bisecting cause commit starting from e472c64aa4fa6150c6076fd36d101d667d71c30a building syzkaller on a41ca8fa8285754d8561dcc3ed54cca2da60eed7 testing commit e472c64aa4fa6150c6076fd36d101d667d71c30a with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in kfree_skb testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in kfree_skb testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 all runs: OK # git bisect start v5.3 v5.2 Bisecting: 7848 revisions left to test after this (roughly 13 steps) [43c95d3694cc448fdf50bd53b7ff3a5bb4655883] Merge tag 'pinctrl-v5.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl testing commit 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in kfree_skb # git bisect bad 43c95d3694cc448fdf50bd53b7ff3a5bb4655883 Bisecting: 4619 revisions left to test after this (roughly 12 steps) [8f6ccf6159aed1f04c6d179f61f6fb2691261e84] Merge tag 'clone3-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux testing commit 8f6ccf6159aed1f04c6d179f61f6fb2691261e84 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8f6ccf6159aed1f04c6d179f61f6fb2691261e84 Bisecting: 2306 revisions left to test after this (roughly 11 steps) [753c8d9b7d81206bb5d011b28abe829d364b028e] Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 753c8d9b7d81206bb5d011b28abe829d364b028e with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in kfree_skb # git bisect bad 753c8d9b7d81206bb5d011b28abe829d364b028e Bisecting: 1156 revisions left to test after this (roughly 10 steps) [2f9b0d93a9d3ec64558537ab5d7cff820886afa4] net: ethernet: ti: cpsw: Fix suspend/resume break testing commit 2f9b0d93a9d3ec64558537ab5d7cff820886afa4 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2f9b0d93a9d3ec64558537ab5d7cff820886afa4 Bisecting: 578 revisions left to test after this (roughly 9 steps) [354d0fab649d47045517cf7cae03d653a4dcb3b8] net: hns3: add default value for tc_size and tc_offset testing commit 354d0fab649d47045517cf7cae03d653a4dcb3b8 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 354d0fab649d47045517cf7cae03d653a4dcb3b8 Bisecting: 289 revisions left to test after this (roughly 8 steps) [52c0609258658ff35b85c654c568a50abd602ac6] bnxt_en: rename some xdp functions testing commit 52c0609258658ff35b85c654c568a50abd602ac6 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb run #1: crashed: KASAN: use-after-free Read in kfree_skb run #2: crashed: KASAN: use-after-free Read in kfree_skb run #3: crashed: KASAN: use-after-free Read in kfree_skb run #4: crashed: KASAN: use-after-free Read in kfree_skb run #5: crashed: KASAN: use-after-free Read in kfree_skb run #6: crashed: KASAN: use-after-free Read in kfree_skb run #7: crashed: KASAN: invalid-free in skb_free_head run #8: crashed: KASAN: use-after-free Read in kfree_skb run #9: crashed: KASAN: invalid-free in skb_free_head # git bisect bad 52c0609258658ff35b85c654c568a50abd602ac6 Bisecting: 163 revisions left to test after this (roughly 7 steps) [1375da478712369d1af8586768cf476e4f42f0ce] Merge tag 'iwlwifi-next-for-kalle-2019-06-29' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next testing commit 1375da478712369d1af8586768cf476e4f42f0ce with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1375da478712369d1af8586768cf476e4f42f0ce Bisecting: 81 revisions left to test after this (roughly 6 steps) [1d87b88ba26eabd4745e158ecfd87c93a9b51dc2] Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug testing commit 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb run #1: crashed: KASAN: invalid-free in skb_free_head run #2: crashed: KASAN: use-after-free Read in kfree_skb run #3: crashed: KASAN: use-after-free Read in kfree_skb run #4: crashed: KASAN: use-after-free Read in kfree_skb run #5: crashed: KASAN: invalid-free in skb_free_head run #6: crashed: KASAN: invalid-free in skb_free_head run #7: crashed: KASAN: invalid-free in skb_free_head run #8: crashed: KASAN: use-after-free Read in kfree_skb run #9: crashed: KASAN: use-after-free Read in kfree_skb # git bisect bad 1d87b88ba26eabd4745e158ecfd87c93a9b51dc2 Bisecting: 40 revisions left to test after this (roughly 5 steps) [c778dd31ac22f9027b7c8dfd62f421e245b49639] net/mlx5: Accel, Expose accel wrapper for IPsec FPGA function testing commit c778dd31ac22f9027b7c8dfd62f421e245b49639 with gcc (GCC) 8.1.0 all runs: OK # git bisect good c778dd31ac22f9027b7c8dfd62f421e245b49639 Bisecting: 20 revisions left to test after this (roughly 4 steps) [db50450d096a452ae36dc265575cbff50f0f9f01] 6lowpan: no need to check return value of debugfs_create functions testing commit db50450d096a452ae36dc265575cbff50f0f9f01 with gcc (GCC) 8.1.0 all runs: OK # git bisect good db50450d096a452ae36dc265575cbff50f0f9f01 Bisecting: 10 revisions left to test after this (roughly 3 steps) [055825614c6b4da8c931fe1dea2f2920553f7a67] Bluetooth: btmtkuart: add an implementation for clock osc property testing commit 055825614c6b4da8c931fe1dea2f2920553f7a67 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 055825614c6b4da8c931fe1dea2f2920553f7a67 Bisecting: 5 revisions left to test after this (roughly 3 steps) [dcae9052ebb0c5b2614de620323d615fcbfda7f8] Bluetooth: hidp: NUL terminate a string in the compat ioctl testing commit dcae9052ebb0c5b2614de620323d615fcbfda7f8 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: invalid-free in skb_free_head run #1: crashed: KASAN: use-after-free Read in kfree_skb run #2: crashed: KASAN: use-after-free Read in kfree_skb run #3: crashed: KASAN: use-after-free Read in kfree_skb run #4: crashed: KASAN: use-after-free Read in kfree_skb run #5: crashed: KASAN: use-after-free Read in kfree_skb run #6: crashed: KASAN: invalid-free in skb_free_head run #7: crashed: KASAN: use-after-free Read in kfree_skb run #8: crashed: KASAN: use-after-free Read in kfree_skb run #9: crashed: KASAN: invalid-free in skb_free_head # git bisect bad dcae9052ebb0c5b2614de620323d615fcbfda7f8 Bisecting: 2 revisions left to test after this (roughly 1 step) [4ce9146e0370fcd573f0372d9b4e5a211112567c] Bluetooth: hci_bcsp: Fix memory leak in rx_skb testing commit 4ce9146e0370fcd573f0372d9b4e5a211112567c with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb run #1: crashed: KASAN: use-after-free Read in kfree_skb run #2: crashed: KASAN: use-after-free Read in kfree_skb run #3: crashed: KASAN: use-after-free Read in kfree_skb run #4: crashed: KASAN: use-after-free Read in kfree_skb run #5: crashed: KASAN: invalid-free in skb_free_head run #6: crashed: KASAN: invalid-free in skb_free_head run #7: crashed: KASAN: use-after-free Read in kfree_skb run #8: crashed: KASAN: use-after-free Read in kfree_skb run #9: crashed: KASAN: invalid-free in skb_free_head # git bisect bad 4ce9146e0370fcd573f0372d9b4e5a211112567c Bisecting: 0 revisions left to test after this (roughly 0 steps) [6c595ea8b7b9d4048760c28cbccd8956acbc0762] Bluetooth:: btrtl: Add support for RTL8723DU testing commit 6c595ea8b7b9d4048760c28cbccd8956acbc0762 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 6c595ea8b7b9d4048760c28cbccd8956acbc0762 4ce9146e0370fcd573f0372d9b4e5a211112567c is the first bad commit commit 4ce9146e0370fcd573f0372d9b4e5a211112567c Author: Tomas Bortoli Date: Tue May 28 15:42:58 2019 +0200 Bluetooth: hci_bcsp: Fix memory leak in rx_skb Syzkaller found that it is possible to provoke a memory leak by never freeing rx_skb in struct bcsp_struct. Fix by freeing in bcsp_close() Signed-off-by: Tomas Bortoli Reported-by: syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com Signed-off-by: Marcel Holtmann :040000 040000 edbac8f0a6b9692f951d922140b17857b77ea205 b0f27c2aa31b5f4548bbdfacfa86fc54f94355e9 M drivers revisions tested: 17, total time: 3h51m43.0523758s (build: 1h39m11.064429993s, test: 2h7m41.951587832s) first bad commit: 4ce9146e0370fcd573f0372d9b4e5a211112567c Bluetooth: hci_bcsp: Fix memory leak in rx_skb cc: ["johan.hedberg@gmail.com" "linux-bluetooth@vger.kernel.org" "linux-kernel@vger.kernel.org" "marcel@holtmann.org" "tomasbortoli@gmail.com"] crash: KASAN: invalid-free in skb_free_head ================================================================== BUG: KASAN: double-free or invalid-free in skb_free_head+0x6e/0x90 net/core/skbuff.c:589 CPU: 1 PID: 7521 Comm: syz-executor.4 Not tainted 5.2.0-rc6+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.5+0x9/0x1ff mm/kasan/report.c:188 kasan_report_invalid_free+0x64/0xa0 mm/kasan/report.c:279 __kasan_slab_free+0x13a/0x150 mm/kasan/common.c:430 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kfree+0xcf/0x220 mm/slab.c:3755 skb_free_head+0x6e/0x90 net/core/skbuff.c:589 skb_release_data+0x376/0x6a0 net/core/skbuff.c:609 skb_release_all+0x3d/0x50 net/core/skbuff.c:663 __kfree_skb net/core/skbuff.c:677 [inline] kfree_skb+0x97/0x270 net/core/skbuff.c:695 bcsp_close+0xb5/0x120 drivers/bluetooth/hci_bcsp.c:748 hci_uart_tty_close+0x18f/0x1f0 drivers/bluetooth/hci_ldisc.c:535 tty_ldisc_close.isra.3+0xc8/0x120 drivers/tty/tty_ldisc.c:494 tty_ldisc_kill+0x7f/0x120 drivers/tty/tty_ldisc.c:642 tty_ldisc_release+0xb8/0x1a0 drivers/tty/tty_ldisc.c:814 tty_release_struct+0x12/0x50 drivers/tty/tty_io.c:1612 tty_release+0x97e/0xc60 drivers/tty/tty_io.c:1785 __fput+0x25a/0x770 fs/file_table.c:280 ____fput+0x9/0x10 fs/file_table.c:313 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:185 [inline] exit_to_usermode_loop+0x1a9/0x200 arch/x86/entry/common.c:168 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x447/0x530 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413ae1 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007ffc4057d0e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 0000000000413ae1 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff R10: 00007ffc4057d1c0 R11: 0000000000000293 R12: 000000000075c9a0 R13: 000000000075c9a0 R14: 00000000007602d8 R15: 000000000075bfd4 Allocated by task 91: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc.constprop.8+0xc7/0xd0 mm/kasan/common.c:489 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503 __do_kmalloc_node mm/slab.c:3620 [inline] __kmalloc_node_track_caller+0x4d/0x70 mm/slab.c:3634 __kmalloc_reserve.isra.38+0x2c/0xc0 net/core/skbuff.c:139 __alloc_skb+0xd7/0x570 net/core/skbuff.c:207 alloc_skb include/linux/skbuff.h:1054 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:339 [inline] bcsp_recv+0x351/0x1480 drivers/bluetooth/hci_bcsp.c:670 hci_uart_tty_receive+0x1ce/0x460 drivers/bluetooth/hci_ldisc.c:600 tty_ldisc_receive_buf+0xff/0x1b0 drivers/tty/tty_buffer.c:465 tty_port_default_receive_buf+0x5f/0x90 drivers/tty/tty_port.c:38 receive_buf drivers/tty/tty_buffer.c:481 [inline] flush_to_ldisc+0x1aa/0x3a0 drivers/tty/tty_buffer.c:533 process_one_work+0x830/0x16a0 kernel/workqueue.c:2269 worker_thread+0x85/0xb60 kernel/workqueue.c:2415 kthread+0x324/0x3e0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 91: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kfree+0xcf/0x220 mm/slab.c:3755 skb_free_head+0x6e/0x90 net/core/skbuff.c:589 skb_release_data+0x376/0x6a0 net/core/skbuff.c:609 skb_release_all+0x3d/0x50 net/core/skbuff.c:663 __kfree_skb net/core/skbuff.c:677 [inline] kfree_skb+0x97/0x270 net/core/skbuff.c:695 bcsp_recv+0x260/0x1480 drivers/bluetooth/hci_bcsp.c:608 hci_uart_tty_receive+0x1ce/0x460 drivers/bluetooth/hci_ldisc.c:600 tty_ldisc_receive_buf+0xff/0x1b0 drivers/tty/tty_buffer.c:465 tty_port_default_receive_buf+0x5f/0x90 drivers/tty/tty_port.c:38 receive_buf drivers/tty/tty_buffer.c:481 [inline] flush_to_ldisc+0x1aa/0x3a0 drivers/tty/tty_buffer.c:533 process_one_work+0x830/0x16a0 kernel/workqueue.c:2269 worker_thread+0x85/0xb60 kernel/workqueue.c:2415 kthread+0x324/0x3e0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8880a0015100 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 0 bytes inside of 8192-byte region [ffff8880a0015100, ffff8880a0017100) The buggy address belongs to the page: page:ffffea0002800500 refcount:1 mapcount:0 mapping:ffff8880aa402080 index:0x0 compound_mapcount: 0 flags: 0x1fffc0000010200(slab|head) raw: 01fffc0000010200 ffffea000224cb08 ffffea00022aa508 ffff8880aa402080 raw: 0000000000000000 ffff8880a0015100 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a0015000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a0015080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880a0015100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a0015180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a0015200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================