ci starts bisection 2023-12-10 23:34:00.339942152 +0000 UTC m=+301764.445399886 bisecting fixing commit since 6bc986ab839c844e78a2333a02e55f02c9e57935 building syzkaller on 4862372a57ee80af8186cd80f6c9c8f741a45e40 ensuring issue is reproducible on original commit 6bc986ab839c844e78a2333a02e55f02c9e57935 testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 76dc5df3ec5d5f75f5b17bdc5b2fd80f047d77b37770044d8d343cf3facbef6a run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: KASAN: slab-use-after-free Read in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release run #10: crashed: BUG: corrupted list in ptp_release run #11: crashed: BUG: corrupted list in ptp_release run #12: crashed: BUG: corrupted list in ptp_release run #13: crashed: BUG: corrupted list in ptp_release run #14: crashed: BUG: corrupted list in ptp_release run #15: crashed: BUG: corrupted list in ptp_release run #16: crashed: BUG: corrupted list in ptp_release run #17: crashed: BUG: corrupted list in ptp_release run #18: crashed: BUG: corrupted list in ptp_release run #19: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] check whether we can drop unnecessary instrumentation disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN KASAN LOCKDEP], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 77107c9fc5af3f2cbc85924aafb91d373fc88e895a25b8bf02dcf3626697a38b run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_open run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed kconfig minimization: base=3923 full=7663 leaves diff=2009 split chunks (needed=false): <2009> split chunk #0 of len 2009 into 5 parts testing without sub-chunk 1/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6c968bb024278f731f3da847653156c20a041d617f83c2b378df2a0839f234b2 all runs: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 0e37541755a2fbf1ad12fdcc4c975cb55c45b568174316af12a8cc3b9f012e0a run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_open run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_open run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_open representative crash: BUG: corrupted list in ptp_open, types: [BUG] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 18f5b3aec1bfcad168c8a61863bc17ac9093cd3c307acecbf0e1d6468251d3f7 run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_open run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_open representative crash: BUG: corrupted list in ptp_open, types: [BUG] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [ATOMIC_SLEEP HANG LEAK UBSAN KASAN LOCKDEP], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c6b8036de1f6474a02f4adf85084f3f0c25697c4e3f0fd0727b0efbfe01ae671 run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_open run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_open run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_open run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_open, types: [BUG] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing commit 6bc986ab839c844e78a2333a02e55f02c9e57935 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b80c11ef0490008671abfa655fdee795f583e28adde67144abd370d05ebbb4d5 run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_open run #9: crashed: BUG: corrupted list in ptp_open representative crash: BUG: corrupted list in ptp_release, types: [BUG] the chunk can be dropped disabling configs for [LEAK UBSAN KASAN LOCKDEP ATOMIC_SLEEP HANG], they are not needed testing current HEAD a39b6ac3781d46ba18193c9dbb2110f31e9bffe9 testing commit a39b6ac3781d46ba18193c9dbb2110f31e9bffe9 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 9f297b71e42346115f5b3b59f6496bbef8b3ab33e52f54da72055bd2e01b75e1 all runs: OK false negative chance: 0.000 # git bisect start a39b6ac3781d46ba18193c9dbb2110f31e9bffe9 6bc986ab839c844e78a2333a02e55f02c9e57935 Bisecting: 1049 revisions left to test after this (roughly 10 steps) [037266a5f7239ead1530266f7d7af153d2a867fa] Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi determine whether the revision contains the guilty commit revision 6bc986ab839c844e78a2333a02e55f02c9e57935 crashed and is reachable testing commit 037266a5f7239ead1530266f7d7af153d2a867fa gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 608da8a9f2db31fbd2e8a96bf58ed259458c4f3fdc481542a29e7c9745e68dbe all runs: OK false negative chance: 0.000 # git bisect bad 037266a5f7239ead1530266f7d7af153d2a867fa Bisecting: 514 revisions left to test after this (roughly 9 steps) [e1d809b3c5d1d9988350755454747a105dad331b] Merge tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound determine whether the revision contains the guilty commit revision 6bc986ab839c844e78a2333a02e55f02c9e57935 crashed and is reachable testing commit e1d809b3c5d1d9988350755454747a105dad331b gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 917137d6609b5bcd79edda939938fc28d1ad32ae5af6ce72f1ee38c18bdf090f all runs: OK false negative chance: 0.000 # git bisect bad e1d809b3c5d1d9988350755454747a105dad331b Bisecting: 270 revisions left to test after this (roughly 8 steps) [3b220413438184b352b297e7cf593fa56999b5b3] Merge tag 'v6.7-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 determine whether the revision contains the guilty commit revision 6bc986ab839c844e78a2333a02e55f02c9e57935 crashed and is reachable testing commit 3b220413438184b352b297e7cf593fa56999b5b3 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 4de055dab8d4faf793cc90b088f9ad53110ceec33e3ff7d37dbe502b7457221b run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_open run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_open run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_open representative crash: BUG: corrupted list in ptp_open, types: [BUG] # git bisect good 3b220413438184b352b297e7cf593fa56999b5b3 Bisecting: 157 revisions left to test after this (roughly 7 steps) [656d88c3b654c0ccc0ff63aa75101c6c9f0a5300] Merge tag 'mips_6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux determine whether the revision contains the guilty commit revision 6bc986ab839c844e78a2333a02e55f02c9e57935 crashed and is reachable testing commit 656d88c3b654c0ccc0ff63aa75101c6c9f0a5300 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f3054460c7436208a152bfcbef546a95e838950a0605f97bfaa57ccc8845bd42 all runs: OK false negative chance: 0.000 # git bisect bad 656d88c3b654c0ccc0ff63aa75101c6c9f0a5300 Bisecting: 56 revisions left to test after this (roughly 6 steps) [caf3100810f4150677f4e1057aa0a29f8a2c3743] drivers/net/ppp: use standard array-copy-function determine whether the revision contains the guilty commit checking the merge base ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 no existing result, test the revision testing commit ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c297eadf3e1bbf5445376f6c60a212884a959ec545ce152a747d407f11233b4a run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_open run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] testing commit caf3100810f4150677f4e1057aa0a29f8a2c3743 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8c93705c74a1f28094a4d334b030978afa9f1dd5f8deee98745442e4261ec55a run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_open run #2: crashed: BUG: corrupted list in ptp_open run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_open run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_open run #8: crashed: BUG: corrupted list in ptp_open run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] # git bisect good caf3100810f4150677f4e1057aa0a29f8a2c3743 Bisecting: 28 revisions left to test after this (roughly 5 steps) [0613736e8ab91e7f338d4021a8b57b124dc49bd4] Merge tag 'nf-23-11-08' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf determine whether the revision contains the guilty commit revision ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 crashed and is reachable testing commit 0613736e8ab91e7f338d4021a8b57b124dc49bd4 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6e440d6ce6f89d6c73b0d750d784fb56f2562b935350483b4fa6345edba4c28c run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_open run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_open run #5: crashed: BUG: corrupted list in ptp_open run #6: crashed: BUG: corrupted list in ptp_open run #7: crashed: BUG: corrupted list in ptp_open run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] # git bisect good 0613736e8ab91e7f338d4021a8b57b124dc49bd4 Bisecting: 14 revisions left to test after this (roughly 4 steps) [4b7d3ab445653336db9854eedad812607760c015] MIPS: AR7: remove platform determine whether the revision contains the guilty commit checking the merge base 8a749fd1a8720d4619c91c8b6e7528c0a355c0aa no existing result, test the revision testing commit 8a749fd1a8720d4619c91c8b6e7528c0a355c0aa gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 57e59e277ef91e3d8aa83635033c0148d5b8e29455723baffb832ae70e7f58c0 all runs: OK false negative chance: 0.000 the bug was not introduced yet; pretend that kernel crashed # git bisect good 4b7d3ab445653336db9854eedad812607760c015 Bisecting: 9 revisions left to test after this (roughly 3 steps) [f1a3b283f852c613fae004f87bbbacc8cef5a061] net_sched: sch_fq: better validate TCA_FQ_WEIGHTS and TCA_FQ_PRIOMAP determine whether the revision contains the guilty commit revision ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 crashed and is reachable testing commit f1a3b283f852c613fae004f87bbbacc8cef5a061 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1b283fba1cd8ae18e140f282bdf086f5f8abfd7c3c38311c2809a2ae2f6feef5 run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_open, types: [BUG] # git bisect good f1a3b283f852c613fae004f87bbbacc8cef5a061 Bisecting: 4 revisions left to test after this (roughly 2 steps) [9b818a340c0024f8b8f36a5f8e8b4eea3afa9a77] Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue determine whether the revision contains the guilty commit revision ff269e2cd5adce4ae14f883fc9c8803bc43ee1e9 crashed and is reachable testing commit 9b818a340c0024f8b8f36a5f8e8b4eea3afa9a77 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8b0681125662eff7f7804b118bdadb84d40415a21abc5154023bd99de04e2d9d run #0: crashed: BUG: corrupted list in ptp_open run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_open run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_release run #6: crashed: BUG: corrupted list in ptp_open run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_open, types: [BUG] # git bisect good 9b818a340c0024f8b8f36a5f8e8b4eea3afa9a77 Bisecting: 2 revisions left to test after this (roughly 1 step) [1bea2c3e6df8caf45d18384abfb707f47e9ff993] ptp: fix corrupted list in ptp_open determine whether the revision contains the guilty commit revision caf3100810f4150677f4e1057aa0a29f8a2c3743 crashed and is reachable testing commit 1bea2c3e6df8caf45d18384abfb707f47e9ff993 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 698190a617df6ec626d535eb3e32fcf7abef73e38de5e2feab20f54712ab9ee4 all runs: OK false negative chance: 0.000 # git bisect bad 1bea2c3e6df8caf45d18384abfb707f47e9ff993 Bisecting: 0 revisions left to test after this (roughly 0 steps) [b714ca2ccf6a90733f6ceb14abb6ce914f8832c3] ptp: ptp_read should not release queue determine whether the revision contains the guilty commit revision f1a3b283f852c613fae004f87bbbacc8cef5a061 crashed and is reachable testing commit b714ca2ccf6a90733f6ceb14abb6ce914f8832c3 gcc compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1aa112e65c4364e1b2ea066865ce5d9df6152bf6941554fe7e0978e87a7e642a run #0: crashed: BUG: corrupted list in ptp_release run #1: crashed: BUG: corrupted list in ptp_release run #2: crashed: BUG: corrupted list in ptp_release run #3: crashed: BUG: corrupted list in ptp_release run #4: crashed: BUG: corrupted list in ptp_release run #5: crashed: BUG: corrupted list in ptp_open run #6: crashed: BUG: corrupted list in ptp_release run #7: crashed: BUG: corrupted list in ptp_release run #8: crashed: BUG: corrupted list in ptp_release run #9: crashed: BUG: corrupted list in ptp_release representative crash: BUG: corrupted list in ptp_release, types: [BUG] # git bisect good b714ca2ccf6a90733f6ceb14abb6ce914f8832c3 1bea2c3e6df8caf45d18384abfb707f47e9ff993 is the first bad commit commit 1bea2c3e6df8caf45d18384abfb707f47e9ff993 Author: Edward Adam Davis Date: Tue Nov 7 16:00:41 2023 +0800 ptp: fix corrupted list in ptp_open There is no lock protection when writing ptp->tsevqs in ptp_open() and ptp_release(), which can cause data corruption, use spin lock to avoid this issue. Moreover, ptp_release() should not be used to release the queue in ptp_read(), and it should be deleted altogether. Acked-by: Richard Cochran Reported-and-tested-by: syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com Fixes: 8f5de6fb2453 ("ptp: support multiple timestamp event readers") Signed-off-by: Edward Adam Davis Link: https://lore.kernel.org/r/tencent_CD19564FFE8DA8A5918DFE92325D92DD8107@qq.com Signed-off-by: Jakub Kicinski drivers/ptp/ptp_chardev.c | 21 ++++++++++++--------- drivers/ptp/ptp_clock.c | 8 ++++++-- drivers/ptp/ptp_private.h | 1 + 3 files changed, 19 insertions(+), 11 deletions(-) accumulated error probability: 0.00 culprit signature: 698190a617df6ec626d535eb3e32fcf7abef73e38de5e2feab20f54712ab9ee4 parent signature: 1aa112e65c4364e1b2ea066865ce5d9df6152bf6941554fe7e0978e87a7e642a revisions tested: 20, total time: 6h2m19.3729466s (build: 3h26m55.200968427s, test: 2h19m53.547421869s) first good commit: 1bea2c3e6df8caf45d18384abfb707f47e9ff993 ptp: fix corrupted list in ptp_open recipients (to): ["eadavis@qq.com" "kuba@kernel.org" "richardcochran@gmail.com" "syzbot+df3f3ef31f60781fa911@syzkaller.appspotmail.com"] recipients (cc): []