bisecting cause commit starting from 63bdf4284c38a48af21745ceb148a087b190cd21 building syzkaller on 16559f86f52b7da53f9156685e32dde788dbe371 testing commit 63bdf4284c38a48af21745ceb148a087b190cd21 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: OK # git bisect start 63bdf4284c38a48af21745ceb148a087b190cd21 v5.0 Bisecting: 1554 revisions left to test after this (roughly 11 steps) [b7b14ec1ebef35d22f3f4087816468f22c987f75] Merge remote-tracking branch 'net-next/master' into mac80211-next testing commit b7b14ec1ebef35d22f3f4087816468f22c987f75 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue # git bisect bad b7b14ec1ebef35d22f3f4087816468f22c987f75 Bisecting: 802 revisions left to test after this (roughly 10 steps) [77ff2c6b49843b01adef1f80abb091753e4c9c65] mac80211: update HE IEs to D3.3 testing commit 77ff2c6b49843b01adef1f80abb091753e4c9c65 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue # git bisect bad 77ff2c6b49843b01adef1f80abb091753e4c9c65 Bisecting: 375 revisions left to test after this (roughly 9 steps) [bb7c778b73ebf4a62408ed6deafc587aae79d3e2] Merge branch 'qed-Error-recovery-process' testing commit bb7c778b73ebf4a62408ed6deafc587aae79d3e2 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip bb7c778b73ebf4a62408ed6deafc587aae79d3e2 Bisecting: 375 revisions left to test after this (roughly 9 steps) [78c787c21f974fe87a9c4418f57a5f76ba880608] cxgb4/l2t: Use struct_size() in kvzalloc() testing commit 78c787c21f974fe87a9c4418f57a5f76ba880608 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 78c787c21f974fe87a9c4418f57a5f76ba880608 Bisecting: 341 revisions left to test after this (roughly 9 steps) [343917b410ba7250dbbe59a8330feffaf36eaab8] Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next testing commit 343917b410ba7250dbbe59a8330feffaf36eaab8 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip 343917b410ba7250dbbe59a8330feffaf36eaab8 Bisecting: 341 revisions left to test after this (roughly 9 steps) [8b59bfe83cf15f755024e88812e057af7341f525] qed: remove duplicated include from qed_if.h testing commit 8b59bfe83cf15f755024e88812e057af7341f525 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 8b59bfe83cf15f755024e88812e057af7341f525 Bisecting: 341 revisions left to test after this (roughly 8 steps) [9b0732d9ed6f80d712119fa32ff25ae9b09d481e] i40e: Change unmatched function types testing commit 9b0732d9ed6f80d712119fa32ff25ae9b09d481e with gcc (GCC) 8.1.0 all runs: OK # git bisect good 9b0732d9ed6f80d712119fa32ff25ae9b09d481e Bisecting: 264 revisions left to test after this (roughly 8 steps) [ec7146db150082737cbfeacaae0f33e42c95cf18] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit ec7146db150082737cbfeacaae0f33e42c95cf18 with gcc (GCC) 8.1.0 all runs: boot failed: can't ssh into the instance # git bisect skip ec7146db150082737cbfeacaae0f33e42c95cf18 Bisecting: 264 revisions left to test after this (roughly 8 steps) [c1e5786d6771c67fe044c3bcaa23e631e0503261] devlink: Add devlink notifications support for port params testing commit c1e5786d6771c67fe044c3bcaa23e631e0503261 with gcc (GCC) 8.1.0 all runs: OK # git bisect good c1e5786d6771c67fe044c3bcaa23e631e0503261 Bisecting: 133 revisions left to test after this (roughly 7 steps) [d6b0a01faa6aff53f166d1b91541374e9ac6209f] Merge branch 'devlink-add-device-driver-information-API' testing commit d6b0a01faa6aff53f166d1b91541374e9ac6209f with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue # git bisect bad d6b0a01faa6aff53f166d1b91541374e9ac6209f Bisecting: 62 revisions left to test after this (roughly 6 steps) [39ee6e8204b9d4bd46d57ad838fa852f5d293f99] net: hns3: Check for allocation failure testing commit 39ee6e8204b9d4bd46d57ad838fa852f5d293f99 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue # git bisect bad 39ee6e8204b9d4bd46d57ad838fa852f5d293f99 Bisecting: 27 revisions left to test after this (roughly 5 steps) [7efba10d6bd22030fb5931e50bf97496f932f00e] sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt testing commit 7efba10d6bd22030fb5931e50bf97496f932f00e with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in sctp_sched_rr_dequeue # git bisect bad 7efba10d6bd22030fb5931e50bf97496f932f00e Bisecting: 13 revisions left to test after this (roughly 4 steps) [2e7709d1cc665a5dbd079e49809907e9e17a9df3] sctp: use SCTP_FUTURE_ASSOC for SCTP_INTERLEAVING_SUPPORTED sockopt testing commit 2e7709d1cc665a5dbd079e49809907e9e17a9df3 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2e7709d1cc665a5dbd079e49809907e9e17a9df3 Bisecting: 6 revisions left to test after this (roughly 3 steps) [7fb3be13a23697450f3609877c367a3750aba3b5] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_AUTH_KEY sockopt testing commit 7fb3be13a23697450f3609877c367a3750aba3b5 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 7fb3be13a23697450f3609877c367a3750aba3b5 Bisecting: 3 revisions left to test after this (roughly 2 steps) [2af66ff3edc79d225e52821fe2464a4cf0c8ba18] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_AUTH_DEACTIVATE_KEY sockopt testing commit 2af66ff3edc79d225e52821fe2464a4cf0c8ba18 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 2af66ff3edc79d225e52821fe2464a4cf0c8ba18 Bisecting: 1 revision left to test after this (roughly 1 step) [99a62135e127977c06f4c44b6b9f24492a4b2153] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_ENABLE_STREAM_RESET sockopt testing commit 99a62135e127977c06f4c44b6b9f24492a4b2153 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 99a62135e127977c06f4c44b6b9f24492a4b2153 Bisecting: 0 revisions left to test after this (roughly 0 steps) [d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f] sctp: use SCTP_FUTURE_ASSOC and add SCTP_CURRENT_ASSOC for SCTP_EVENT sockopt testing commit d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f with gcc (GCC) 8.1.0 all runs: OK # git bisect good d251f05e3ba2e6ab7f59c88b497facf2f61c5b2f 7efba10d6bd22030fb5931e50bf97496f932f00e is the first bad commit commit 7efba10d6bd22030fb5931e50bf97496f932f00e Author: Xin Long Date: Mon Jan 28 15:08:46 2019 +0800 sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt Check with SCTP_ALL_ASSOC instead in sctp_setsockopt_scheduler and check with SCTP_FUTURE_ASSOC instead in sctp_getsockopt_scheduler, it's compatible with 0. SCTP_CURRENT_ASSOC is supported for SCTP_STREAM_SCHEDULER in this patch. It also adds default_ss in sctp_sock to support SCTP_FUTURE_ASSOC. Signed-off-by: Xin Long Signed-off-by: David S. Miller :040000 040000 16ef8accf213e5387e144504f5c273903d67f728 5f868fb5ef35b662900e15c2d3acbc3332a3e013 M include :040000 040000 a9c295d52a9815d4d4173a74b1858e8028da28af e9a3ca518cda75c8a75990c01e63bc145f5ea574 M net revisions tested: 19, total time: 4h2m51.848169518s (build: 1h31m28.842257654s, test: 2h27m51.884707765s) first bad commit: 7efba10d6bd22030fb5931e50bf97496f932f00e sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt cc: ["davem@davemloft.net" "linux-kernel@vger.kernel.org" "linux-sctp@vger.kernel.org" "lucien.xin@gmail.com" "marcelo.leitner@gmail.com" "netdev@vger.kernel.org" "nhorman@tuxdriver.com" "vyasevich@gmail.com"] crash: general protection fault in sctp_sched_rr_dequeue IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready bridge0: port 2(bridge_slave_1) entered blocking state kasan: CONFIG_KASAN_INLINE enabled bridge0: port 2(bridge_slave_1) entered forwarding state kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN 8021q: adding VLAN 0 to HW filter on device team0 CPU: 0 PID: 7210 Comm: syz-executor.5 Not tainted 5.0.0-rc4+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:sctp_sched_rr_dequeue+0xd3/0x170 net/sctp/stream_sched_rr.c:141 Code: 03 80 3c 02 00 0f 85 a6 00 00 00 4d 8b 65 08 e8 b3 01 ef fa 49 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 56 4d 8b 64 24 30 48 89 df 49 83 ec 18 4c 89 e6 e8 RSP: 0018:ffff888075ff7000 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88801bb3eea0 RCX: ffffffff8678e5df RDX: 0000000000000006 RSI: ffffffff8680e6bd RDI: 0000000000000030 RBP: ffff888075ff7018 R08: ffff888076b86000 R09: 0000000000000002 R10: ffffed1005b05bc7 R11: ffff88802d82de3b R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888075ff7130 8021q: adding VLAN 0 to HW filter on device team0 FS: 00007f51a1303700(0000) GS:ffff88802d800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3634d91000 CR3: 0000000029286000 CR4: 00000000007406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: sctp_outq_dequeue_data net/sctp/outqueue.c:90 [inline] sctp_outq_flush_data net/sctp/outqueue.c:1079 [inline] sctp_outq_flush+0xc6b/0x2750 net/sctp/outqueue.c:1205 sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:772 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline] sctp_do_sm+0x4a4/0x5160 net/sctp/sm_sideeffect.c:1191 hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1074 sctp_inq_push+0x1e8/0x290 net/sctp/inqueue.c:95 sctp_backlog_rcv+0x17e/0xb30 net/sctp/input.c:354 8021q: adding VLAN 0 to HW filter on device batadv0 kobject: 'vlan0' (00000000bbc347a5): kobject_add_internal: parent: 'mesh', set: '' sk_backlog_rcv include/net/sock.h:936 [inline] __release_sock+0x12f/0x390 net/core/sock.c:2309 release_sock+0x59/0x1c0 net/core/sock.c:2825 sctp_wait_for_connect+0x2d7/0x550 net/sctp/socket.c:8998 sctp_sendmsg_to_asoc+0x13b6/0x1720 net/sctp/socket.c:1967 sctp_sendmsg+0x1037/0x17f0 net/sctp/socket.c:2113 inet_sendmsg+0x146/0x5c0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x80e/0x950 net/socket.c:2116 __sys_sendmsg+0x110/0x1f0 net/socket.c:2154 __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg net/socket.c:2161 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161 do_syscall_64+0x103/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457799 Code: 8d b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f51a1302c88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000071bf00 RCX: 0000000000457799 RDX: 0000000000000000 RSI: 000000002001afc8 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000006ec8c8 R14: 00000000004ac101 R15: 00007f51a13036d4 Modules linked in: ---[ end trace 99caa0b93f497e1b ]--- RIP: 0010:sctp_sched_rr_dequeue+0xd3/0x170 net/sctp/stream_sched_rr.c:141 Code: 03 80 3c 02 00 0f 85 a6 00 00 00 4d 8b 65 08 e8 b3 01 ef fa 49 8d 7c 24 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 56 4d 8b 64 24 30 48 89 df 49 83 ec 18 4c 89 e6 e8 RSP: 0018:ffff888075ff7000 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88801bb3eea0 RCX: ffffffff8678e5df RDX: 0000000000000006 RSI: ffffffff8680e6bd RDI: 0000000000000030 RBP: ffff888075ff7018 R08: ffff888076b86000 R09: 0000000000000002 R10: ffffed1005b05bc7 R11: ffff88802d82de3b R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888075ff7130 FS: 00007f51a1303700(0000) GS:ffff88802d800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3634d91000 CR3: 0000000029286000 CR4: 00000000007406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554