bisecting cause commit starting from 1c6b40509daf5190b1fd2c758649f7df1da4827b building syzkaller on e3f76baaa97f5c1d27a6f49094f0de132592d96e testing commit 1c6b40509daf5190b1fd2c758649f7df1da4827b with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in brnf_exit_net run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: OK # git bisect start 1c6b40509daf5190b1fd2c758649f7df1da4827b v5.1 Bisecting: 10765 revisions left to test after this (roughly 13 steps) [249b08e4e504d4c54eda3453c9c97edbafa51401] elf: init pt_regs pointer later testing commit 249b08e4e504d4c54eda3453c9c97edbafa51401 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 249b08e4e504d4c54eda3453c9c97edbafa51401 Bisecting: 5335 revisions left to test after this (roughly 12 steps) [72d582c5adedf84aeb1bfaac2319e265e8fc8b47] Merge remote-tracking branch 'jc_docs/docs-next' testing commit 72d582c5adedf84aeb1bfaac2319e265e8fc8b47 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 72d582c5adedf84aeb1bfaac2319e265e8fc8b47 Bisecting: 2761 revisions left to test after this (roughly 11 steps) [64c2dedf766cfd065c09126e8293f73927df1957] Merge remote-tracking branch 'amdgpu/drm-next' testing commit 64c2dedf766cfd065c09126e8293f73927df1957 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in brnf_exit_net run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 64c2dedf766cfd065c09126e8293f73927df1957 Bisecting: 1186 revisions left to test after this (roughly 10 steps) [d6480856dd157e2d435e98e05da87005950541af] Merge remote-tracking branch 'net-next/master' testing commit d6480856dd157e2d435e98e05da87005950541af with gcc (GCC) 8.1.0 all runs: OK # git bisect good d6480856dd157e2d435e98e05da87005950541af Bisecting: 596 revisions left to test after this (roughly 9 steps) [72a14e9b23d0a5a68f8504a2ecaf26788a11a14d] Revert "drm/amdgpu: add DRIVER_SYNCOBJ_TIMELINE to amdgpu" testing commit 72a14e9b23d0a5a68f8504a2ecaf26788a11a14d with gcc (GCC) 8.1.0 all runs: OK # git bisect good 72a14e9b23d0a5a68f8504a2ecaf26788a11a14d Bisecting: 275 revisions left to test after this (roughly 8 steps) [3692c9fbdd07785c8c895ecb86c9d349215ee730] Merge remote-tracking branch 'crypto/master' testing commit 3692c9fbdd07785c8c895ecb86c9d349215ee730 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 3692c9fbdd07785c8c895ecb86c9d349215ee730 Bisecting: 137 revisions left to test after this (roughly 7 steps) [7f9c24a0fc436e0745cd3eb9c9b4638b22d710c9] drm/amd/display: 3.2.34 testing commit 7f9c24a0fc436e0745cd3eb9c9b4638b22d710c9 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7f9c24a0fc436e0745cd3eb9c9b4638b22d710c9 Bisecting: 68 revisions left to test after this (roughly 6 steps) [4d7553c3ed2c4614eb030fcf0ed904d639bb687e] drm/ast: Unpin cursor BO during cleanup testing commit 4d7553c3ed2c4614eb030fcf0ed904d639bb687e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 4d7553c3ed2c4614eb030fcf0ed904d639bb687e Bisecting: 34 revisions left to test after this (roughly 5 steps) [eb03e7959c36b1df2cc7c9054e1ee1e821368272] drm/amdgpu: explicitly set mmGDS_VMID0_BASE to 0 testing commit eb03e7959c36b1df2cc7c9054e1ee1e821368272 with gcc (GCC) 8.1.0 all runs: OK # git bisect good eb03e7959c36b1df2cc7c9054e1ee1e821368272 Bisecting: 17 revisions left to test after this (roughly 4 steps) [5ade071ba13e3bb24e3a9d5f8d6a3cf145deeb18] drm: Add atomic variants for bridge enable/disable testing commit 5ade071ba13e3bb24e3a9d5f8d6a3cf145deeb18 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 5ade071ba13e3bb24e3a9d5f8d6a3cf145deeb18 Bisecting: 8 revisions left to test after this (roughly 3 steps) [b9341521700dddea0c5d80d904c2c2f4d100323f] drm/amd/powerplay: Delete a redundant memory setting in vega20_set_default_od8_setttings() testing commit b9341521700dddea0c5d80d904c2c2f4d100323f with gcc (GCC) 8.1.0 all runs: OK # git bisect good b9341521700dddea0c5d80d904c2c2f4d100323f Bisecting: 4 revisions left to test after this (roughly 2 steps) [9f9b25593ab4197318e3621201588ad8cd525c9b] drm/connector: Fix kerneldoc warning in HDR_OUTPUT_METADATA description testing commit 9f9b25593ab4197318e3621201588ad8cd525c9b with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9f9b25593ab4197318e3621201588ad8cd525c9b Bisecting: 2 revisions left to test after this (roughly 1 step) [2454fcea338ad821a39d471bc7db5a58ba41b742] Merge tag 'drm-misc-next-2019-06-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next testing commit 2454fcea338ad821a39d471bc7db5a58ba41b742 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2454fcea338ad821a39d471bc7db5a58ba41b742 Bisecting: 1 revision left to test after this (roughly 1 step) [21a249ca02415cba22e95ede9a71be20a5fe8619] drm/amdgpu: wait to fetch the vbios until after common init testing commit 21a249ca02415cba22e95ede9a71be20a5fe8619 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 21a249ca02415cba22e95ede9a71be20a5fe8619 Bisecting: 0 revisions left to test after this (roughly 0 steps) [b38d37a08ec4b19a9b9ec3a1ff5566781fcae1f1] Merge remote-tracking branch 'drm/drm-next' testing commit b38d37a08ec4b19a9b9ec3a1ff5566781fcae1f1 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in brnf_exit_net run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad b38d37a08ec4b19a9b9ec3a1ff5566781fcae1f1 b38d37a08ec4b19a9b9ec3a1ff5566781fcae1f1 is the first bad commit revisions tested: 17, total time: 5h17m0.945092368s (build: 1h34m34.803066625s, test: 3h37m1.755256316s) first bad commit: b38d37a08ec4b19a9b9ec3a1ff5566781fcae1f1 Merge remote-tracking branch 'drm/drm-next' cc: ["a.hajda@samsung.com" "airlied@linux.ie" "airlied@redhat.com" "alexander.deucher@amd.com" "christian.koenig@amd.com" "daniel@ffwll.ch" "dri-devel@lists.freedesktop.org" "enric.balletbo@collabora.com" "harry.wentland@amd.com" "heiko@sntech.de" "intel-gfx@lists.freedesktop.org" "jani.nikula@linux.intel.com" "jerry.zhang@amd.com" "jonas@kwiboo.se" "joonas.lahtinen@linux.intel.com" "laurent.pinchart@ideasonboard.com" "linux-kernel@vger.kernel.org" "maarten.lankhorst@linux.intel.com" "marc.zyngier@arm.com" "maxime.ripard@bootlin.com" "narmstrong@baylibre.com" "patrik.r.jakobsson@gmail.com" "rodrigo.vivi@intel.com" "sam@ravnborg.org" "sean@poorly.run" "sfr@canb.auug.org.au"] crash: KASAN: use-after-free Read in brnf_exit_net ================================================================== BUG: KASAN: use-after-free in br_netfilter_sysctl_exit_net net/bridge/br_netfilter_hooks.c:1121 [inline] BUG: KASAN: use-after-free in brnf_exit_net+0x2a0/0x2c0 net/bridge/br_netfilter_hooks.c:1141 Read of size 8 at addr ffff88808b86e560 by task kworker/u4:5/3000 CPU: 0 PID: 3000 Comm: kworker/u4:5 Not tainted 5.2.0-rc5+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.5+0x9/0x1ff mm/kasan/report.c:188 __kasan_report.cold.6+0x1b/0x39 mm/kasan/report.c:317 kasan_report+0x12/0x20 mm/kasan/common.c:614 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 br_netfilter_sysctl_exit_net net/bridge/br_netfilter_hooks.c:1121 [inline] brnf_exit_net+0x2a0/0x2c0 net/bridge/br_netfilter_hooks.c:1141 ops_exit_list.isra.5+0x8b/0x120 net/core/net_namespace.c:154 cleanup_net+0x363/0x850 net/core/net_namespace.c:553 process_one_work+0x830/0x16a0 kernel/workqueue.c:2269 worker_thread+0x85/0xb60 kernel/workqueue.c:2415 kthread+0x324/0x3e0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 9066: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc.constprop.8+0xc7/0xd0 mm/kasan/common.c:489 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503 __do_kmalloc mm/slab.c:3660 [inline] __kmalloc+0x15d/0x760 mm/slab.c:3669 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:742 [inline] __register_sysctl_table+0xaa/0xdf0 fs/proc/proc_sysctl.c:1323 register_net_sysctl+0x10/0x20 net/sysctl_net.c:121 br_netfilter_sysctl_init_net net/bridge/br_netfilter_hooks.c:1105 [inline] brnf_init_net+0x334/0x5d0 net/bridge/br_netfilter_hooks.c:1126 ops_init+0x95/0x370 net/core/net_namespace.c:130 setup_net+0x2c1/0x660 net/core/net_namespace.c:316 copy_net_ns+0x199/0x2a0 net/core/net_namespace.c:439 create_new_namespaces+0x487/0x760 kernel/nsproxy.c:103 unshare_nsproxy_namespaces+0x87/0x1a0 kernel/nsproxy.c:202 ksys_unshare+0x31b/0x710 kernel/fork.c:2692 __do_sys_unshare kernel/fork.c:2760 [inline] __se_sys_unshare kernel/fork.c:2758 [inline] __x64_sys_unshare+0x2c/0x40 kernel/fork.c:2758 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kfree+0xcf/0x220 mm/slab.c:3755 __rcu_reclaim kernel/rcu/rcu.h:215 [inline] rcu_do_batch kernel/rcu/tree.c:2092 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2310 [inline] rcu_core+0xc8e/0x1430 kernel/rcu/tree.c:2291 __do_softirq+0x260/0x958 kernel/softirq.c:292 The buggy address belongs to the object at ffff88808b86e540 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 32 bytes inside of 512-byte region [ffff88808b86e540, ffff88808b86e740) The buggy address belongs to the page: page:ffffea00022e1b80 refcount:1 mapcount:0 mapping:ffff8880aa400940 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0001d81dc8 ffffea00027bf648 ffff8880aa400940 raw: 0000000000000000 ffff88808b86e040 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808b86e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808b86e480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88808b86e500: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff88808b86e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808b86e600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================