55b1c73a8f432b1fbbdead242d1391794b5ed2 all runs: OK # git bisect good fb800fa4c1f5aee1238267252e88a7837e645c02 Bisecting: 41 revisions left to test after this (roughly 5 steps) [55b24334c0f2db55ca059848121939f59133bdb6] ethtool: ioctl: improve error checking for set_wol testing commit 55b24334c0f2db55ca059848121939f59133bdb6 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 575e1e7c25e8b1ce08fe22b00256f60eb6d2d88af5918708521783d24856c677 all runs: OK # git bisect good 55b24334c0f2db55ca059848121939f59133bdb6 Bisecting: 20 revisions left to test after this (roughly 4 steps) [df720d288dbb1793e82b6ccbfc670ec871e9def4] tls/sw: Use splice_eof() to flush testing commit df720d288dbb1793e82b6ccbfc670ec871e9def4 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: ea7e0bdb77dbe6a422a82b3acd0a7c6cca07d13e8ae7413f0304e2bf62daca08 all runs: crashed: general protection fault in splice_to_socket # git bisect bad df720d288dbb1793e82b6ccbfc670ec871e9def4 Bisecting: 10 revisions left to test after this (roughly 3 steps) [f4692ab13a1f7ad2c2098b838c2820c113ce8a07] net/mlx5e: Remove RX page cache leftovers testing commit f4692ab13a1f7ad2c2098b838c2820c113ce8a07 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e0151e3c55bcf762c5456b1a0154c89862a4987f680cbe030930c710795afb2a all runs: OK # git bisect good f4692ab13a1f7ad2c2098b838c2820c113ce8a07 Bisecting: 5 revisions left to test after this (roughly 3 steps) [f84ad5cffd889226e820a727211c0d0264fe7f34] Merge tag 'mlx5-updates-2023-06-06' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux testing commit f84ad5cffd889226e820a727211c0d0264fe7f34 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5c50bdbe1d4bc48b4954ed1790442c7799850bd56cb7aaa9379bd32d81d2a906 all runs: OK # git bisect good f84ad5cffd889226e820a727211c0d0264fe7f34 Bisecting: 2 revisions left to test after this (roughly 2 steps) [81840b3b91aad06053ad2712f3da5d0448eeb0e8] tls: Allow MSG_SPLICE_PAGES but treat it as normal sendmsg testing commit 81840b3b91aad06053ad2712f3da5d0448eeb0e8 gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 822738d77bf83e1cbe53bcfc3215afd03eb2a38a7d16a7e41f6753274359b154 all runs: OK # git bisect good 81840b3b91aad06053ad2712f3da5d0448eeb0e8 Bisecting: 0 revisions left to test after this (roughly 1 step) [2bfc66850952b6921b2033b09729ec59eabbc81d] splice, net: Add a splice_eof op to file-ops and socket-ops testing commit 2bfc66850952b6921b2033b09729ec59eabbc81d gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 8f829816386869535037859a0c7e2fd62022b758103a873a899c06952b5fe2a5 all runs: crashed: general protection fault in splice_to_socket # git bisect bad 2bfc66850952b6921b2033b09729ec59eabbc81d Bisecting: 0 revisions left to test after this (roughly 0 steps) [2dc334f1a63a8839b88483a3e73c0f27c9c1791c] splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage() testing commit 2dc334f1a63a8839b88483a3e73c0f27c9c1791c gcc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: cf3d5ee9d934f9ad6705f4b04c064a7daac481adc7cce1515950ddbbe8154999 all runs: crashed: general protection fault in splice_to_socket # git bisect bad 2dc334f1a63a8839b88483a3e73c0f27c9c1791c 2dc334f1a63a8839b88483a3e73c0f27c9c1791c is the first bad commit commit 2dc334f1a63a8839b88483a3e73c0f27c9c1791c Author: David Howells Date: Wed Jun 7 19:19:09 2023 +0100 splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage() Replace generic_splice_sendpage() + splice_from_pipe + pipe_to_sendpage() with a net-specific handler, splice_to_socket(), that calls sendmsg() with MSG_SPLICE_PAGES set instead of calling ->sendpage(). MSG_MORE is used to indicate if the sendmsg() is expected to be followed with more data. This allows multiple pipe-buffer pages to be passed in a single call in a BVEC iterator, allowing the processing to be pushed down to a loop in the protocol driver. This helps pave the way for passing multipage folios down too. Protocols that haven't been converted to handle MSG_SPLICE_PAGES yet should just ignore it and do a normal sendmsg() for now - although that may be a bit slower as it may copy everything. Signed-off-by: David Howells Reviewed-by: Jakub Kicinski cc: Jens Axboe cc: Matthew Wilcox Signed-off-by: Jakub Kicinski fs/splice.c | 158 +++++++++++++++++++++++++++++++++++++++---------- include/linux/fs.h | 2 - include/linux/splice.h | 2 + net/socket.c | 26 +------- 4 files changed, 131 insertions(+), 57 deletions(-) culprit signature: cf3d5ee9d934f9ad6705f4b04c064a7daac481adc7cce1515950ddbbe8154999 parent signature: 822738d77bf83e1cbe53bcfc3215afd03eb2a38a7d16a7e41f6753274359b154 revisions tested: 17, total time: 4h54m59.876905948s (build: 2h38m5.675096846s, test: 2h14m1.7281762s) first bad commit: 2dc334f1a63a8839b88483a3e73c0f27c9c1791c splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage() recipients (to): ["dhowells@redhat.com" "kuba@kernel.org"] recipients (cc): [] crash: general protection fault in splice_to_socket general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5420 Comm: syz-executor.0 Not tainted 6.4.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:pipe_buf_release include/linux/pipe_fs_i.h:203 [inline] RIP: 0010:splice_to_socket+0x844/0xd70 fs/splice.c:933 Code: 10 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 0f 04 00 00 48 8b 46 10 48 c7 46 10 00 00 00 00 48 8d 78 08 48 89 fa 48 c1 ea 03 <42> 80 3c 32 00 0f 85 61 04 00 00 4c 89 ef 41 83 c4 01 ff 50 08 48 RSP: 0018:ffffc900045afa40 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffed10055a3aaf RCX: ffffffff81cdf42d RDX: 0000000000000001 RSI: ffff8880223ec828 RDI: 0000000000000008 RBP: 0000000000008001 R08: 0000000000000001 R09: ffff8880223ec830 R10: fffff940000ff186 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88802ad1d400 R14: dffffc0000000000 R15: 000000000000000f FS: 00007fbced1db700(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbced1ba718 CR3: 000000001d889000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_splice_from fs/splice.c:969 [inline] do_splice+0x9e1/0x1f00 fs/splice.c:1278 __do_splice+0x117/0x1f0 fs/splice.c:1356 __do_sys_splice fs/splice.c:1567 [inline] __se_sys_splice fs/splice.c:1549 [inline] __x64_sys_splice+0x14e/0x200 fs/splice.c:1549 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fbcec48c169 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fbced1db168 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 00007fbcec5abf80 RCX: 00007fbcec48c169 RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fbcec4e7ca1 R08: 0000000002000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffcc18ad2cf R14: 00007fbced1db300 R15: 0000000000022000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:pipe_buf_release include/linux/pipe_fs_i.h:203 [inline] RIP: 0010:splice_to_socket+0x844/0xd70 fs/splice.c:933 Code: 10 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 0f 04 00 00 48 8b 46 10 48 c7 46 10 00 00 00 00 48 8d 78 08 48 89 fa 48 c1 ea 03 <42> 80 3c 32 00 0f 85 61 04 00 00 4c 89 ef 41 83 c4 01 ff 50 08 48 RSP: 0018:ffffc900045afa40 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffffed10055a3aaf RCX: ffffffff81cdf42d RDX: 0000000000000001 RSI: ffff8880223ec828 RDI: 0000000000000008 RBP: 0000000000008001 R08: 0000000000000001 R09: ffff8880223ec830 R10: fffff940000ff186 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88802ad1d400 R14: dffffc0000000000 R15: 000000000000000f FS: 00007fbced1db700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005651269c6950 CR3: 000000001d889000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 10 48 89 adc %cl,-0x77(%rax) 3: f8 clc 4: 48 c1 e8 03 shr $0x3,%rax 8: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) d: 0f 85 0f 04 00 00 jne 0x422 13: 48 8b 46 10 mov 0x10(%rsi),%rax 17: 48 c7 46 10 00 00 00 movq $0x0,0x10(%rsi) 1e: 00 1f: 48 8d 78 08 lea 0x8(%rax),%rdi 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 42 80 3c 32 00 cmpb $0x0,(%rdx,%r14,1) <-- trapping instruction 2f: 0f 85 61 04 00 00 jne 0x496 35: 4c 89 ef mov %r13,%rdi 38: 41 83 c4 01 add $0x1,%r12d 3c: ff 50 08 callq *0x8(%rax) 3f: 48 rex.W