bisecting fixing commit since 4abf26854aade9732a215a168205fa9fecd6149a building syzkaller on c090b4da255257841173fb4eb18c19d69b293180 testing commit 4abf26854aade9732a215a168205fa9fecd6149a with gcc (GCC) 8.4.1 20210217 kernel signature: 1f61940ccf691728ad429c41e87b73788ae142e08d7fc8cf15d4c71039169af4 all runs: crashed: general protection fault in ioctl_standard_call testing current HEAD 030194a5b292bb7613407668d85af0b987bb9839 testing commit 030194a5b292bb7613407668d85af0b987bb9839 with gcc (GCC) 8.4.1 20210217 kernel signature: 50c2dec4814d9127bfc709246ce404ee8c022a0f2c7ffb0183fac2e020e121c6 all runs: OK # git bisect start 030194a5b292bb7613407668d85af0b987bb9839 4abf26854aade9732a215a168205fa9fecd6149a Bisecting: 605 revisions left to test after this (roughly 9 steps) [669c0b5782fba3c4b0a5f68bca53b3b6055b3b2f] net: avoid 32 x truesize under-estimation for tiny skbs testing commit 669c0b5782fba3c4b0a5f68bca53b3b6055b3b2f with gcc (GCC) 8.4.1 20210217 kernel signature: 2e5c489dddb9662de582e893b338a4740e6ac8bd676ebdac40de7eb0d4479973 all runs: crashed: general protection fault in ioctl_standard_call # git bisect good 669c0b5782fba3c4b0a5f68bca53b3b6055b3b2f Bisecting: 302 revisions left to test after this (roughly 8 steps) [3a429d135749e8e8a82c3a7912dc93faa55829ab] arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz testing commit 3a429d135749e8e8a82c3a7912dc93faa55829ab with gcc (GCC) 8.4.1 20210217 kernel signature: 239cb8288219da0186e76776f5eaee5083c120a88157543ddd7b85ffdc5ce42f all runs: OK # git bisect bad 3a429d135749e8e8a82c3a7912dc93faa55829ab Bisecting: 151 revisions left to test after this (roughly 7 steps) [2a6e9df11190aba32113d4e8122d7da6422b5044] elfcore: fix building with clang testing commit 2a6e9df11190aba32113d4e8122d7da6422b5044 with gcc (GCC) 8.4.1 20210217 kernel signature: 9e7e3cf3ff7370a6dab467271be2b20f4086958d2f40e818f05f3030e0052803 all runs: OK # git bisect bad 2a6e9df11190aba32113d4e8122d7da6422b5044 Bisecting: 75 revisions left to test after this (roughly 6 steps) [f9b0c6c556dbf3694fee05f1334830ce2ec1f5bc] futex: Add mutex around futex exit testing commit f9b0c6c556dbf3694fee05f1334830ce2ec1f5bc with gcc (GCC) 8.4.1 20210217 kernel signature: eee3bb6c3389c39877abede6b1560a3e70f456e36bcfa5b7a84209270961d78c run #0: crashed: general protection fault in ioctl_standard_call run #1: crashed: general protection fault in ioctl_standard_call run #2: crashed: general protection fault in ioctl_standard_call run #3: crashed: general protection fault in ioctl_standard_call run #4: crashed: general protection fault in ioctl_standard_call run #5: crashed: general protection fault in ioctl_standard_call run #6: boot failed: can't ssh into the instance run #7: boot failed: can't ssh into the instance run #8: boot failed: can't ssh into the instance run #9: boot failed: can't ssh into the instance # git bisect good f9b0c6c556dbf3694fee05f1334830ce2ec1f5bc Bisecting: 37 revisions left to test after this (roughly 5 steps) [6790d6f3cb46d6212e9cabfc82d8be0a34cb08bd] xfrm: Fix oops in xfrm_replay_advance_bmp testing commit 6790d6f3cb46d6212e9cabfc82d8be0a34cb08bd with gcc (GCC) 8.4.1 20210217 kernel signature: 1d94c1dc9e16205a33789ac8b3e0ea9af570259b1f39324f9182cc68bd24a5f4 all runs: OK # git bisect bad 6790d6f3cb46d6212e9cabfc82d8be0a34cb08bd Bisecting: 18 revisions left to test after this (roughly 4 steps) [8445d9564504e40fd0e3b5323079d4ea02715030] kernel: kexec: remove the lock operation of system_transition_mutex testing commit 8445d9564504e40fd0e3b5323079d4ea02715030 with gcc (GCC) 8.4.1 20210217 kernel signature: 36ecbd6dfd38c78dddc9363a6ce98626537271e23b3c87f775b387f1820c7227 all runs: crashed: general protection fault in ioctl_standard_call # git bisect good 8445d9564504e40fd0e3b5323079d4ea02715030 Bisecting: 9 revisions left to test after this (roughly 3 steps) [d8fc14c45f784d813c2b4246ce4d15632b3325ab] drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] testing commit d8fc14c45f784d813c2b4246ce4d15632b3325ab with gcc (GCC) 8.4.1 20210217 kernel signature: 0d202fbf2274f0579e199d2fd1300aa2036ab888f7e5e26d2f751fbdfe52bbbc all runs: OK # git bisect bad d8fc14c45f784d813c2b4246ce4d15632b3325ab Bisecting: 4 revisions left to test after this (roughly 2 steps) [92e80fac793d32e233d58a99052f88d3bd12bde6] ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming testing commit 92e80fac793d32e233d58a99052f88d3bd12bde6 with gcc (GCC) 8.4.1 20210217 kernel signature: 903a843269a69a5f463535b8792a1777f4b553600516c3d1dd24789524c17c51 all runs: crashed: general protection fault in ioctl_standard_call # git bisect good 92e80fac793d32e233d58a99052f88d3bd12bde6 Bisecting: 2 revisions left to test after this (roughly 1 step) [e4959cfbd7cd8c969b49773c11260953c5c2b530] net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family testing commit e4959cfbd7cd8c969b49773c11260953c5c2b530 with gcc (GCC) 8.4.1 20210217 kernel signature: 6a28b5ed1d3d406b19f5cc1d400ffc5ab729e430672cb698c48fb7e1e61e0efd all runs: OK # git bisect bad e4959cfbd7cd8c969b49773c11260953c5c2b530 Bisecting: 0 revisions left to test after this (roughly 0 steps) [3f33e522a07f5f8d399d509ff06f7fd87a46e176] wext: fix NULL-ptr-dereference with cfg80211's lack of commit() testing commit 3f33e522a07f5f8d399d509ff06f7fd87a46e176 with gcc (GCC) 8.4.1 20210217 kernel signature: 200c905c33fceeccc194cf690c6087a8e225966b39dd7d6037c095e9a458e6b2 all runs: OK # git bisect bad 3f33e522a07f5f8d399d509ff06f7fd87a46e176 3f33e522a07f5f8d399d509ff06f7fd87a46e176 is the first bad commit commit 3f33e522a07f5f8d399d509ff06f7fd87a46e176 Author: Johannes Berg Date: Thu Jan 21 17:16:22 2021 +0100 wext: fix NULL-ptr-dereference with cfg80211's lack of commit() commit 5122565188bae59d507d90a9a9fd2fd6107f4439 upstream. Since cfg80211 doesn't implement commit, we never really cared about that code there (and it's configured out w/o CONFIG_WIRELESS_EXT). After all, since it has no commit, it shouldn't return -EIWCOMMIT to indicate commit is needed. However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_ happen if e.g. we try to change the frequency but we're already in the process of connecting to some network, and drivers could return that value (or even cfg80211 itself might). This then causes us to crash because dev->wireless_handlers is NULL but we try to check dev->wireless_handlers->standard[0]. Fix this by also checking dev->wireless_handlers. Also simplify the code a little bit. Cc: stable@vger.kernel.org Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman net/wireless/wext-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) culprit signature: 200c905c33fceeccc194cf690c6087a8e225966b39dd7d6037c095e9a458e6b2 parent signature: 903a843269a69a5f463535b8792a1777f4b553600516c3d1dd24789524c17c51 revisions tested: 12, total time: 3h34m9.385018571s (build: 2h5m59.267285597s, test: 1h26m3.950207301s) first good commit: 3f33e522a07f5f8d399d509ff06f7fd87a46e176 wext: fix NULL-ptr-dereference with cfg80211's lack of commit() recipients (to): ["davem@davemloft.net" "gregkh@linuxfoundation.org" "johannes.berg@intel.com" "netdev@vger.kernel.org"] recipients (cc): ["johannes@sipsolutions.net" "linux-kernel@vger.kernel.org" "linux-wireless@vger.kernel.org"]