bisecting cause commit starting from d012a7190fc1fd72ed48911e77ca97ba4521bccd building syzkaller on 67b599d167ab42fff545ec53e23f2711c184877b testing commit d012a7190fc1fd72ed48911e77ca97ba4521bccd with gcc (GCC) 8.1.0 kernel signature: a09a4b1622af5bf99b85e20aba2d6fcf3568d6d269c1b69e473df17cf8edb321 run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: kernel BUG at fs/inode.c:LINE! run #7: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #8: crashed: kernel BUG at fs/inode.c:LINE! run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: d37cda1767eff12bd2ea993e2344f976743d051b42d1b3f97d0bcd1f085fc1bc all runs: OK # git bisect start d012a7190fc1fd72ed48911e77ca97ba4521bccd bcf876870b95592b52519ed4aafcf9d95999bc9c Bisecting: 8152 revisions left to test after this (roughly 13 steps) [8186749621ed6b8fc42644c399e8c755a2b6f630] Merge tag 'drm-next-2020-08-06' of git://anongit.freedesktop.org/drm/drm testing commit 8186749621ed6b8fc42644c399e8c755a2b6f630 with gcc (GCC) 8.1.0 kernel signature: 3b5eba32ad22131a96a7e065347b776e42fc44846bbad910add6c70ac4c37728 all runs: OK # git bisect good 8186749621ed6b8fc42644c399e8c755a2b6f630 Bisecting: 4052 revisions left to test after this (roughly 12 steps) [dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee] Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi testing commit dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee with gcc (GCC) 8.1.0 kernel signature: e2636a7b5f677367f6fb28ce17e8e0e49ed561eb49f1dd3c22d67e5952806fa8 all runs: OK # git bisect good dfdf16ecfd6abafc22b7f02364d9bb879ca8a5ee Bisecting: 2039 revisions left to test after this (roughly 11 steps) [8c2618a6d0f7b08e2b41575a87cf568745c8860e] Merge tag 'gfs2-for-5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 testing commit 8c2618a6d0f7b08e2b41575a87cf568745c8860e with gcc (GCC) 8.1.0 kernel signature: 934345c0bbac6941894b3b0615e86dfcb56712227ad086b7b3f88ac60c9a135f all runs: OK # git bisect good 8c2618a6d0f7b08e2b41575a87cf568745c8860e Bisecting: 1023 revisions left to test after this (roughly 10 steps) [7a02c8d45bbf65cf432292c2032147fa7529de58] Merge branch 'parisc-5.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux testing commit 7a02c8d45bbf65cf432292c2032147fa7529de58 with gcc (GCC) 8.1.0 kernel signature: 849c0c0f1a92be28d0690f25270242c6dfa82460ab72e1ed51e50cfbe8cf2255 all runs: boot failed: WARNING in mem_cgroup_css_alloc # git bisect skip 7a02c8d45bbf65cf432292c2032147fa7529de58 Bisecting: 1023 revisions left to test after this (roughly 10 steps) [f254ac04c8744cf7bfed012717eac34eacc65dfb] io_uring: enable lookup of links holding inflight files testing commit f254ac04c8744cf7bfed012717eac34eacc65dfb with gcc (GCC) 8.1.0 kernel signature: ecea310d3946739bd0b7f0fc91a7e0f1983e78551c4bfc2ab483e1b7f6bfa211 all runs: OK # git bisect good f254ac04c8744cf7bfed012717eac34eacc65dfb Bisecting: 1010 revisions left to test after this (roughly 10 steps) [6c357848b44b4016ca422178aa368a7472245f6f] mm: replace hpage_nr_pages with thp_nr_pages testing commit 6c357848b44b4016ca422178aa368a7472245f6f with gcc (GCC) 8.1.0 kernel signature: 92760629a918c093edae0f69bf4d550fc5378c4234d7c309ce28ec2ab7b4241c all runs: OK # git bisect good 6c357848b44b4016ca422178aa368a7472245f6f Bisecting: 379 revisions left to test after this (roughly 9 steps) [0790e63f58f22a68696667102be03efb92a4da5f] Merge tag 'drm-intel-fixes-2020-08-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes testing commit 0790e63f58f22a68696667102be03efb92a4da5f with gcc (GCC) 8.1.0 kernel signature: 119a650e947dbc06da8e082cc6375c242b76f0b9b711c757c95dd7caefedb5c5 all runs: OK # git bisect good 0790e63f58f22a68696667102be03efb92a4da5f Bisecting: 185 revisions left to test after this (roughly 8 steps) [d723b99ec9e502a414a96a51ec229333f807b47e] Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 testing commit d723b99ec9e502a414a96a51ec229333f807b47e with gcc (GCC) 8.1.0 kernel signature: ed2a2d805d117e9dd0b067c19560a2045840c42e1822eeadf850eb80b79ff95d all runs: OK # git bisect good d723b99ec9e502a414a96a51ec229333f807b47e Bisecting: 88 revisions left to test after this (roughly 7 steps) [c3d8f220d01220a5b253e422be407d068dc65511] Merge tag 'kbuild-fixes-v5.9' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild testing commit c3d8f220d01220a5b253e422be407d068dc65511 with gcc (GCC) 8.1.0 kernel signature: 443d7e112ba6658201276354493945d162e21fd875aab0eef375dad6337caade all runs: OK # git bisect good c3d8f220d01220a5b253e422be407d068dc65511 Bisecting: 49 revisions left to test after this (roughly 6 steps) [774d977abfd024e6f73484544b9abe5a5cd62de7] net: dsa: b53: check for timeout testing commit 774d977abfd024e6f73484544b9abe5a5cd62de7 with gcc (GCC) 8.1.0 kernel signature: ec074b7df782f8ddae0358134394bcf018b474cb15bca86ff4637480fc583fbe all runs: OK # git bisect good 774d977abfd024e6f73484544b9abe5a5cd62de7 Bisecting: 20 revisions left to test after this (roughly 5 steps) [10c091b62e7fc3133d652b7212904348398b302e] Merge tag 'efi-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit 10c091b62e7fc3133d652b7212904348398b302e with gcc (GCC) 8.1.0 kernel signature: 2e8221d1a927623fd3cebf5e992092e40d6304bc585348f65236c551ca807dc6 run #0: crashed: kernel BUG at fs/inode.c:LINE! run #1: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: kernel BUG at fs/inode.c:LINE! run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad 10c091b62e7fc3133d652b7212904348398b302e Bisecting: 15 revisions left to test after this (roughly 4 steps) [eeaac3634ee0e3f35548be35275efeca888e9b23] net: nexthop: don't allow empty NHA_GROUP testing commit eeaac3634ee0e3f35548be35275efeca888e9b23 with gcc (GCC) 8.1.0 kernel signature: 7f61100a18cc72f0587d85dd6a4a5d3078d98d13fd85331807bbd0311c87f2a3 all runs: OK # git bisect good eeaac3634ee0e3f35548be35275efeca888e9b23 Bisecting: 7 revisions left to test after this (roughly 3 steps) [e99b2507baccca79394ec646e3d1a0884667ea98] Merge tag 'core-urgent-2020-08-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit e99b2507baccca79394ec646e3d1a0884667ea98 with gcc (GCC) 8.1.0 kernel signature: 9ee3e9a44192c44db7edee75e52b8a9c083033e4039f2d8aa1ca0cd05035ef5c run #0: crashed: kernel BUG at fs/inode.c:LINE! run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #7: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #8: crashed: kernel BUG at fs/inode.c:LINE! run #9: OK # git bisect bad e99b2507baccca79394ec646e3d1a0884667ea98 Bisecting: 3 revisions left to test after this (roughly 2 steps) [9d045ed1ebe1a6115d3fa9930c5371defb31d95a] Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net testing commit 9d045ed1ebe1a6115d3fa9930c5371defb31d95a with gcc (GCC) 8.1.0 kernel signature: 8299d3b950510e2eff6c3a68f9c45595b2128603cceb9119648e1f0b297db7eb run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #2: crashed: kernel BUG at fs/inode.c:LINE! run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: kernel BUG at fs/inode.c:LINE! run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: kernel BUG at fs/inode.c:LINE! run #7: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad 9d045ed1ebe1a6115d3fa9930c5371defb31d95a Bisecting: 1 revision left to test after this (roughly 1 step) [52c479697c9b73f628140dcdfcd39ea302d05482] do_epoll_ctl(): clean the failure exits up a bit testing commit 52c479697c9b73f628140dcdfcd39ea302d05482 with gcc (GCC) 8.1.0 kernel signature: 4fb15e416273d7fc55087d8a6c567267e1206d6405b0060cffe29a450ea953f7 all runs: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad 52c479697c9b73f628140dcdfcd39ea302d05482 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a9ed4a6560b8562b7e2e2bed9527e88001f7b682] epoll: Keep a reference on files added to the check list testing commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 with gcc (GCC) 8.1.0 kernel signature: 91fffa187ac1f3665d0045ed0f24ac5f23608f176e9d566dc1c40f57a3e25ae8 run #0: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #1: crashed: kernel BUG at fs/inode.c:LINE! run #2: crashed: kernel BUG at fs/inode.c:LINE! run #3: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #4: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #5: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in task_work_run run #7: crashed: kernel BUG at fs/inode.c:LINE! run #8: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare run #9: crashed: WARNING: ODEBUG bug in exit_to_user_mode_prepare # git bisect bad a9ed4a6560b8562b7e2e2bed9527e88001f7b682 a9ed4a6560b8562b7e2e2bed9527e88001f7b682 is the first bad commit commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 Author: Marc Zyngier Date: Wed Aug 19 17:12:17 2020 +0100 epoll: Keep a reference on files added to the check list When adding a new fd to an epoll, and that this new fd is an epoll fd itself, we recursively scan the fds attached to it to detect cycles, and add non-epool files to a "check list" that gets subsequently parsed. However, this check list isn't completely safe when deletions can happen concurrently. To sidestep the issue, make sure that a struct file placed on the check list sees its f_count increased, ensuring that a concurrent deletion won't result in the file disapearing from under our feet. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Signed-off-by: Al Viro fs/eventpoll.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) parent commit 9123e3a74ec7b934a4a099e98af6a61c2f80bbf5 wasn't tested testing commit 9123e3a74ec7b934a4a099e98af6a61c2f80bbf5 with gcc (GCC) 8.1.0 kernel signature: 0d7baae7b68186587866b26fb71a0ae7c68225df7f8f28581d58789ceae7401a culprit signature: 91fffa187ac1f3665d0045ed0f24ac5f23608f176e9d566dc1c40f57a3e25ae8 parent signature: 0d7baae7b68186587866b26fb71a0ae7c68225df7f8f28581d58789ceae7401a revisions tested: 18, total time: 4h15m23.359002302s (build: 1h30m22.017346904s, test: 2h43m16.528808521s) first bad commit: a9ed4a6560b8562b7e2e2bed9527e88001f7b682 epoll: Keep a reference on files added to the check list recipients (to): ["linux-kernel@vger.kernel.org" "maz@kernel.org" "viro@zeniv.linux.org.uk"] recipients (cc): ["linux-fsdevel@vger.kernel.org" "viro@zeniv.linux.org.uk"] crash: WARNING: ODEBUG bug in exit_to_user_mode_prepare ------------[ cut here ]------------ ODEBUG: free active (active state 1) object type: rcu_head hint: 0x0 WARNING: CPU: 0 PID: 32637 at lib/debugobjects.c:488 debug_print_object+0x67/0x80 lib/debugobjects.c:485 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 32637 Comm: syz-executor.3 Not tainted 5.9.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xb3/0xec lib/dump_stack.c:118 panic+0x115/0x2fa kernel/panic.c:231 __warn.cold.13+0x20/0x25 kernel/panic.c:600 report_bug+0xc0/0xf0 lib/bug.c:198 handle_bug+0x35/0x90 arch/x86/kernel/traps.c:234 exc_invalid_op+0x13/0x60 arch/x86/kernel/traps.c:254 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 RIP: 0010:debug_print_object+0x67/0x80 lib/debugobjects.c:485 Code: 8b 43 10 83 c2 01 4c 89 e6 48 c7 c7 20 55 f1 83 89 15 11 dc 21 04 8b 4b 14 4c 8b 45 00 48 8b 14 c5 00 19 7a 83 e8 34 5f 4e ff <0f> 0b 5b 83 05 1b 0f 95 02 01 5d 41 5c c3 83 05 10 0f 95 02 01 c3 RSP: 0018:ffffc90002077e40 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff88810f0b5050 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff8401b939 RDI: 00000000ffffffff RBP: ffffffff842f59c0 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: f33c643fd81ac911 R12: ffffffff83ef3d14 R13: ffff88810f0b5050 R14: 0000000000000000 R15: ffffffff842f59c0 __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] debug_check_no_obj_freed+0x1bb/0x1dd lib/debugobjects.c:998 kmem_cache_free.part.65+0x145/0x1d0 mm/slab.c:3692 task_work_run+0x68/0xb0 kernel/task_work.c:141 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:139 [inline] exit_to_user_mode_prepare+0x1e2/0x1f0 kernel/entry/common.c:166 syscall_exit_to_user_mode+0x59/0x2b0 kernel/entry/common.c:241 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d579 Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f329cbc1c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 RAX: 0000000000000000 RBX: 0000000000002ac0 RCX: 000000000045d579 RDX: 0000000000000003 RSI: 0000000000000001 RDI: 0000000000000004 RBP: 000000000118d028 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 000000000118cfec R13: 00007fffebaf68bf R14: 00007f329cbc29c0 R15: 000000000118cfec Kernel Offset: disabled Rebooting in 86400 seconds..