bisecting cause commit starting from 819d11507f6637731947836e6308f5966d64cf9d building syzkaller on 6caa12e443d9f79aa2df67d44cdc6163eaa1e97f testing commit 819d11507f6637731947836e6308f5966d64cf9d compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4a5034c5138c3760cf2cea0df34b7fd684fb4211b893e6c72357575a4ed2b0cb run #0: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #1: OK run #2: OK run #3: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #4: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #5: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #6: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing release v5.15 testing commit 8bb7eca972ad531c9b149c0a51ab43a417385813 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: 4eda65bb0ed70e64cbdfc7538a5fe842ee4334bbe41999c3960a0fdd3dc02575 run #0: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #1: OK run #2: OK run #3: OK run #4: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #5: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #6: OK run #7: OK run #8: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #9: OK run #10: OK run #11: OK run #12: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #13: OK run #14: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #15: OK run #16: OK run #17: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #18: OK run #19: crashed: KASAN: use-after-free Read in tcp_retransmit_timer testing release v5.14 testing commit 7d2a07b769330c34b4deabeed939325c77a7ec2f compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: fdfe9d68da08535da6f5146b3990d2c60178dfb0664c0fc62d32fedb96568655 all runs: OK # git bisect start 8bb7eca972ad531c9b149c0a51ab43a417385813 7d2a07b769330c34b4deabeed939325c77a7ec2f Bisecting: 6693 revisions left to test after this (roughly 13 steps) warning: unable to access '/syzkaller/.config/git/ignore': Permission denied warning: unable to access '/syzkaller/.config/git/attributes': Permission denied [477f70cd2a67904e04c2c2b9bd0fa2e95222f2f6] Merge tag 'drm-next-2021-08-31-1' of git://anongit.freedesktop.org/drm/drm testing commit 477f70cd2a67904e04c2c2b9bd0fa2e95222f2f6 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: dc5b117db94ea034cf3315296277549648815d051b6cedbd73efd6535d3b136a run #0: crashed: KASAN: use-after-free Read in __d_alloc run #1: crashed: KASAN: use-after-free Read in __d_alloc run #2: crashed: KASAN: use-after-free Read in __d_alloc run #3: crashed: KASAN: use-after-free Read in __d_alloc run #4: OK run #5: crashed: KASAN: use-after-free Read in __d_alloc run #6: OK run #7: crashed: KASAN: use-after-free Read in __d_alloc run #8: crashed: KASAN: use-after-free Read in __d_alloc run #9: crashed: KASAN: use-after-free Read in __d_alloc run #10: crashed: KASAN: use-after-free Read in __d_alloc run #11: crashed: KASAN: use-after-free Read in __d_alloc run #12: crashed: KASAN: use-after-free Read in __d_alloc run #13: OK run #14: OK run #15: crashed: KASAN: use-after-free Read in __d_alloc run #16: OK run #17: OK run #18: OK run #19: OK # git bisect bad 477f70cd2a67904e04c2c2b9bd0fa2e95222f2f6 Bisecting: 3024 revisions left to test after this (roughly 12 steps) warning: unable to access '/syzkaller/.config/git/ignore': Permission denied warning: unable to access '/syzkaller/.config/git/attributes': Permission denied [9e9fb7655ed585da8f468e29221f0ba194a5f613] Merge tag 'net-next-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 9e9fb7655ed585da8f468e29221f0ba194a5f613 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 arch/x86/kernel/setup.c:916:6: error: implicit declaration of function 'acpi_mps_check' [-Werror=implicit-function-declaration] arch/x86/kernel/setup.c:1110:2: error: implicit declaration of function 'acpi_table_upgrade' [-Werror=implicit-function-declaration] arch/x86/kernel/setup.c:1112:2: error: implicit declaration of function 'acpi_boot_table_init' [-Werror=implicit-function-declaration] arch/x86/kernel/setup.c:1120:2: error: implicit declaration of function 'early_acpi_boot_init'; did you mean 'early_cpu_init'? [-Werror=implicit-function-declaration] arch/x86/kernel/setup.c:1162:2: error: implicit declaration of function 'acpi_boot_init' [-Werror=implicit-function-declaration] # git bisect skip 9e9fb7655ed585da8f468e29221f0ba194a5f613 Bisecting: 3024 revisions left to test after this (roughly 12 steps) warning: unable to access '/syzkaller/.config/git/ignore': Permission denied warning: unable to access '/syzkaller/.config/git/attributes': Permission denied [7a47c52142c18a9239c5afea2c9656c68d3f22e7] s390/ccwgroup: Drop if with an always false condition testing commit 7a47c52142c18a9239c5afea2c9656c68d3f22e7 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a55a22c99f323622085c9262e2d9b61b8f101ad2f3e66fac5e7dd3e15f5edeea run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #1: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: crashed: KASAN: use-after-free Read in tcp_retransmit_timer run #19: OK # git bisect bad 7a47c52142c18a9239c5afea2c9656c68d3f22e7 Bisecting: 0 revisions left to test after this (roughly 1 step) warning: unable to access '/syzkaller/.config/git/ignore': Permission denied warning: unable to access '/syzkaller/.config/git/attributes': Permission denied [a7bdb9a9767360c2b4096bbb379e73022b274483] s390/cio: Make struct css_driver::remove return void testing commit a7bdb9a9767360c2b4096bbb379e73022b274483 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a55a22c99f323622085c9262e2d9b61b8f101ad2f3e66fac5e7dd3e15f5edeea run #0: basic kernel testing failed: BUG: sleeping function called from invalid context in lock_sock_nested run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK # git bisect good a7bdb9a9767360c2b4096bbb379e73022b274483 warning: unable to access '/syzkaller/.config/git/attributes': Permission denied 7a47c52142c18a9239c5afea2c9656c68d3f22e7 is the first bad commit commit 7a47c52142c18a9239c5afea2c9656c68d3f22e7 Author: Uwe Kleine-König Date: Tue Jul 13 21:35:20 2021 +0200 s390/ccwgroup: Drop if with an always false condition The driver core only calls a bus remove callback when there is a driver. So dev->driver is never NULL and the check can safely be removed. Reviewed-by: Cornelia Huck Acked-by: Vineeth Vijayan Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20210713193522.1770306-4-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman drivers/s390/cio/ccwgroup.c | 2 -- 1 file changed, 2 deletions(-) culprit signature: a55a22c99f323622085c9262e2d9b61b8f101ad2f3e66fac5e7dd3e15f5edeea parent signature: a55a22c99f323622085c9262e2d9b61b8f101ad2f3e66fac5e7dd3e15f5edeea Reproducer flagged being flaky revisions tested: 6, total time: 1h19m18.303790946s (build: 44m12.726904644s, test: 33m44.755616945s) first bad commit: 7a47c52142c18a9239c5afea2c9656c68d3f22e7 s390/ccwgroup: Drop if with an always false condition recipients (to): ["cohuck@redhat.com" "gregkh@linuxfoundation.org" "u.kleine-koenig@pengutronix.de" "vneethv@linux.ibm.com"] recipients (cc): [] crash: KASAN: use-after-free Read in tcp_retransmit_timer ================================================================== BUG: KASAN: use-after-free in tcp_retransmit_timer+0x291b/0x30e0 net/ipv4/tcp_timer.c:511 Read of size 8 at addr ffff88802b1537d8 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.14.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:436 tcp_retransmit_timer+0x291b/0x30e0 net/ipv4/tcp_timer.c:511 tcp_write_timer_handler+0x495/0x8a0 net/ipv4/tcp_timer.c:622 tcp_write_timer+0x79/0x1b0 net/ipv4/tcp_timer.c:642 call_timer_fn+0x163/0x4a0 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x524/0x8a0 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0x9c/0x190 kernel/time/timer.c:1744 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x16e/0x1c0 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:132 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:110 [inline] RIP: 0010:acpi_idle_do_entry+0x15e/0x1c0 drivers/acpi/processor_idle.c:553 Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6a 48 8b 45 00 a8 08 75 c9 e8 1d 6b 0e f9 eb 07 0f 00 2d 04 e0 c8 00 fb f4 <9c> 58 fa f6 c4 02 74 b1 5d e9 94 67 0e f9 48 89 ef 5d e9 cb f9 ff RSP: 0018:ffffc90000d57d30 EFLAGS: 00000202 RAX: 000000000019e5d3 RBX: ffff8881419a1065 RCX: 1ffffffff18f95b1 RDX: 0000000000000000 RSI: ffffffff88cb2920 RDI: ffffffff891fde20 RBP: ffff88800fe6d4c0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffed1001fcda98 R11: 0000000000000001 R12: 0000000000000001 R13: ffff8881419a1064 R14: ffffffff8b4f2f60 R15: ffff888145c81004 acpi_idle_enter+0x2c0/0x4b0 drivers/acpi/processor_idle.c:688 cpuidle_enter_state+0x152/0xb40 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x45/0xa0 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:158 [inline] cpuidle_idle_call kernel/sched/idle.c:239 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:306 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403 start_secondary+0x265/0x340 arch/x86/kernel/smpboot.c:270 secondary_startup_64_no_verify+0xb0/0xbb Allocated by task 5858: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x84/0xa0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:2956 [inline] slab_alloc mm/slub.c:2964 [inline] kmem_cache_alloc+0x285/0x4a0 mm/slub.c:2969 kmem_cache_zalloc include/linux/slab.h:711 [inline] net_alloc net/core/net_namespace.c:409 [inline] copy_net_ns+0xfe/0x5c0 net/core/net_namespace.c:461 create_new_namespaces+0x35a/0x920 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x86/0x1a0 kernel/nsproxy.c:226 ksys_unshare+0x309/0x6b0 kernel/fork.c:3002 __do_sys_unshare kernel/fork.c:3076 [inline] __se_sys_unshare kernel/fork.c:3074 [inline] __x64_sys_unshare+0x28/0x40 kernel/fork.c:3074 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 8: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:360 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xfb/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1625 [inline] slab_free_freelist_hook+0xdf/0x240 mm/slub.c:1650 slab_free mm/slub.c:3210 [inline] kmem_cache_free+0x8e/0x5a0 mm/slub.c:3226 net_free net/core/net_namespace.c:437 [inline] net_drop_ns net/core/net_namespace.c:444 [inline] net_drop_ns net/core/net_namespace.c:440 [inline] cleanup_net+0x723/0x990 net/core/net_namespace.c:614 process_one_work+0x84c/0x13d0 kernel/workqueue.c:2276 worker_thread+0x598/0x1040 kernel/workqueue.c:2422 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff88802b153580 which belongs to the cache net_namespace of size 6592 The buggy address is located 600 bytes inside of 6592-byte region [ffff88802b153580, ffff88802b154f40) The buggy address belongs to the page: page:ffffea0000ac5400 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802b150000 pfn:0x2b150 head:ffffea0000ac5400 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff8880177e7981 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888010f69000 raw: ffff88802b150000 0000000080040003 00000001ffffffff ffff8880177e7981 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5855, ts 64612656247, free_ts 64610558398 prep_new_page mm/page_alloc.c:2433 [inline] get_page_from_freelist+0xa6f/0x2f50 mm/page_alloc.c:4166 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5388 alloc_slab_page mm/slub.c:1688 [inline] allocate_slab+0x32e/0x4b0 mm/slub.c:1828 new_slab mm/slub.c:1891 [inline] new_slab_objects mm/slub.c:2637 [inline] ___slab_alloc+0x4ba/0x820 mm/slub.c:2800 __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2840 slab_alloc_node mm/slub.c:2922 [inline] slab_alloc mm/slub.c:2964 [inline] kmem_cache_alloc+0x3e1/0x4a0 mm/slub.c:2969 kmem_cache_zalloc include/linux/slab.h:711 [inline] net_alloc net/core/net_namespace.c:409 [inline] copy_net_ns+0xfe/0x5c0 net/core/net_namespace.c:461 create_new_namespaces+0x35a/0x920 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x86/0x1a0 kernel/nsproxy.c:226 ksys_unshare+0x309/0x6b0 kernel/fork.c:3002 __do_sys_unshare kernel/fork.c:3076 [inline] __se_sys_unshare kernel/fork.c:3074 [inline] __x64_sys_unshare+0x28/0x40 kernel/fork.c:3074 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1343 [inline] free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1394 free_unref_page_prepare mm/page_alloc.c:3329 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3408 unfreeze_partials+0x17c/0x1d0 mm/slub.c:2418 put_cpu_partial+0x13d/0x230 mm/slub.c:2454 qlink_free mm/kasan/quarantine.c:146 [inline] qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0x8e/0xa0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:2956 [inline] slab_alloc mm/slub.c:2964 [inline] __kmalloc+0x1f4/0x330 mm/slub.c:4100 kmalloc include/linux/slab.h:596 [inline] tomoyo_realpath_from_path+0xb0/0x6a0 security/tomoyo/realpath.c:254 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_number_perm+0x1a6/0x4d0 security/tomoyo/file.c:723 security_file_ioctl+0x44/0x80 security/security.c:1539 __do_sys_ioctl fs/ioctl.c:1063 [inline] __se_sys_ioctl fs/ioctl.c:1055 [inline] __x64_sys_ioctl+0x99/0x190 fs/ioctl.c:1055 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88802b153680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b153700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802b153780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802b153800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b153880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 00 fc add %bh,%ah 6: ff (bad) 7: df 48 c1 fisttps -0x3f(%rax) a: ea (bad) b: 03 80 3c 02 00 75 add 0x7500023c(%rax),%eax 11: 6a 48 pushq $0x48 13: 8b 45 00 mov 0x0(%rbp),%eax 16: a8 08 test $0x8,%al 18: 75 c9 jne 0xffffffe3 1a: e8 1d 6b 0e f9 callq 0xf90e6b3c 1f: eb 07 jmp 0x28 21: 0f 00 2d 04 e0 c8 00 verw 0xc8e004(%rip) # 0xc8e02c 28: fb sti 29: f4 hlt * 2a: 9c pushfq <-- trapping instruction 2b: 58 pop %rax 2c: fa cli 2d: f6 c4 02 test $0x2,%ah 30: 74 b1 je 0xffffffe3 32: 5d pop %rbp 33: e9 94 67 0e f9 jmpq 0xf90e67cc 38: 48 89 ef mov %rbp,%rdi 3b: 5d pop %rbp 3c: e9 .byte 0xe9 3d: cb lret 3e: f9 stc 3f: ff .byte 0xff