bisecting cause commit starting from d012a7190fc1fd72ed48911e77ca97ba4521bccd building syzkaller on 67b599d167ab42fff545ec53e23f2711c184877b testing commit d012a7190fc1fd72ed48911e77ca97ba4521bccd with gcc (GCC) 8.1.0 kernel signature: 9c8029c57c01baf8cc9afc572337a75194e02d5ce86d4df5ff0c267eb92329b6 run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in get_signal run #7: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: ba91f8d7c2020183a924cbaa3e3813a95e930bc58c54befec68939863fc54371 all runs: OK # git bisect start d012a7190fc1fd72ed48911e77ca97ba4521bccd bcf876870b95592b52519ed4aafcf9d95999bc9c Bisecting: 8152 revisions left to test after this (roughly 13 steps) [8186749621ed6b8fc42644c399e8c755a2b6f630] Merge tag 'drm-next-2020-08-06' of git://anongit.freedesktop.org/drm/drm testing commit 8186749621ed6b8fc42644c399e8c755a2b6f630 with gcc (GCC) 8.1.0 kernel signature: cb7bb575873429af3f751dee7d4756625f58ea6aaaee838f6654c8f9dba6d921 all runs: OK # git bisect good 8186749621ed6b8fc42644c399e8c755a2b6f630 Bisecting: 4052 revisions left to test after this (roughly 12 steps) [dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee] Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi testing commit dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee with gcc (GCC) 8.1.0 kernel signature: 188897efa8e78e09357770967d31e068542aea2e011b88f128a490dc6f6847b6 all runs: OK # git bisect good dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee Bisecting: 2039 revisions left to test after this (roughly 11 steps) [8c2618a6d0f7b08e2b41575a87cf568745c8860e] Merge tag 'gfs2-for-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 testing commit 8c2618a6d0f7b08e2b41575a87cf568745c8860e with gcc (GCC) 8.1.0 kernel signature: 56ec64eff3adde1440612d8c1dade456aef4d1db1857d788c5492bbb89840697 all runs: OK # git bisect good 8c2618a6d0f7b08e2b41575a87cf568745c8860e Bisecting: 1023 revisions left to test after this (roughly 10 steps) [7a02c8d45bbf65cf432292c2032147fa7529de58] Merge branch 'parisc-5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux testing commit 7a02c8d45bbf65cf432292c2032147fa7529de58 with gcc (GCC) 8.1.0 kernel signature: 3e4414ad8df1f257cf830eb3766b55b8908cf54fdcb039e431ca2e0a0cac39d3 all runs: boot failed: WARNING in mem_cgroup_css_alloc # git bisect skip 7a02c8d45bbf65cf432292c2032147fa7529de58 Bisecting: 1023 revisions left to test after this (roughly 10 steps) [f254ac04c8744cf7bfed012717eac34eacc65dfb] io_uring: enable lookup of links holding inflight files testing commit f254ac04c8744cf7bfed012717eac34eacc65dfb with gcc (GCC) 8.1.0 kernel signature: 0b9a30434b085ee54e625f453a507b71ad2a2792e43a35685da4b1a9b966b93d all runs: OK # git bisect good f254ac04c8744cf7bfed012717eac34eacc65dfb Bisecting: 1010 revisions left to test after this (roughly 10 steps) [6c357848b44b4016ca422178aa368a7472245f6f] mm: replace hpage_nr_pages with thp_nr_pages testing commit 6c357848b44b4016ca422178aa368a7472245f6f with gcc (GCC) 8.1.0 kernel signature: 3d5cc777f3f0d1fc0cf760754afeff39e0905d993e69a1aaa3cc2b000195fbec all runs: OK # git bisect good 6c357848b44b4016ca422178aa368a7472245f6f Bisecting: 379 revisions left to test after this (roughly 9 steps) [0790e63f58f22a68696667102be03efb92a4da5f] Merge tag 'drm-intel-fixes-2020-08-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes testing commit 0790e63f58f22a68696667102be03efb92a4da5f with gcc (GCC) 8.1.0 kernel signature: 62fcda5712eea51ea6d4b505bb174e7f2c86718b294da11202d82911e49d02c7 all runs: OK # git bisect good 0790e63f58f22a68696667102be03efb92a4da5f Bisecting: 185 revisions left to test after this (roughly 8 steps) [d723b99ec9e502a414a96a51ec229333f807b47e] Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 testing commit d723b99ec9e502a414a96a51ec229333f807b47e with gcc (GCC) 8.1.0 kernel signature: fd4b28d260bf8ff9f6cdc39adb9045e0a0dbb07bc6cef0c2ca1edb4b85cea8d8 all runs: OK # git bisect good d723b99ec9e502a414a96a51ec229333f807b47e Bisecting: 88 revisions left to test after this (roughly 7 steps) [c3d8f220d01220a5b253e422be407d068dc65511] Merge tag 'kbuild-fixes-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild testing commit c3d8f220d01220a5b253e422be407d068dc65511 with gcc (GCC) 8.1.0 kernel signature: 0655ba19d3f7fabece4ecfda928b5194734ed773737650a6ce4ed37f46a00cff all runs: OK # git bisect good c3d8f220d01220a5b253e422be407d068dc65511 Bisecting: 49 revisions left to test after this (roughly 6 steps) [774d977abfd024e6f73484544b9abe5a5cd62de7] net: dsa: b53: check for timeout testing commit 774d977abfd024e6f73484544b9abe5a5cd62de7 with gcc (GCC) 8.1.0 kernel signature: b59365e9013d76a99e20952090dc6d24e366d9435fdaee4bf8f79235698b3cbe all runs: OK # git bisect good 774d977abfd024e6f73484544b9abe5a5cd62de7 Bisecting: 20 revisions left to test after this (roughly 5 steps) [10c091b62e7fc3133d652b7212904348398b302e] Merge tag 'efi-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 10c091b62e7fc3133d652b7212904348398b302e with gcc (GCC) 8.1.0 kernel signature: 289f5b942f20be070126051132cc82661eb92eacf50a0b8bd808938a23dd9e1c run #0: crashed: kernel BUG at fs/inode.c:LINE! run #1: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: kernel BUG at fs/inode.c:LINE! run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in __sock_release run #8: crashed: kernel BUG at fs/inode.c:LINE! run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad 10c091b62e7fc3133d652b7212904348398b302e Bisecting: 15 revisions left to test after this (roughly 4 steps) [eeaac3634ee0e3f35548be35275efeca888e9b23] net: nexthop: don't allow empty NHA_GROUP testing commit eeaac3634ee0e3f35548be35275efeca888e9b23 with gcc (GCC) 8.1.0 kernel signature: e45a4750cfa288f03f5bbed82fc505cfd637ae591d64859fd3311b31cd209f4f all runs: OK # git bisect good eeaac3634ee0e3f35548be35275efeca888e9b23 Bisecting: 7 revisions left to test after this (roughly 3 steps) [e99b2507baccca79394ec646e3d1a0884667ea98] Merge tag 'core-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e99b2507baccca79394ec646e3d1a0884667ea98 with gcc (GCC) 8.1.0 kernel signature: 12db0dcb63fe26bbb518bbbfc808e007c464f763439ab9d6be31558af1d97464 run #0: crashed: kernel BUG at fs/inode.c:LINE! run #1: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: kernel BUG at fs/inode.c:LINE! run #4: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: kernel BUG at fs/inode.c:LINE! run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in get_signal # git bisect bad e99b2507baccca79394ec646e3d1a0884667ea98 Bisecting: 3 revisions left to test after this (roughly 2 steps) [9d045ed1ebe1a6115d3fa9930c5371defb31d95a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 9d045ed1ebe1a6115d3fa9930c5371defb31d95a with gcc (GCC) 8.1.0 kernel signature: cc1a7add5f0cde30805d15cd77a0d7d29620a2ebd382322e120cd2df4bcae64a run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: kernel BUG at fs/inode.c:LINE! run #3: crashed: kernel BUG at fs/inode.c:LINE! run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: kernel BUG at fs/inode.c:LINE! run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #8: crashed: kernel BUG at fs/inode.c:LINE! run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad 9d045ed1ebe1a6115d3fa9930c5371defb31d95a Bisecting: 1 revision left to test after this (roughly 1 step) [52c479697c9b73f628140dcdfcd39ea302d05482] do_epoll_ctl(): clean the failure exits up a bit testing commit 52c479697c9b73f628140dcdfcd39ea302d05482 with gcc (GCC) 8.1.0 kernel signature: fa441b4feb69d8b870f33ea2dfccee61555e0d94e3b32dad1bb2255b152074b9 run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: WARNING: ODEBUG bug in get_signal run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: kernel BUG at fs/inode.c:LINE! run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: kernel BUG at fs/inode.c:LINE! # git bisect bad 52c479697c9b73f628140dcdfcd39ea302d05482 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a9ed4a6560b8562b7e2e2bed9527e88001f7b682] epoll: Keep a reference on files added to the check list testing commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 with gcc (GCC) 8.1.0 kernel signature: 540b4e8aae3d3a53911d51fc7d39aecc3c0e51be00b3e9c0fb76cdc7d2b19a29 run #0: crashed: kernel BUG at fs/inode.c:LINE! run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: kernel BUG at fs/inode.c:LINE! run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: kernel BUG at fs/inode.c:LINE! run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad a9ed4a6560b8562b7e2e2bed9527e88001f7b682 a9ed4a6560b8562b7e2e2bed9527e88001f7b682 is the first bad commit commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 Author: Marc Zyngier Date: Wed Aug 19 17:12:17 2020 +0100 epoll: Keep a reference on files added to the check list When adding a new fd to an epoll, and that this new fd is an epoll fd itself, we recursively scan the fds attached to it to detect cycles, and add non-epool files to a "check list" that gets subsequently parsed. However, this check list isn't completely safe when deletions can happen concurrently. To sidestep the issue, make sure that a struct file placed on the check list sees its f_count increased, ensuring that a concurrent deletion won't result in the file disapearing from under our feet. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Signed-off-by: Al Viro fs/eventpoll.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) parent commit 9123e3a74ec7b934a4a099e98af6a61c2f80bbf5 wasn't tested testing commit 9123e3a74ec7b934a4a099e98af6a61c2f80bbf5 with gcc (GCC) 8.1.0 kernel signature: bbc4e3c7c1b712624359f7556ee809e3f183a537faeb29aabbbffb52c857875e culprit signature: 540b4e8aae3d3a53911d51fc7d39aecc3c0e51be00b3e9c0fb76cdc7d2b19a29 parent signature: bbc4e3c7c1b712624359f7556ee809e3f183a537faeb29aabbbffb52c857875e revisions tested: 18, total time: 4h14m2.164541165s (build: 1h29m51.524396259s, test: 2h42m26.625124991s) first bad commit: a9ed4a6560b8562b7e2e2bed9527e88001f7b682 epoll: Keep a reference on files added to the check list recipients (to): ["linux-kernel@vger.kernel.org" "maz@kernel.org" "viro@zeniv.linux.org.uk"] recipients (cc): ["linux-fsdevel@vger.kernel.org" "viro@zeniv.linux.org.uk"] crash: WARNING: ODEBUG bug in exit_to_user_mode_prepare ------------[ cut here ]------------ ODEBUG: free active (active state 1) object type: rcu_head hint: 0x0 WARNING: CPU: 0 PID: 2436 at lib/debugobjects.c:488 debug_print_object+0x67/0x80 lib/debugobjects.c:485 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 2436 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xb3/0xec lib/dump_stack.c:118 panic+0x115/0x2fa kernel/panic.c:231 __warn.cold.13+0x20/0x25 kernel/panic.c:600 report_bug+0xc0/0xf0 lib/bug.c:198 handle_bug+0x35/0x90 arch/x86/kernel/traps.c:234 exc_invalid_op+0x13/0x60 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:debug_print_object+0x67/0x80 lib/debugobjects.c:485 Code: 8b 43 10 83 c2 01 4c 89 e6 48 c7 c7 20 55 f1 83 89 15 11 dc 21 04 8b 4b 14 4c 8b 45 00 48 8b 14 c5 00 19 7a 83 e8 34 5f 4e ff <0f> 0b 5b 83 05 1b 0f 95 02 01 5d 41 5c c3 83 05 10 0f 95 02 01 c3 RSP: 0018:ffffc9000403be40 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff88810cac32f8 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff8401b939 RDI: 00000000ffffffff RBP: ffffffff842f59c0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: f33c643fd81ac911 R12: ffffffff83ef3d14 R13: ffff88810cac32f8 R14: 0000000000000000 R15: ffffffff842f59c0 __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] debug_check_no_obj_freed+0x1bb/0x1dd lib/debugobjects.c:998 kmem_cache_free.part.65+0x145/0x1d0 mm/slab.c:3692 task_work_run+0x68/0xb0 kernel/task_work.c:141 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:139 [inline] exit_to_user_mode_prepare+0x1e2/0x1f0 kernel/entry/common.c:166 syscall_exit_to_user_mode+0x59/0x2b0 kernel/entry/common.c:241 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d579 Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3d67aa1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d579 RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000004 RBP: 000000000118d028 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 000000000118cfec R13: 00007ffebe727abf R14: 00007f3d67aa29c0 R15: 000000000118cfec Kernel Offset: disabled Rebooting in 86400 seconds..