bisecting cause commit starting from 406715df933ad6a1b8b0545e7689aa5f4ac27922 building syzkaller on d0686497a9ccb558957ad69ffc9577dd80031b29 testing commit 406715df933ad6a1b8b0545e7689aa5f4ac27922 with gcc (GCC) 8.1.0 all runs: crashed: WARNING: refcount bug in smc_release testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: OK # git bisect start v5.2 v5.1 Bisecting: 6966 revisions left to test after this (roughly 13 steps) [a2d635decbfa9c1e4ae15cb05b68b2559f7f827c] Merge tag 'drm-next-2019-05-09' of git://anongit.freedesktop.org/drm/drm testing commit a2d635decbfa9c1e4ae15cb05b68b2559f7f827c with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad a2d635decbfa9c1e4ae15cb05b68b2559f7f827c Bisecting: 4612 revisions left to test after this (roughly 12 steps) [82efe439599439a5e1e225ce5740e6cfb777a7dd] Merge tag 'devicetree-for-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux testing commit 82efe439599439a5e1e225ce5740e6cfb777a7dd with gcc (GCC) 8.1.0 all runs: OK # git bisect good 82efe439599439a5e1e225ce5740e6cfb777a7dd Bisecting: 2416 revisions left to test after this (roughly 11 steps) [b3a5e648f5917ea508ecab9a629028b186d38eae] Merge tag 'tty-5.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty testing commit b3a5e648f5917ea508ecab9a629028b186d38eae with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad b3a5e648f5917ea508ecab9a629028b186d38eae Bisecting: 1097 revisions left to test after this (roughly 10 steps) [0e33d334df1310d0697f2595833f723e5380359c] Merge branch 'libbpf-fixes' testing commit 0e33d334df1310d0697f2595833f723e5380359c with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad 0e33d334df1310d0697f2595833f723e5380359c Bisecting: 548 revisions left to test after this (roughly 9 steps) [4339ef396ab65a61f7f22f36d7ba94b6e9e0939b] net: hns3: add error handler for initializing command queue testing commit 4339ef396ab65a61f7f22f36d7ba94b6e9e0939b with gcc (GCC) 8.1.0 all runs: OK # git bisect good 4339ef396ab65a61f7f22f36d7ba94b6e9e0939b Bisecting: 273 revisions left to test after this (roughly 8 steps) [cea29a70727e7885b3fdf0d266a57818652a89c1] Merge branch 'ipv6-Use-fib6_result-for-fib_lookups' testing commit cea29a70727e7885b3fdf0d266a57818652a89c1 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad cea29a70727e7885b3fdf0d266a57818652a89c1 Bisecting: 137 revisions left to test after this (roughly 7 steps) [38f58c972334833e0e0804a32e8cee8d8d475cb7] netdevsim: move sdev specific bpf debugfs files to sdev dir testing commit 38f58c972334833e0e0804a32e8cee8d8d475cb7 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad 38f58c972334833e0e0804a32e8cee8d8d475cb7 Bisecting: 69 revisions left to test after this (roughly 6 steps) [947e8b595b82d3551750641445d0a97b8f29b536] bpf: explicitly prohibit ctx_{in, out} in non-skb BPF_PROG_TEST_RUN testing commit 947e8b595b82d3551750641445d0a97b8f29b536 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 947e8b595b82d3551750641445d0a97b8f29b536 Bisecting: 34 revisions left to test after this (roughly 5 steps) [1ba9a8951794751ea3bcbcc5df700d42d525a130] ipv6: Only call rt6_check_neigh for nexthop with gateway testing commit 1ba9a8951794751ea3bcbcc5df700d42d525a130 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 1ba9a8951794751ea3bcbcc5df700d42d525a130 Bisecting: 17 revisions left to test after this (roughly 4 steps) [178ca044aa60cb05102148b635cb82f6986451a3] sctp: Make sctp_enqueue_event tak an skb list. testing commit 178ca044aa60cb05102148b635cb82f6986451a3 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 178ca044aa60cb05102148b635cb82f6986451a3 Bisecting: 8 revisions left to test after this (roughly 3 steps) [228bae05be328045e6dfb4d3bf2600e6547c1d13] net/smc: code cleanup smc_listen_work testing commit 228bae05be328045e6dfb4d3bf2600e6547c1d13 with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad 228bae05be328045e6dfb4d3bf2600e6547c1d13 Bisecting: 4 revisions left to test after this (roughly 2 steps) [50717a37db032ce783f50685a73bb2ac68471a5a] net/smc: nonblocking connect rework testing commit 50717a37db032ce783f50685a73bb2ac68471a5a with gcc (GCC) 8.1.0 all runs: crashed: WARNING in smc_unhash_sk # git bisect bad 50717a37db032ce783f50685a73bb2ac68471a5a Bisecting: 1 revision left to test after this (roughly 1 step) [8af9f7291e22d165ea630856da4171a9d5a6ced3] Merge branch 'sctp-skb-list' testing commit 8af9f7291e22d165ea630856da4171a9d5a6ced3 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8af9f7291e22d165ea630856da4171a9d5a6ced3 Bisecting: 0 revisions left to test after this (roughly 0 steps) [6dc400af216a79c10cb082f25a7337bcbf532045] xen-netback: add reference from xenvif to backend_info to facilitate coredump analysis testing commit 6dc400af216a79c10cb082f25a7337bcbf532045 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 6dc400af216a79c10cb082f25a7337bcbf532045 50717a37db032ce783f50685a73bb2ac68471a5a is the first bad commit commit 50717a37db032ce783f50685a73bb2ac68471a5a Author: Ursula Braun Date: Fri Apr 12 12:57:23 2019 +0200 net/smc: nonblocking connect rework For nonblocking sockets move the kernel_connect() from the connect worker into the initial smc_connect part to return kernel_connect() errors other than -EINPROGRESS to user space. Reviewed-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller :040000 040000 a85dd8a64aa44f2f73ddb0317e6d97e9cb681ee2 1faf0e9b56a1e08fc2a888067f8560779c7026fc M net revisions tested: 18, total time: 3h47m5.311103709s (build: 1h42m57.503448964s, test: 1h58m41.200656029s) first bad commit: 50717a37db032ce783f50685a73bb2ac68471a5a net/smc: nonblocking connect rework cc: ["davem@davemloft.net" "kgraul@linux.ibm.com" "linux-kernel@vger.kernel.org" "linux-s390@vger.kernel.org" "netdev@vger.kernel.org" "ubraun@linux.ibm.com"] crash: WARNING in smc_unhash_sk WARNING: CPU: 1 PID: 7005 at include/net/sock.h:666 smc_unhash_sk+0x1b4/0x220 net/smc/af_smc.c:98 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 7005 Comm: syz-executor.2 Not tainted 5.1.0-rc4+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 panic+0x212/0x40b kernel/panic.c:214 __warn.cold.8+0x1b/0x38 kernel/panic.c:571 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:sk_del_node_init include/net/sock.h:666 [inline] RIP: 0010:smc_unhash_sk+0x1b4/0x220 net/smc/af_smc.c:95 Code: 3c 02 00 75 54 48 8b 7b 30 ba ff ff ff ff e8 03 2c b1 fe 4c 89 ef e8 db a1 33 00 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b eb 95 4c 89 e7 e8 40 30 33 fb eb 80 e8 59 30 33 fb e9 bd fe RSP: 0018:ffff8880a92cfd40 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff888090ab8040 RCX: ffffffff86631d5c RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888090ab80c0 RBP: ffff8880a92cfd70 R08: ffffed1012157019 R09: ffffed1012157018 R10: ffffed1012157018 R11: ffff888090ab80c3 R12: ffff888090ab80c0 R13: ffffffff88c93a00 R14: ffff888090ab8068 R15: 0000000000000000 smc_release+0x277/0x6e0 net/smc/af_smc.c:164 __sock_release+0xc2/0x290 net/socket.c:599 sock_close+0x10/0x20 net/socket.c:1247 __fput+0x24f/0x800 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x1a9/0x200 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x407/0x4d0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x413a91 Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 RSP: 002b:00007fff19ad1ec0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413a91 RDX: 0000001b30320000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000001 R08: ffffffffffffffff R09: ffffffffffffffff R10: 00007fff19ad1fa0 R11: 0000000000000293 R12: 000000000075bf20 R13: 000000000000baa0 R14: 00000000007602a0 R15: 000000000075bf2c Kernel Offset: disabled Rebooting in 86400 seconds..