bisecting cause commit starting from 9d1bc24b52fb8c5d859f9a47084bf1179470e04c building syzkaller on 429efa16d6ca7fd282a93c614ef97612f9c9bf62 testing commit 9d1bc24b52fb8c5d859f9a47084bf1179470e04c with gcc (GCC) 8.1.0 run #0: crashed: WARNING: refcount bug in nr_insert_socket run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: OK # git bisect start 9d1bc24b52fb8c5d859f9a47084bf1179470e04c v5.1 Bisecting: 6873 revisions left to test after this (roughly 13 steps) [a2d635decbfa9c1e4ae15cb05b68b2559f7f827c] Merge tag 'drm-next-2019-05-09' of git://anongit.freedesktop.org/drm/drm testing commit a2d635decbfa9c1e4ae15cb05b68b2559f7f827c with gcc (GCC) 8.1.0 run #0: OK run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: boot failed: WARNING: workqueue cpumask: online intersect > possible intersect # git bisect good a2d635decbfa9c1e4ae15cb05b68b2559f7f827c Bisecting: 3693 revisions left to test after this (roughly 12 steps) [22c58fd70ca48a29505922b1563826593b08cc00] Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit 22c58fd70ca48a29505922b1563826593b08cc00 with gcc (GCC) 8.1.0 run #0: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/tmp/syz-executor605363283" "root@10.128.15.201:./syz-executor605363283"]: exit status 1 ssh: connect to host 10.128.15.201 port 22: Connection timed out lost connection run #1: basic kernel testing failed: failed to copy test binary to VM: failed to run ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "-i" "/syzkaller/jobs/linux/workdir/image/key" "/tmp/syz-executor889725846" "root@10.128.1.25:./syz-executor889725846"]: exit status 1 ssh: connect to host 10.128.1.25 port 22: Connection timed out lost connection run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect good 22c58fd70ca48a29505922b1563826593b08cc00 Bisecting: 1846 revisions left to test after this (roughly 11 steps) [7fbc78e3155a0c464bd832efc07fb3c2355fe9bd] Merge tag 'for-linus-20190524' of git://git.kernel.dk/linux-block testing commit 7fbc78e3155a0c464bd832efc07fb3c2355fe9bd with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7fbc78e3155a0c464bd832efc07fb3c2355fe9bd Bisecting: 921 revisions left to test after this (roughly 10 steps) [9331b6740f86163908de69f4008e434fe0c27691] Merge tag 'spdx-5.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core testing commit 9331b6740f86163908de69f4008e434fe0c27691 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9331b6740f86163908de69f4008e434fe0c27691 Bisecting: 460 revisions left to test after this (roughly 9 steps) [fdbf6326912d578a31ac4ca0933c919eadf1d54c] net/af_iucv: remove GFP_DMA restriction for HiperTransport testing commit fdbf6326912d578a31ac4ca0933c919eadf1d54c with gcc (GCC) 8.1.0 all runs: OK # git bisect good fdbf6326912d578a31ac4ca0933c919eadf1d54c Bisecting: 230 revisions left to test after this (roughly 8 steps) [0728f6c3cab107f0aab2c8ded1292dd2cc41a228] Merge tag 'drm-fixes-2019-06-21' of git://anongit.freedesktop.org/drm/drm testing commit 0728f6c3cab107f0aab2c8ded1292dd2cc41a228 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 0728f6c3cab107f0aab2c8ded1292dd2cc41a228 Bisecting: 114 revisions left to test after this (roughly 7 steps) [fe2da896fd9469317ff693fb08a86d9c435e101a] Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit fe2da896fd9469317ff693fb08a86d9c435e101a with gcc (GCC) 8.1.0 all runs: OK # git bisect good fe2da896fd9469317ff693fb08a86d9c435e101a Bisecting: 57 revisions left to test after this (roughly 6 steps) [3c91f25c2f72ba6001775a5932857c1d2131c531] bnx2x: Prevent ptp_task to be rescheduled indefinitely testing commit 3c91f25c2f72ba6001775a5932857c1d2131c531 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 3c91f25c2f72ba6001775a5932857c1d2131c531 Bisecting: 28 revisions left to test after this (roughly 5 steps) [3d26eb8ad1e9b906433903ce05f775cf038e747f] net: bridge: don't cache ether dest pointer on input testing commit 3d26eb8ad1e9b906433903ce05f775cf038e747f with gcc (GCC) 8.1.0 run #0: crashed: WARNING: refcount bug in nr_insert_socket run #1: crashed: WARNING: refcount bug in nr_insert_socket run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 3d26eb8ad1e9b906433903ce05f775cf038e747f Bisecting: 14 revisions left to test after this (roughly 4 steps) [4d1415811e492d9a8238f8a92dd0d51612c788e9] sctp: fix error handling on stream scheduler initialization testing commit 4d1415811e492d9a8238f8a92dd0d51612c788e9 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: refcount bug in nr_insert_socket run #1: crashed: WARNING: refcount bug in nr_insert_socket run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 4d1415811e492d9a8238f8a92dd0d51612c788e9 Bisecting: 6 revisions left to test after this (roughly 3 steps) [22506f488e6b7adf14b008ed241c69e3918886e6] Merge branch 'bnxt_en-Bug-fixes' testing commit 22506f488e6b7adf14b008ed241c69e3918886e6 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 22506f488e6b7adf14b008ed241c69e3918886e6 Bisecting: 3 revisions left to test after this (roughly 2 steps) [40f6a2cb9cfc5da713f745b23bcc2c6761e5eb5e] net: dst.h: Fix shifting signed 32-bit value by 31 bits problem testing commit 40f6a2cb9cfc5da713f745b23bcc2c6761e5eb5e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 40f6a2cb9cfc5da713f745b23bcc2c6761e5eb5e Bisecting: 1 revision left to test after this (roughly 1 step) [2e60546368165c2449564d71f6005dda9205b5fb] ipv4: don't set IPv6 only flags to IPv4 addresses testing commit 2e60546368165c2449564d71f6005dda9205b5fb with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2e60546368165c2449564d71f6005dda9205b5fb Bisecting: 0 revisions left to test after this (roughly 0 steps) [c8c8218ec5af5d2598381883acbefbf604e56b5e] netrom: fix a memory leak in nr_rx_frame() testing commit c8c8218ec5af5d2598381883acbefbf604e56b5e with gcc (GCC) 8.1.0 run #0: crashed: WARNING: refcount bug in nr_insert_socket run #1: crashed: WARNING: refcount bug in nr_insert_socket run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad c8c8218ec5af5d2598381883acbefbf604e56b5e c8c8218ec5af5d2598381883acbefbf604e56b5e is the first bad commit commit c8c8218ec5af5d2598381883acbefbf604e56b5e Author: Cong Wang Date: Thu Jun 27 14:30:58 2019 -0700 netrom: fix a memory leak in nr_rx_frame() When the skb is associated with a new sock, just assigning it to skb->sk is not sufficient, we have to set its destructor to free the sock properly too. Reported-by: syzbot+d6636a36d3c34bd88938@syzkaller.appspotmail.com Signed-off-by: Cong Wang Signed-off-by: David S. Miller :040000 040000 4c07dae2c063172c527c8acf843b916a275a70ce 1c43141d5e0b704990d869e2ed626126f1596f0b M net revisions tested: 16, total time: 4h32m7.09202955s (build: 1h30m5.511677838s, test: 2h56m51.262277283s) first bad commit: c8c8218ec5af5d2598381883acbefbf604e56b5e netrom: fix a memory leak in nr_rx_frame() cc: ["davem@davemloft.net" "linux-hams@vger.kernel.org" "linux-kernel@vger.kernel.org" "netdev@vger.kernel.org" "ralf@linux-mips.org" "xiyou.wangcong@gmail.com"] crash: WARNING: refcount bug in nr_insert_socket ------------[ cut here ]------------ refcount_t: increment on 0; use-after-free. WARNING: CPU: 1 PID: 7289 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30 lib/refcount.c:156 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 7289 Comm: udevd Not tainted 5.2.0-rc6+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 panic+0x212/0x4cb kernel/panic.c:219 __warn.cold.8+0x1b/0x38 kernel/panic.c:576 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:179 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:291 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986 RIP: 0010:refcount_inc_checked+0x2b/0x30 lib/refcount.c:156 Code: 48 89 e5 e8 97 fe ff ff 84 c0 74 02 5d c3 80 3d c3 b1 f2 05 00 75 f5 48 c7 c7 40 51 41 87 c6 05 b3 b1 f2 05 01 e8 b8 a9 3d fe <0f> 0b 5d c3 90 55 48 89 e5 41 56 41 55 49 89 fd 48 c7 c7 a0 51 41 RSP: 0018:ffff8880aeb09c10 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880988bb500 RCX: 0000000000000000 RDX: 0000000000000004 RSI: ffff888098e7c968 RDI: ffffffff89d55d40 RBP: ffff8880aeb09c10 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880a764ac00 R13: ffff8880988bb568 R14: 000000000000000d R15: ffff8880988bb99e sock_hold include/net/sock.h:649 [inline] sk_add_node include/net/sock.h:701 [inline] nr_insert_socket+0x28/0xd0 net/netrom/af_netrom.c:137 nr_rx_frame+0x160f/0x1f00 net/netrom/af_netrom.c:1023 nr_loopback_timer+0x64/0x120 net/netrom/nr_loopback.c:59 call_timer_fn+0x14d/0x510 kernel/time/timer.c:1322 expire_timers kernel/time/timer.c:1366 [inline] __run_timers kernel/time/timer.c:1685 [inline] run_timer_softirq+0xc6f/0x1330 kernel/time/timer.c:1698 __do_softirq+0x260/0x958 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x13e/0x540 arch/x86/kernel/apic/apic.c:1068 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:806 RIP: 0010:sockfd_lookup_light+0x1/0x150 net/socket.c:491 Code: 8b 55 e8 8b 75 ec e9 64 ff ff ff 89 55 ec e8 a6 ad 7a fc 8b 55 ec eb be 83 c8 ff c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 55 <48> 89 e5 41 57 41 56 41 55 49 89 d5 41 54 53 48 89 f3 48 83 ec 08 RSP: 0018:ffff88808f587d90 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000000 RBX: 1ffff11011eb0fb4 RCX: 0000000000000001 RDX: ffff88808f587dc0 RSI: ffff88808f587e00 RDI: 000000000000000b RBP: ffff88808f587ee8 R08: 0000000000000006 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88808f587ec0 R13: 00007ffebf9d0240 R14: ffff888098e7c0c0 R15: 0000000000000000 __do_sys_sendmsg net/socket.c:2333 [inline] __se_sys_sendmsg net/socket.c:2331 [inline] __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2331 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f386ac46320 Code: 02 48 83 c8 ff eb 8d 48 8b 05 14 7b 2a 00 f7 da 64 89 10 48 83 c8 ff eb c9 90 83 3d d5 d2 2a 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e ba 00 00 48 89 04 24 RSP: 002b:00007ffebf9d01f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f386ac46320 RDX: 0000000000000000 RSI: 00007ffebf9d0240 RDI: 000000000000000b RBP: 0000000000000000 R08: 0000000000000000 R09: 00007ffebf9d4080 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000011729f0 R13: 000000000000009b R14: 0000000000000000 R15: 000000000000000b Kernel Offset: disabled Rebooting in 86400 seconds..