ci2 starts bisection 2023-01-23 04:02:58.945283985 +0000 UTC m=+185145.793924456 bisecting cause commit starting from 72d681a01da5f02769fd75f229ed2f9276894c4f building syzkaller on cc0f9968db1abe397e6c93bf4f5dff51be20f914 ensuring issue is reproducible on original commit 72d681a01da5f02769fd75f229ed2f9276894c4f testing commit 72d681a01da5f02769fd75f229ed2f9276894c4f gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 35b5723547c879b06ff26c640372352d636da15f4f68304ea41542548f6e0eac run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_fd_cancel run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: crashed: BUG: corrupted list in p9_conn_cancel run #10: crashed: BUG: corrupted list in p9_fd_cancel run #11: crashed: BUG: corrupted list in p9_fd_cancel run #12: crashed: BUG: corrupted list in p9_fd_cancel run #13: crashed: BUG: corrupted list in p9_fd_cancel run #14: crashed: BUG: corrupted list in p9_fd_cancel run #15: crashed: BUG: corrupted list in p9_fd_cancel run #16: crashed: BUG: corrupted list in p9_fd_cancel run #17: crashed: BUG: corrupted list in p9_fd_cancel run #18: crashed: BUG: corrupted list in p9_conn_cancel run #19: crashed: BUG: corrupted list in p9_fd_cancel testing release v5.15.80 testing commit 71e496bd338221709b180b60ba419fa542c2b320 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 31db3960b427250706e697eb7f12d2d791f691c2a03b5b14941600b73cb9cafe run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_fd_cancel run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: OK run #9: OK testing release v5.15.79 testing commit 3df0eeae4d9a547c0f19924952ccb8290582e5d0 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5eefc8e4bacbbcbd783b877b71bc035a9adffa7c6f4bb7fa88a0a0a58f59c952 all runs: OK # git bisect start 71e496bd338221709b180b60ba419fa542c2b320 3df0eeae4d9a547c0f19924952ccb8290582e5d0 Bisecting: 90 revisions left to test after this (roughly 7 steps) [c08c13cb13fa3866dd0700db3b246fcd2043ab81] xen/pcpu: fix possible memory leak in register_pcpu() testing commit c08c13cb13fa3866dd0700db3b246fcd2043ab81 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: b691732f03fa874d0e8c5b7c7c64e896447d1b417c549598042dd80385259a1f all runs: OK # git bisect good c08c13cb13fa3866dd0700db3b246fcd2043ab81 Bisecting: 45 revisions left to test after this (roughly 6 steps) [656f670613662b6cc77aad14112db2803ad18fa8] iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() testing commit 656f670613662b6cc77aad14112db2803ad18fa8 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 7deba3934526d74ce37ccb0492a5b1866231a0d99d7ff94d9c12f1923c576877 all runs: OK # git bisect good 656f670613662b6cc77aad14112db2803ad18fa8 Bisecting: 22 revisions left to test after this (roughly 5 steps) [2ac6276864deb4c6593469deadc7ecec217640a3] serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake testing commit 2ac6276864deb4c6593469deadc7ecec217640a3 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e9432b6ea496172054de5e8f19c63dde0450897c04d2c26a044ad0a73b17f97b all runs: OK # git bisect good 2ac6276864deb4c6593469deadc7ecec217640a3 Bisecting: 11 revisions left to test after this (roughly 4 steps) [27d706b0d394a907ff8c4f83ffef9d3e5817fa84] kcm: avoid potential race in kcm_tx_work testing commit 27d706b0d394a907ff8c4f83ffef9d3e5817fa84 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: faf7d138d77603c2b494339895bb33a5c701e7d6496062a35a181be3f5d4c467 all runs: OK # git bisect good 27d706b0d394a907ff8c4f83ffef9d3e5817fa84 Bisecting: 5 revisions left to test after this (roughly 3 steps) [b334ab4c3347e028f050c17a79ec1bb249aefcd2] wifi: wext: use flex array destination for memcpy() testing commit b334ab4c3347e028f050c17a79ec1bb249aefcd2 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 5c32024d2cc5c1f84f409896ca1d2eac8cbf2b63187afea31047e5f7bcba59a2 run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_fd_cancel run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: general protection fault in p9_conn_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: OK # git bisect bad b334ab4c3347e028f050c17a79ec1bb249aefcd2 Bisecting: 2 revisions left to test after this (roughly 2 steps) [28275a7c84d21c55ab3282d897f284d8d527173c] gfs2: Check sb_bsize_shift after reading superblock testing commit 28275a7c84d21c55ab3282d897f284d8d527173c gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 0da026788482db5ad6928c1df36af61152233542a6ac63d469bc474b6577f875 run #0: crashed: BUG: corrupted list in p9_fd_cancel run #1: crashed: BUG: corrupted list in p9_fd_cancel run #2: crashed: BUG: corrupted list in p9_conn_cancel run #3: crashed: BUG: corrupted list in p9_fd_cancel run #4: crashed: BUG: corrupted list in p9_fd_cancel run #5: crashed: BUG: corrupted list in p9_fd_cancel run #6: crashed: BUG: corrupted list in p9_fd_cancel run #7: crashed: BUG: corrupted list in p9_fd_cancel run #8: crashed: BUG: corrupted list in p9_fd_cancel run #9: crashed: BUG: corrupted list in p9_fd_cancel # git bisect bad 28275a7c84d21c55ab3282d897f284d8d527173c Bisecting: 0 revisions left to test after this (roughly 1 step) [a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd] 9p: trans_fd/p9_conn_cancel: drop client lock earlier testing commit a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 87bcf68c2c9d4ffa396a99f67d5cc6c01e4fb6ed9ac5f87e3a82db5c10aa3a91 all runs: crashed: BUG: corrupted list in p9_fd_cancel # git bisect bad a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd Bisecting: 0 revisions left to test after this (roughly 0 steps) [f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3] kcm: close race conditions on sk_receive_queue testing commit f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3 gcc compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: c66fd4c1dd0e73550a16bbe3e645b92abb41b7ced8c0a8a2609ffda1708bc14b all runs: OK # git bisect good f7b0e95071bb4be4b811af3f0bfc3e200eedeaa3 a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd is the first bad commit commit a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd Author: Dominique Martinet Date: Wed Aug 17 14:58:44 2022 +0900 9p: trans_fd/p9_conn_cancel: drop client lock earlier commit 52f1c45dde9136f964d63a77d19826c8a74e2c7f upstream. syzbot reported a double-lock here and we no longer need this lock after requests have been moved off to local list: just drop the lock earlier. Link: https://lkml.kernel.org/r/20220904064028.1305220-1-asmadeus@codewreck.org Reported-by: syzbot+50f7e8d06c3768dd97f3@syzkaller.appspotmail.com Signed-off-by: Dominique Martinet Tested-by: Schspa Shi Signed-off-by: Greg Kroah-Hartman net/9p/trans_fd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) culprit signature: 87bcf68c2c9d4ffa396a99f67d5cc6c01e4fb6ed9ac5f87e3a82db5c10aa3a91 parent signature: c66fd4c1dd0e73550a16bbe3e645b92abb41b7ced8c0a8a2609ffda1708bc14b revisions tested: 11, total time: 3h15m53.684970903s (build: 1h9m33.709405438s, test: 1h57m53.271118469s) first bad commit: a4f1a01b2e81378fce9ca528d4d8a049e4b58fcd 9p: trans_fd/p9_conn_cancel: drop client lock earlier recipients (to): ["asmadeus@codewreck.org" "gregkh@linuxfoundation.org" "schspa@gmail.com"] recipients (cc): [] crash: BUG: corrupted list in p9_fd_cancel list_del corruption, ffff88812459d6b8->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:55! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 16072 Comm: syz-executor494 Not tainted 5.15.79-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:__list_del_entry_valid+0xf4/0x130 lib/list_debug.c:53 Code: 6b 80 13 02 0f 0b 48 c7 c7 00 ce 05 85 4c 89 f6 31 c0 e8 58 80 13 02 0f 0b 48 c7 c7 60 ce 05 85 4c 89 f6 31 c0 e8 45 80 13 02 <0f> 0b 48 c7 c7 c0 ce 05 85 4c 89 f6 31 c0 e8 32 80 13 02 0f 0b 48 RSP: 0018:ffffc90002407528 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000100 RCX: 57a28e4909713d00 RDX: 1ffff92000480e6c RSI: ffffffff8505ca00 RDI: 0000000000000001 RBP: ffffc90002407548 R08: dffffc0000000000 R09: ffffed103ee465a0 R10: ffffed103ee465a0 R11: 1ffff1103ee4659f R12: dffffc0000000000 R13: ffff88812459d640 R14: ffff88812459d6b8 R15: dead000000000122 FS: 00007fafd4b62700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe39b7e7c0 CR3: 000000012196d000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:132 [inline] list_del include/linux/list.h:146 [inline] p9_fd_cancel+0x55/0x1d0 net/9p/trans_fd.c:700 p9_client_rpc+0x361/0x900 net/9p/client.c:778 p9_client_version+0x168/0x5c0 p9_client_create+0x786/0xa20 net/9p/client.c:1047 v9fs_session_init+0x1e9/0x1500 fs/9p/v9fs.c:409 v9fs_mount+0x70/0x750 fs/9p/vfs_super.c:126 legacy_get_tree+0xe7/0x180 fs/fs_context.c:610 vfs_get_tree+0x7e/0x220 fs/super.c:1499 do_new_mount+0x1df/0x930 fs/namespace.c:2994 path_mount+0x677/0xd00 fs/namespace.c:3324 do_mount fs/namespace.c:3337 [inline] __do_sys_mount fs/namespace.c:3545 [inline] __se_sys_mount+0x24a/0x2e0 fs/namespace.c:3522 __x64_sys_mount+0xba/0xd0 fs/namespace.c:3522 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fafd4bb10c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fafd4b62278 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fafd4c3a4c0 RCX: 00007fafd4bb10c9 RDX: 0000000020000200 RSI: 0000000020000000 RDI: 0000000000000000 RBP: 00007fafd4c071d4 R08: 0000000020000380 R09: 65732f636f72702f R10: 0000000000000000 R11: 0000000000000246 R12: 0031656c69662f2e R13: 00007fafd4b62280 R14: 64663d736e617274 R15: 00007fafd4c3a4c8 Modules linked in: ---[ end trace f9c38cabff9b9b07 ]--- RIP: 0010:__list_del_entry_valid+0xf4/0x130 lib/list_debug.c:53 Code: 6b 80 13 02 0f 0b 48 c7 c7 00 ce 05 85 4c 89 f6 31 c0 e8 58 80 13 02 0f 0b 48 c7 c7 60 ce 05 85 4c 89 f6 31 c0 e8 45 80 13 02 <0f> 0b 48 c7 c7 c0 ce 05 85 4c 89 f6 31 c0 e8 32 80 13 02 0f 0b 48 RSP: 0018:ffffc90002407528 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000100 RCX: 57a28e4909713d00 RDX: 1ffff92000480e6c RSI: ffffffff8505ca00 RDI: 0000000000000001 RBP: ffffc90002407548 R08: dffffc0000000000 R09: ffffed103ee465a0 R10: ffffed103ee465a0 R11: 1ffff1103ee4659f R12: dffffc0000000000 R13: ffff88812459d640 R14: ffff88812459d6b8 R15: dead000000000122 FS: 00007fafd4b62700(0000) GS:ffff8881f7200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe39b7e7c0 CR3: 000000012196d000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400