bisecting cause commit starting from d9862cfbe2099deb83f0e9c1932c91f2d9c50464 building syzkaller on d09a902e9d8663c6efcf5ef2ec6e32161d3dea71 testing commit d9862cfbe2099deb83f0e9c1932c91f2d9c50464 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_dequeue_common testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: OK # git bisect start d9862cfbe2099deb83f0e9c1932c91f2d9c50464 v5.0 Bisecting: 1699 revisions left to test after this (roughly 11 steps) [d29d1c4957d4dde1a7578b10f2a2d1fae39bd47a] Merge branch 'AF_PACKET-transport_offset-fix' testing commit d29d1c4957d4dde1a7578b10f2a2d1fae39bd47a with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_dequeue_common # git bisect bad d29d1c4957d4dde1a7578b10f2a2d1fae39bd47a Bisecting: 818 revisions left to test after this (roughly 10 steps) [77ff2c6b49843b01adef1f80abb091753e4c9c65] mac80211: update HE IEs to D3.3 testing commit 77ff2c6b49843b01adef1f80abb091753e4c9c65 with gcc (GCC) 8.1.0 run #0: crashed: general protection fault in sctp_sched_dequeue_common run #1: crashed: general protection fault in sctp_sched_dequeue_common run #2: crashed: general protection fault in sctp_sched_dequeue_common run #3: crashed: general protection fault in corrupted run #4: crashed: general protection fault in sctp_sched_dequeue_common run #5: crashed: general protection fault in sctp_sched_dequeue_common run #6: crashed: general protection fault in sctp_sched_dequeue_common run #7: crashed: general protection fault in sctp_sched_dequeue_common # git bisect bad 77ff2c6b49843b01adef1f80abb091753e4c9c65 Bisecting: 375 revisions left to test after this (roughly 9 steps) [bb7c778b73ebf4a62408ed6deafc587aae79d3e2] Merge branch 'qed-Error-recovery-process' testing commit bb7c778b73ebf4a62408ed6deafc587aae79d3e2 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip bb7c778b73ebf4a62408ed6deafc587aae79d3e2 Bisecting: 375 revisions left to test after this (roughly 9 steps) [78c787c21f974fe87a9c4418f57a5f76ba880608] cxgb4/l2t: Use struct_size() in kvzalloc() testing commit 78c787c21f974fe87a9c4418f57a5f76ba880608 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 78c787c21f974fe87a9c4418f57a5f76ba880608 Bisecting: 341 revisions left to test after this (roughly 9 steps) [343917b410ba7250dbbe59a8330feffaf36eaab8] Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next testing commit 343917b410ba7250dbbe59a8330feffaf36eaab8 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip 343917b410ba7250dbbe59a8330feffaf36eaab8 Bisecting: 341 revisions left to test after this (roughly 9 steps) [8b59bfe83cf15f755024e88812e057af7341f525] qed: remove duplicated include from qed_if.h testing commit 8b59bfe83cf15f755024e88812e057af7341f525 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8b59bfe83cf15f755024e88812e057af7341f525 Bisecting: 341 revisions left to test after this (roughly 8 steps) [9b0732d9ed6f80d712119fa32ff25ae9b09d481e] i40e: Change unmatched function types testing commit 9b0732d9ed6f80d712119fa32ff25ae9b09d481e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9b0732d9ed6f80d712119fa32ff25ae9b09d481e Bisecting: 264 revisions left to test after this (roughly 8 steps) [ec7146db150082737cbfeacaae0f33e42c95cf18] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit ec7146db150082737cbfeacaae0f33e42c95cf18 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip ec7146db150082737cbfeacaae0f33e42c95cf18 Bisecting: 264 revisions left to test after this (roughly 8 steps) [c1e5786d6771c67fe044c3bcaa23e631e0503261] devlink: Add devlink notifications support for port params testing commit c1e5786d6771c67fe044c3bcaa23e631e0503261 with gcc (GCC) 8.1.0 all runs: OK # git bisect good c1e5786d6771c67fe044c3bcaa23e631e0503261 Bisecting: 133 revisions left to test after this (roughly 7 steps) [d6b0a01faa6aff53f166d1b91541374e9ac6209f] Merge branch 'devlink-add-device-driver-information-API' testing commit d6b0a01faa6aff53f166d1b91541374e9ac6209f with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_dequeue_common # git bisect bad d6b0a01faa6aff53f166d1b91541374e9ac6209f Bisecting: 62 revisions left to test after this (roughly 6 steps) [39ee6e8204b9d4bd46d57ad838fa852f5d293f99] net: hns3: Check for allocation failure testing commit 39ee6e8204b9d4bd46d57ad838fa852f5d293f99 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_dequeue_common # git bisect bad 39ee6e8204b9d4bd46d57ad838fa852f5d293f99 Bisecting: 27 revisions left to test after this (roughly 5 steps) [7efba10d6bd22030fb5931e50bf97496f932f00e] sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt testing commit 7efba10d6bd22030fb5931e50bf97496f932f00e with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_dequeue_common # git bisect bad 7efba10d6bd22030fb5931e50bf97496f932f00e Bisecting: 13 revisions left to test after this (roughly 4 steps) [2e7709d1cc665a5dbd079e49809907e9e17a9df3] sctp: use SCTP_FUTURE_ASSOC for SCTP_INTERLEAVING_SUPPORTED sockopt testing commit 2e7709d1cc665a5dbd079e49809907e9e17a9df3 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2e7709d1cc665a5dbd079e49809907e9e17a9df3 Bisecting: 6 revisions left to test after this (roughly 3 steps) [7fb3be13a23697450f3609877c367a3750aba3b5] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_AUTH_KEY sockopt testing commit 7fb3be13a23697450f3609877c367a3750aba3b5 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7fb3be13a23697450f3609877c367a3750aba3b5 Bisecting: 3 revisions left to test after this (roughly 2 steps) [2af66ff3edc79d225e52821fe2464a4cf0c8ba18] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_AUTH_DEACTIVATE_KEY sockopt testing commit 2af66ff3edc79d225e52821fe2464a4cf0c8ba18 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2af66ff3edc79d225e52821fe2464a4cf0c8ba18 Bisecting: 1 revision left to test after this (roughly 1 step) [99a62135e127977c06f4c44b6b9f24492a4b2153] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_ENABLE_STREAM_RESET sockopt testing commit 99a62135e127977c06f4c44b6b9f24492a4b2153 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 99a62135e127977c06f4c44b6b9f24492a4b2153 Bisecting: 0 revisions left to test after this (roughly 0 steps) [d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_EVENT sockopt testing commit d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f with gcc (GCC) 8.1.0 all runs: OK # git bisect good d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f 7efba10d6bd22030fb5931e50bf97496f932f00e is the first bad commit commit 7efba10d6bd22030fb5931e50bf97496f932f00e Author: Xin Long Date: Mon Jan 28 15:08:46 2019 +0800 sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt Check with SCTP_ALL_ASSOC instead in sctp_setsockopt_scheduler and check with SCTP_FUTURE_ASSOC instead in sctp_getsockopt_scheduler, it's compatible with 0. SCTP_CURRENT_ASSOC is supported for SCTP_STREAM_SCHEDULER in this patch. It also adds default_ss in sctp_sock to support SCTP_FUTURE_ASSOC. Signed-off-by: Xin Long Signed-off-by: David S. Miller :040000 040000 16ef8accf213e5387e144504f5c273903d67f728 5f868fb5ef35b662900e15c2d3acbc3332a3e013 M include :040000 040000 a9c295d52a9815d4d4173a74b1858e8028da28af e9a3ca518cda75c8a75990c01e63bc145f5ea574 M net revisions tested: 19, total time: 4h6m58.549845797s (build: 1h40m29.716158801s, test: 2h22m7.757257275s) first bad commit: 7efba10d6bd22030fb5931e50bf97496f932f00e sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt cc: ["davem@davemloft.net" "linux-kernel@vger.kernel.org" "linux-sctp@vger.kernel.org" "lucien.xin@gmail.com" "marcelo.leitner@gmail.com" "netdev@vger.kernel.org" "nhorman@tuxdriver.com" "vyasevich@gmail.com"] crash: general protection fault in sctp_sched_dequeue_common IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready kasan: CONFIG_KASAN_INLINE enabled IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready kasan: GPF could be caused by NULL-ptr deref or user memory access IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready general protection fault: 0000 [#1] PREEMPT SMP KASAN IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready CPU: 0 PID: 7041 Comm: syz-executor.5 Not tainted 5.0.0-rc4+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:__list_del_entry_valid+0x84/0xf3 lib/list_debug.c:51 Code: 0f 84 cc 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 a5 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 5f 49 8b 14 24 48 39 da 0f 85 ba 00 00 00 49 8d 7d RSP: 0018:ffff888072d8ef98 EFLAGS: 00010247 RAX: dffffc0000000000 RBX: ffff88802ab7cd90 RCX: ffffffff8678b5df IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready RDX: 0000000000000000 RSI: ffffffff86807fb0 RDI: ffff88802ab7cd98 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready RBP: ffff888072d8efb0 R08: ffff88807a4ca000 R09: 0000000000000002 IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready R10: ffffed1005b05bc7 R11: ffff88802d82de3b R12: 0000000000000006 R13: 0000000100000000 R14: 0000000000000000 R15: ffff888072d8f130 FS: 00007fe490d09700(0000) GS:ffff88802d800000(0000) knlGS:0000000000000000 kasan: CONFIG_KASAN_INLINE enabled CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a5213d518 CR3: 0000000023d93000 CR4: 00000000007406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 kasan: GPF could be caused by NULL-ptr deref or user memory access DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:159 [inline] sctp_sched_dequeue_common+0x28/0x340 net/sctp/stream_sched.c:267 sctp_sched_prio_dequeue+0xed/0x1a0 net/sctp/stream_sched_prio.c:283 sctp_outq_dequeue_data net/sctp/outqueue.c:90 [inline] sctp_outq_flush_data net/sctp/outqueue.c:1079 [inline] sctp_outq_flush+0xc6b/0x2750 net/sctp/outqueue.c:1205 sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:772 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline] sctp_do_sm+0x4a4/0x5160 net/sctp/sm_sideeffect.c:1191 sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1074 sctp_inq_push+0x1e8/0x290 net/sctp/inqueue.c:95 sctp_backlog_rcv+0x17e/0xb30 net/sctp/input.c:354 sk_backlog_rcv include/net/sock.h:936 [inline] __release_sock+0x12f/0x390 net/core/sock.c:2309 release_sock+0x59/0x1c0 net/core/sock.c:2825 sctp_wait_for_connect+0x2d7/0x550 net/sctp/socket.c:8998 sctp_sendmsg_to_asoc+0x13b6/0x1720 net/sctp/socket.c:1967 sctp_sendmsg+0x1037/0x17f0 net/sctp/socket.c:2113 inet_sendmsg+0x146/0x5c0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x80e/0x950 net/socket.c:2116 __sys_sendmsg+0x110/0x1f0 net/socket.c:2154 __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg net/socket.c:2161 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161 do_syscall_64+0x103/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457799 Code: 8d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fe490d08c88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000071bf00 RCX: 0000000000457799 RDX: 0000000000000000 RSI: 000000002001afc8 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000006ec8c8 R14: 00000000004ac101 R15: 00007fe490d096d4 Modules linked in: general protection fault: 0000 [#2] PREEMPT SMP KASAN CPU: 1 PID: 7044 Comm: syz-executor.2 Tainted: G D 5.0.0-rc4+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:__list_del_entry_valid+0x84/0xf3 lib/list_debug.c:51 Code: 0f 84 cc 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 a5 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 5f 49 8b 14 24 48 39 da 0f 85 ba 00 00 00 49 8d 7d RSP: 0018:ffff888077e0ef98 EFLAGS: 00010247 ---[ end trace 3844bedd0ab6328b ]--- RAX: dffffc0000000000 RBX: ffff888077caa1d0 RCX: ffffffff8678b5df RDX: 0000000000000000 RSI: ffffffff86807fb0 RDI: ffff888077caa1d8 RIP: 0010:__list_del_entry_valid+0x84/0xf3 lib/list_debug.c:51 RBP: ffff888077e0efb0 R08: ffff888078270000 R09: 0000000000000000 R10: ffffed100f07b94f R11: ffff888078270000 R12: 0000000000000006 R13: 0000000100000000 R14: 0000000000000000 R15: ffff888077e0f130 FS: 00007f7ca2584700(0000) GS:ffff88807ea00000(0000) knlGS:0000000000000000 Code: 0f 84 cc 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f 84 a5 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75 5f 49 8b 14 24 48 39 da 0f 85 ba 00 00 00 49 8d 7d CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0e57fd7190 CR3: 000000007d918000 CR4: 00000000007406e0 RSP: 0018:ffff888072d8ef98 EFLAGS: 00010247 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 RAX: dffffc0000000000 RBX: ffff88802ab7cd90 RCX: ffffffff8678b5df DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: RDX: 0000000000000000 RSI: ffffffff86807fb0 RDI: ffff88802ab7cd98 __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:159 [inline] sctp_sched_dequeue_common+0x28/0x340 net/sctp/stream_sched.c:267 RBP: ffff888072d8efb0 R08: ffff88807a4ca000 R09: 0000000000000002 sctp_sched_prio_dequeue+0xed/0x1a0 net/sctp/stream_sched_prio.c:283 R10: ffffed1005b05bc7 R11: ffff88802d82de3b R12: 0000000000000006 sctp_outq_dequeue_data net/sctp/outqueue.c:90 [inline] sctp_outq_flush_data net/sctp/outqueue.c:1079 [inline] sctp_outq_flush+0xc6b/0x2750 net/sctp/outqueue.c:1205 R13: 0000000100000000 R14: 0000000000000000 R15: ffff888072d8f130 FS: 00007fe490d09700(0000) GS:ffff88802d800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:772 CR2: 00007f7a52787000 CR3: 0000000023d93000 CR4: 00000000007406f0 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline] sctp_do_sm+0x4a4/0x5160 net/sctp/sm_sideeffect.c:1191 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554