bisecting fixing commit since 01fd1694b93c92ad54fa684dac9c8068ecda8288
building syzkaller on cd626f3ba9f85027426d4fbed73e79e523e8e138
testing commit 01fd1694b93c92ad54fa684dac9c8068ecda8288 with gcc (GCC) 8.1.0
kernel signature: b54004db9e35b23d934298a873d34d660f77eabb7559e1184776cd33e389de5f
run #0: crashed: general protection fault in __smc_diag_dump
run #1: crashed: general protection fault in __smc_diag_dump
run #2: crashed: general protection fault in __smc_diag_dump
run #3: crashed: general protection fault in __smc_diag_dump
run #4: crashed: KASAN: use-after-free Read in __smc_diag_dump
run #5: crashed: general protection fault in __smc_diag_dump
run #6: crashed: general protection fault in __smc_diag_dump
run #7: crashed: general protection fault in __smc_diag_dump
run #8: crashed: general protection fault in __smc_diag_dump
run #9: crashed: general protection fault in __smc_diag_dump
testing current HEAD 4f68020fef1c6cf1b680ffb6481ac41379283ea3
testing commit 4f68020fef1c6cf1b680ffb6481ac41379283ea3 with gcc (GCC) 8.1.0
kernel signature: 422bc18d2fd0fdd2c63b6665fe1ffdf7258d7afb64c7453c258cd34c888faf48
run #0: crashed: general protection fault in __smc_diag_dump
run #1: crashed: KASAN: use-after-free Read in __smc_diag_dump
run #2: crashed: general protection fault in __smc_diag_dump
run #3: crashed: general protection fault in __smc_diag_dump
run #4: crashed: general protection fault in __smc_diag_dump
run #5: crashed: general protection fault in __smc_diag_dump
run #6: crashed: general protection fault in __smc_diag_dump
run #7: crashed: general protection fault in __smc_diag_dump
run #8: crashed: general protection fault in __smc_diag_dump
run #9: crashed: general protection fault in __smc_diag_dump
revisions tested: 2, total time: 26m2.629258011s (build: 17m25.291872142s, test: 7m47.433276973s)
the crash still happens on HEAD
commit msg: Linux 4.14.182
crash: general protection fault in __smc_diag_dump
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 9109 Comm: syz-executor.3 Not tainted 4.14.182-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8880961fa1c0 task.stack: ffff88807a0e8000
RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:46 [inline]
RIP: 0010:__smc_diag_dump.isra.4+0x322/0x1670 net/smc/smc_diag.c:81
RSP: 0018:ffff88807a0ef328 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: ffff88807a0ef500 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff888078430f3c RDI: 000000000000000e
RBP: ffff88807a0ef528 R08: ffffed100f0861ea R09: ffff888078430f10
R10: ffffed100f0861e9 R11: ffff888078430f4f R12: ffff8880a1220100
R13: ffff888078430f00 R14: ffff8880907e5210 R15: 0000000000000000
FS:  00007fdc524da700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3b66ee5db8 CR3: 00000000a69cf000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 smc_diag_dump+0x1dc/0x2a0 net/smc/smc_diag.c:169
 netlink_dump+0x3bf/0xb70 net/netlink/af_netlink.c:2203
 __netlink_dump_start+0x4c2/0x780 net/netlink/af_netlink.c:2300
 netlink_dump_start include/linux/netlink.h:217 [inline]
 smc_diag_handler_dump+0x197/0x220 net/smc/smc_diag.c:190
 __sock_diag_cmd net/core/sock_diag.c:231 [inline]
 sock_diag_rcv_msg+0x252/0x350 net/core/sock_diag.c:263
 netlink_rcv_skb+0x133/0x370 net/netlink/af_netlink.c:2433
 sock_diag_rcv+0x25/0x40 net/core/sock_diag.c:274
 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline]
 netlink_unicast+0x40d/0x5f0 net/netlink/af_netlink.c:1313
 netlink_sendmsg+0x730/0xbd0 net/netlink/af_netlink.c:1878
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0xf0 net/socket.c:656
 kernel_sendmsg+0x26/0x30 net/socket.c:664
 sock_no_sendpage+0xf7/0x130 net/core/sock.c:2572
 kernel_sendpage+0x60/0xd0 net/socket.c:3407
 sock_sendpage+0x6d/0xd0 net/socket.c:871
 pipe_to_sendpage+0x206/0x420 fs/splice.c:451
 splice_from_pipe_feed fs/splice.c:502 [inline]
 __splice_from_pipe+0x2cb/0x720 fs/splice.c:626
 splice_from_pipe+0xb5/0x110 fs/splice.c:661
 generic_splice_sendpage+0x10/0x20 fs/splice.c:832
 do_splice_from fs/splice.c:851 [inline]
 do_splice fs/splice.c:1147 [inline]
 SYSC_splice fs/splice.c:1402 [inline]
 SyS_splice+0x6e9/0x1580 fs/splice.c:1382
 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x459879
RSP: 002b:00007fdc524d9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000459879
RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 000000000075c070 R08: 0000000080000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdc524da6d4
R13: 00000000004c907b R14: 00000000004df4f0 R15: 00000000ffffffff
Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2c 12 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7f 20 49 8d 7f 0e 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 
RIP: smc_diag_msg_common_fill net/smc/smc_diag.c:46 [inline] RSP: ffff88807a0ef328
RIP: __smc_diag_dump.isra.4+0x322/0x1670 net/smc/smc_diag.c:81 RSP: ffff88807a0ef328
---[ end trace 5df0d30ad5ef29cb ]---