ci2 starts bisection 2025-01-25 16:16:09.350852117 +0000 UTC m=+43559.345806579
bisecting fixing commit since 4aa6747d935281df8a1888feeb6e22e0097d0b86
building syzkaller on fb427a0782000106c62de76d251e5a02de5406a9
ensuring issue is reproducible on original commit 4aa6747d935281df8a1888feeb6e22e0097d0b86
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 20ba9d5e97acff1f0257e3cea0d39e81d8a6641205f4b499a48ee5deace5df85
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
check whether we can drop unnecessary instrumentation
disabling configs for [LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN KASAN], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d7950ca48094d2c33444abd1f3dd755d15844ad830098dc2c3dc6b1b0cb18a9f
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
the bug reproduces without the instrumentation
disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed
kconfig minimization: base=3824 full=7526 leaves diff=1995
split chunks (needed=false): <1995>
split chunk #0 of len 1995 into 5 parts
testing without sub-chunk 1/5
disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4068f2508d9666c45faeb7d8e64df44cb37d5088282b7a5544c824b37315585d
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 56bff0b6f616f6eeab7cd0969661bea5a2d1725661321958333c052fc84b4f67
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f4a1f9f2ec02473cc72ec740fa063464b5cf940633b42e1146b17cc0b5784f0b
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: e843e94aeda2de49a98520ecaf63361092621ccf9cfa968529883bf37c14be27
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed
testing commit 4aa6747d935281df8a1888feeb6e22e0097d0b86 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 1862548879da92031695366782b9a327e34703badc70e12ecb788ae016b2d6f6
all runs: OK
false negative chance: 0.000
minimized to 399 configs; suspects: [ARCH_ENABLE_MEMORY_HOTREMOVE ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT CMA COMMON_CLK CONTIG_ALLOC CRYPTO_842 CRYPTO_LZ4 CRYPTO_LZ4HC CRYPTO_LZO CRYPTO_ZSTD DVB_CORE EXTCON FB GPIOLIB HID_ZEROPLUS I2C_MUX IIO IRQ_REMAP KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_CONFIGFS USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_FOTG210_HCD USB_FOTG210_UDC USB_FTDI_ELAN USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GPIO_VBUS USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_MV_U3D USB_MV_UDC USB_NET2272 USB_NET2272_DMA USB_NET2280 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_RNDIS_WLAN USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_U132_HCD USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USERMODE_DRIVER USER_RETURN_NOTIFIER U_SERIAL_CONSOLE V4L2_ASYNC V4L2_FWNODE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VDPA_USER VETH VFIO VFIO_IOMMU_TYPE1 VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_PCI_MMAP VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_VDPA VHOST_VSOCK VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CAMERA_SENSOR VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_STK1160_COMMON VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING VXFS_FS WANT_DEV_COREDUMP WEXT_CORE WEXT_PRIV WEXT_PROC WIREGUARD WIRELESS WIRELESS_EXT WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_PURELIFI WLAN_VENDOR_SILABS X86_SGX X86_SGX_KVM X86_X2APIC X86_X32_ABI XARRAY_MULTI XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_FS XFS_POSIX_ACL XFS_QUOTA XFS_RT XOR_BLOCKS YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZBUD ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZPOOL ZRAM ZRAM_DEF_COMP_LZORLE ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_LZO ZSWAP_DEFAULT_ON ZSWAP_ZPOOL_DEFAULT_ZBUD]
disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing current HEAD 75cefdf153f582f9d55ff4f9b55778dc95d55f60
testing commit 75cefdf153f582f9d55ff4f9b55778dc95d55f60 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: f9a7a9f0eb72dcfed33217555422f5222439de79e5f796808e58497328b3a741
all runs: OK
false negative chance: 0.000
# git bisect start 75cefdf153f582f9d55ff4f9b55778dc95d55f60 4aa6747d935281df8a1888feeb6e22e0097d0b86
Bisecting: 4545 revisions left to test after this (roughly 12 steps)
[782bdaf9d01658281bc813f3f873e6258aa1fd8d] RDMA/restrack: Fix potential invalid address access
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit 782bdaf9d01658281bc813f3f873e6258aa1fd8d gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 536d0614c1b7b81d62809b25400c9bc02a78d07b9d4eece61ba17bce378eca85
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 782bdaf9d01658281bc813f3f873e6258aa1fd8d
Bisecting: 2273 revisions left to test after this (roughly 11 steps)
[e0ae93934ce867b197fd958341c6757bcee17628] f2fs: fix several potential integer overflows in file offsets
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit e0ae93934ce867b197fd958341c6757bcee17628 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: eb2ec0cd435440cba637b3ba2cedcc4d13b781b20a3f357788c4ac0037d27093
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good e0ae93934ce867b197fd958341c6757bcee17628
Bisecting: 1136 revisions left to test after this (roughly 10 steps)
[34772c3f1a38d1081bb779090b0d9166cbfcd7e6] arm64: dts: mediatek: mt8173-elm-hana: Add vdd-supply to second source trackpad
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit 34772c3f1a38d1081bb779090b0d9166cbfcd7e6 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: a9d9f8288061775fbe41eae1c7e68e3a3723517a9452b4f61055778c83255a4a
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 34772c3f1a38d1081bb779090b0d9166cbfcd7e6
Bisecting: 568 revisions left to test after this (roughly 9 steps)
[5947c9ac08f0771ea8ed64186b0d52e9029cb6c0] net: af_can: do not leave a dangling sk pointer in can_create()
determine whether the revision contains the guilty commit
revision e0ae93934ce867b197fd958341c6757bcee17628 crashed and is reachable
testing commit 5947c9ac08f0771ea8ed64186b0d52e9029cb6c0 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 87dc5557c73cba78cafa0b25a3ba9b377d9da4bf32135af57ced1483fa50864a
all runs: OK
false negative chance: 0.000
# git bisect bad 5947c9ac08f0771ea8ed64186b0d52e9029cb6c0
Bisecting: 283 revisions left to test after this (roughly 8 steps)
[7e696b979061de3fc482b01b343d2d0fd1248900] wifi: brcmfmac: release 'root' node in all execution paths
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit 7e696b979061de3fc482b01b343d2d0fd1248900 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ce4ff4ca77e26eb5cd81020ee78944796a71b7a082bf11b4f7390e42e5fb326e
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 7e696b979061de3fc482b01b343d2d0fd1248900
Bisecting: 141 revisions left to test after this (roughly 7 steps)
[085980b68b035411c1f535ce34d53fbf1091e537] ptp: Add error handling for adjfine callback in ptp_clock_adjtime
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit 085980b68b035411c1f535ce34d53fbf1091e537 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8425474bdbe30fec5025c953856e225602cb939361e632bb9b6a2cedc73b5253
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 085980b68b035411c1f535ce34d53fbf1091e537
Bisecting: 70 revisions left to test after this (roughly 6 steps)
[e4fd0dde298a4f8d3f293f7b28d3519147bab01e] bpf: Remove unnecessary kfree(im_node) in lpm_trie_update_elem
determine whether the revision contains the guilty commit
revision 34772c3f1a38d1081bb779090b0d9166cbfcd7e6 crashed and is reachable
testing commit e4fd0dde298a4f8d3f293f7b28d3519147bab01e gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 5e523ba984d553b2e0a9ee2a1e1058f25a9399deefdc943702f8276b1eeaf699
all runs: OK
false negative chance: 0.000
# git bisect bad e4fd0dde298a4f8d3f293f7b28d3519147bab01e
Bisecting: 35 revisions left to test after this (roughly 5 steps)
[6f24a5f8309438863e57d067d38ab5da7430a156] ntp: Remove invalid cast in time offset math
determine whether the revision contains the guilty commit
revision 4aa6747d935281df8a1888feeb6e22e0097d0b86 crashed and is reachable
testing commit 6f24a5f8309438863e57d067d38ab5da7430a156 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ed390c7d67bb665a1efda19947b0be1d8201b93ee28d553883b13c219da66fd6
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 6f24a5f8309438863e57d067d38ab5da7430a156
Bisecting: 17 revisions left to test after this (roughly 4 steps)
[6fedf3dc30e8584018987fedf4b74c19d82df807] device property: Introduce device_for_each_child_node_scoped()
determine whether the revision contains the guilty commit
revision e0ae93934ce867b197fd958341c6757bcee17628 crashed and is reachable
testing commit 6fedf3dc30e8584018987fedf4b74c19d82df807 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: d0db71a4e67c0d5b7990c890b631ce79282d66d319105304a3ebbe0ffd6948ba
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 6fedf3dc30e8584018987fedf4b74c19d82df807
Bisecting: 8 revisions left to test after this (roughly 3 steps)
[8c28274b2dccdcf2fe29ef625f3c5f8a09e2b809] ALSA: usb-audio: Notify xrun for low-latency mode
determine whether the revision contains the guilty commit
revision 7e696b979061de3fc482b01b343d2d0fd1248900 crashed and is reachable
testing commit 8c28274b2dccdcf2fe29ef625f3c5f8a09e2b809 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: b38b65a38edc95a54f72841a68563f4134d60173d7bc55794833482b3c9815e3
all runs: OK
false negative chance: 0.000
# git bisect bad 8c28274b2dccdcf2fe29ef625f3c5f8a09e2b809
Bisecting: 4 revisions left to test after this (roughly 2 steps)
[98452de4519083cb12ec453b5ea61c681cfed2c1] xsk: always clear DMA mapping information when unmapping the pool
determine whether the revision contains the guilty commit
revision e0ae93934ce867b197fd958341c6757bcee17628 crashed and is reachable
testing commit 98452de4519083cb12ec453b5ea61c681cfed2c1 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 0404c5d98a48038081466f326eb4020d9e1f2832e4f637541439baddd8768dd9
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 98452de4519083cb12ec453b5ea61c681cfed2c1
Bisecting: 2 revisions left to test after this (roughly 1 step)
[31a19580badbaa67837fafc31b892ea08009a31a] bpftool: fix potential NULL pointer dereferencing in prog_dump()
determine whether the revision contains the guilty commit
revision 085980b68b035411c1f535ce34d53fbf1091e537 crashed and is reachable
testing commit 31a19580badbaa67837fafc31b892ea08009a31a gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 69bbaf834bc6b7748461d6df8b06f4884eefac6bd7e09f7972a0e59f03f76d27
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 31a19580badbaa67837fafc31b892ea08009a31a
Bisecting: 0 revisions left to test after this (roughly 1 step)
[456f08d24afa51b5eb816c42e4ca1c44a247bd42] tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
determine whether the revision contains the guilty commit
revision e0ae93934ce867b197fd958341c6757bcee17628 crashed and is reachable
testing commit 456f08d24afa51b5eb816c42e4ca1c44a247bd42 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: c4252c73b221d2fe1f6c505888bc6096becdf662bbc1fad15f429f91f2412444
all runs: OK
false negative chance: 0.000
# git bisect bad 456f08d24afa51b5eb816c42e4ca1c44a247bd42
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[0f51eb88c39a0f4110f0f4352866c403e08262e8] drm/sti: Add __iomem for mixer_dbg_mxn's parameter
determine whether the revision contains the guilty commit
revision 34772c3f1a38d1081bb779090b0d9166cbfcd7e6 crashed and is reachable
testing commit 0f51eb88c39a0f4110f0f4352866c403e08262e8 gcc
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 4c66dada34a272e2d9943051f36507d0621772de621a6f1c8460003586b856e0
all runs: crashed: WARNING in inet_sock_destruct
representative crash: WARNING in inet_sock_destruct, types: [WARNING]
# git bisect good 0f51eb88c39a0f4110f0f4352866c403e08262e8
456f08d24afa51b5eb816c42e4ca1c44a247bd42 is the first bad commit
commit 456f08d24afa51b5eb816c42e4ca1c44a247bd42
Author: Zijian Zhang <zijianzhang@bytedance.com>
Date: Wed Oct 16 23:48:38 2024 +0000
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
[ Upstream commit ca70b8baf2bd125b2a4d96e76db79375c07d7ff2 ]
The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging
tosend bytes, which is either msg->sg.size or a smaller value apply_bytes.
Potential problems with this strategy are as follows:
- If the actual sent bytes are smaller than tosend, we need to charge some
bytes back, as in line 487, which is okay but seems not clean.
- When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may
miss uncharging (msg->sg.size - apply_bytes) bytes.
[...]
415 tosend = msg->sg.size;
416 if (psock->apply_bytes && psock->apply_bytes < tosend)
417 tosend = psock->apply_bytes;
[...]
443 sk_msg_return(sk, msg, tosend);
444 release_sock(sk);
446 origsize = msg->sg.size;
447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress,
448 msg, tosend, flags);
449 sent = origsize - msg->sg.size;
[...]
454 lock_sock(sk);
455 if (unlikely(ret < 0)) {
456 int free = sk_msg_free_nocharge(sk, msg);
458 if (!cork)
459 *copied -= free;
460 }
[...]
487 if (eval == __SK_REDIRECT)
488 sk_mem_charge(sk, tosend - sent);
[...]
When running the selftest test_txmsg_redir_wait_sndmem with txmsg_apply,
the following warning will be reported:
------------[ cut here ]------------
WARNING: CPU: 6 PID: 57 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x190/0x1a0
Modules linked in:
CPU: 6 UID: 0 PID: 57 Comm: kworker/6:0 Not tainted 6.12.0-rc1.bm.1-amd64+ #43
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events sk_psock_destroy
RIP: 0010:inet_sock_destruct+0x190/0x1a0
RSP: 0018:ffffad0a8021fe08 EFLAGS: 00010206
RAX: 0000000000000011 RBX: ffff9aab4475b900 RCX: ffff9aab481a0800
RDX: 0000000000000303 RSI: 0000000000000011 RDI: ffff9aab4475b900
RBP: ffff9aab4475b990 R08: 0000000000000000 R09: ffff9aab40050ec0
R10: 0000000000000000 R11: ffff9aae6fdb1d01 R12: ffff9aab49c60400
R13: ffff9aab49c60598 R14: ffff9aab49c60598 R15: dead000000000100
FS: 0000000000000000(0000) GS:ffff9aae6fd80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffec7e47bd8 CR3: 00000001a1a1c004 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? __warn+0x89/0x130
? inet_sock_destruct+0x190/0x1a0
? report_bug+0xfc/0x1e0
? handle_bug+0x5c/0xa0
? exc_invalid_op+0x17/0x70
? asm_exc_invalid_op+0x1a/0x20
? inet_sock_destruct+0x190/0x1a0
__sk_destruct+0x25/0x220
sk_psock_destroy+0x2b2/0x310
process_scheduled_works+0xa3/0x3e0
worker_thread+0x117/0x240
? __pfx_worker_thread+0x10/0x10
kthread+0xcf/0x100
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x40
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
---[ end trace 0000000000000000 ]---
In __SK_REDIRECT, a more concise way is delaying the uncharging after sent
bytes are finalized, and uncharge this value. When (ret < 0), we shall
invoke sk_msg_free.
Same thing happens in case __SK_DROP, when tosend is set to apply_bytes,
we may miss uncharging (msg->sg.size - apply_bytes) bytes. The same
warning will be reported in selftest.
[...]
468 case __SK_DROP:
469 default:
470 sk_msg_free_partial(sk, msg, tosend);
471 sk_msg_apply_bytes(psock, tosend);
472 *copied -= (tosend + delta);
473 return -EACCES;
[...]
So instead of sk_msg_free_partial we can do sk_msg_free here.
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Fixes: 8ec95b94716a ("bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues")
Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20241016234838.3167769-3-zijianzhang@bytedance.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/tcp_bpf.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
accumulated error probability: 0.00
culprit signature: c4252c73b221d2fe1f6c505888bc6096becdf662bbc1fad15f429f91f2412444
parent signature: 4c66dada34a272e2d9943051f36507d0621772de621a6f1c8460003586b856e0
revisions tested: 22, total time: 5h2m35.972131301s (build: 2h49m28.714129253s, test: 2h4m3.490287429s)
first good commit: 456f08d24afa51b5eb816c42e4ca1c44a247bd42 tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
recipients (to): ["daniel@iogearbox.net" "john.fastabend@gmail.com" "sashal@kernel.org" "zijianzhang@bytedance.com"]
recipients (cc): []