ci2 starts bisection 2024-07-14 20:35:24.507083703 +0000 UTC m=+268649.054715149 bisecting fixing commit since 5d96939590c0122be2138255c921e57e3f78b7bd building syzkaller on 610f2a54d02f8cf4f2454c03bf679b602e6e59b6 ensuring issue is reproducible on original commit 5d96939590c0122be2138255c921e57e3f78b7bd testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ea17841ade2e4627e21a5ec0261c8e3eae5a375e1e8665d46a23e81ab9089f36 run #0: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #1: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #6: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #7: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #8: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #9: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #10: crashed: BUG: scheduling while atomic in do_task_dead run #11: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #12: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #13: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #14: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #15: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #16: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #17: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #18: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #19: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] check whether we can drop unnecessary instrumentation disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP HANG], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e31d7d1eeba97709b59ba0fd4f08bf465ec5fe5e292e2643f9cc8d3111e7c7c5 run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in do_task_dead run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #6: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #7: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #8: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #9: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] the bug reproduces without the instrumentation disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP], they are not needed kconfig minimization: base=4920 full=6158 leaves diff=242 split chunks (needed=false): <242> split chunk #0 of len 242 into 5 parts testing without sub-chunk 1/5 disabling configs for [BUG KASAN LOCKDEP HANG LEAK UBSAN], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 149cb414aad1a98ef78e7968825916e056a7456e90c55186871205afb82bd39e run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in do_task_dead run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in do_task_dead run #5: crashed: BUG: scheduling while atomic in do_task_dead run #6: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #7: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #8: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #9: crashed: BUG: scheduling while atomic in do_task_dead representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [UBSAN BUG KASAN LOCKDEP HANG LEAK], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d09cca25597158f10c2d7564303706c5eca4d7095f0bdbc34e9048c16a1cb220 run #0: crashed: BUG: scheduling while atomic in do_epoll_wait run #1: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #2: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #6: OK run #7: OK run #8: OK run #9: OK representative crash: BUG: scheduling while atomic in do_epoll_wait, types: [ATOMIC_SLEEP] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP HANG], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 43d43d805a7babb586ac45a13d87da3c52e99091e6ca69fb7fcb8e0d83704d20 run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #2: crashed: BUG: scheduling while atomic in do_task_dead run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #5: OK run #6: crashed: BUG: scheduling while atomic in do_task_dead run #7: OK run #8: OK run #9: OK representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP HANG], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 43449a39de4e47ca26138eac561c78fd50965bc665cf4eafadaa7afacf5f326f run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in bit_wait_io run #2: crashed: BUG: scheduling while atomic in do_task_dead run #3: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: workqueue leaked lock or atomic in bpf_prog_free_deferred run #6: crashed: BUG: scheduling while atomic in do_task_dead run #7: OK run #8: OK run #9: OK representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP UNKNOWN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [LOCKDEP HANG LEAK UBSAN BUG KASAN], they are not needed testing commit 5d96939590c0122be2138255c921e57e3f78b7bd gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 failed building 5d96939590c0122be2138255c921e57e3f78b7bd: net/socket.c:1191: undefined reference to `wext_handle_ioctl' net/socket.c:3385: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:343: undefined reference to `wext_proc_exit' net/core/net-procfs.c:327: undefined reference to `wext_proc_init' minimized to 46 configs; suspects: [HID_ZEROPLUS USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL USB_SERIAL_FTDI_SIO USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_ZYDAS X86_X32 ZEROPLUS_FF] disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP HANG], they are not needed testing current HEAD db06c48ab67eb5db1ac64a0210d77742e335537a testing commit db06c48ab67eb5db1ac64a0210d77742e335537a gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 95a9bcbb8fafb02aabbef0dc8d2325ca774c60b5160b36516e736278b2ec2eba all runs: OK false negative chance: 0.000 # git bisect start db06c48ab67eb5db1ac64a0210d77742e335537a 5d96939590c0122be2138255c921e57e3f78b7bd Bisecting: 207 revisions left to test after this (roughly 8 steps) [989af2f29342a9a7c7515523d879b698ac8465f4] RDMA/srpt: Support specifying the srpt_service_guid parameter determine whether the revision contains the guilty commit checking the merge base 458ce51d0356ee60c93f9f807d9827cf2a41643d no existing result, test the revision testing commit 458ce51d0356ee60c93f9f807d9827cf2a41643d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 1cad51ea725c84799eea3e87582c29cc6afa2d9e640344017f9f38a2d2eb5992 run #0: crashed: BUG: scheduling while atomic in do_task_dead run #1: crashed: BUG: scheduling while atomic in do_task_dead run #2: crashed: BUG: scheduling while atomic in bit_wait_io run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in do_task_dead run #5: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #6: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #7: OK run #8: OK run #9: OK representative crash: BUG: scheduling while atomic in do_task_dead, types: [ATOMIC_SLEEP] testing commit 989af2f29342a9a7c7515523d879b698ac8465f4 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3bd7f2fd442237a1d5b6451898aac32505ee28afabcc3270f075a605e626625a all runs: OK false negative chance: 0.000 # git bisect bad 989af2f29342a9a7c7515523d879b698ac8465f4 Bisecting: 103 revisions left to test after this (roughly 7 steps) [256c3e6192ed80f7f67c55c531942f880788c9ed] usb: roles: don't get/set_role() when usb_role_switch is unregistered determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit 256c3e6192ed80f7f67c55c531942f880788c9ed gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 121d4f5e61e6125dc29f94837296ef039b4818afdeb7e6f1fc9bfa3c9b4685cb all runs: OK false negative chance: 0.000 # git bisect bad 256c3e6192ed80f7f67c55c531942f880788c9ed Bisecting: 51 revisions left to test after this (roughly 6 steps) [b4663b406aeef31604a9495a2db0898987224b95] Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit b4663b406aeef31604a9495a2db0898987224b95 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 83abd69cba4aa25153ea2bce62dd102229b447ff6331ed20ddbdbce4d396400e all runs: OK false negative chance: 0.000 # git bisect bad b4663b406aeef31604a9495a2db0898987224b95 Bisecting: 25 revisions left to test after this (roughly 5 steps) [0399d7eba41d9b28f5bdd7757ec21a5b7046858d] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit 0399d7eba41d9b28f5bdd7757ec21a5b7046858d gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 6835c65da42548f6f22a391556c3bd7638001bb9452f4fa0b0af252d28c19188 all runs: OK false negative chance: 0.000 # git bisect bad 0399d7eba41d9b28f5bdd7757ec21a5b7046858d Bisecting: 12 revisions left to test after this (roughly 4 steps) [4bbb93ad84b32e6f2a80567e9d461fa5287770c0] bpf: Remove trace_printk_lock determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit 4bbb93ad84b32e6f2a80567e9d461fa5287770c0 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3934af6fe2d380b3a945dfe110eb5cfa160f345804ae47a557c70e5aa32b9a0a all runs: OK false negative chance: 0.000 # git bisect bad 4bbb93ad84b32e6f2a80567e9d461fa5287770c0 Bisecting: 5 revisions left to test after this (roughly 3 steps) [ee0fb9baa7a4fc50ea710565da6f7a3139f5b3eb] smb: client: fix parsing of SMB3.1.1 POSIX create context determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit ee0fb9baa7a4fc50ea710565da6f7a3139f5b3eb gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 33e1fb3bfa877cf142152722575e7cf27477358ad333a5376869a24ba0f69d9b run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in do_task_dead run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] # git bisect good ee0fb9baa7a4fc50ea710565da6f7a3139f5b3eb Bisecting: 2 revisions left to test after this (roughly 2 steps) [8495c34dff0dfbbab18b1c2eb54673372fb366b0] bpf: Merge printk and seq_printf VARARG max macros determine whether the revision contains the guilty commit revision ee0fb9baa7a4fc50ea710565da6f7a3139f5b3eb crashed and is reachable testing commit 8495c34dff0dfbbab18b1c2eb54673372fb366b0 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8bf30dbc5a77862902dd60b9400b032c0399e87b589a480b3200416bb591805f run #0: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #1: crashed: BUG: scheduling while atomic in do_task_dead run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #6: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: BUG: scheduling while atomic in exit_to_user_mode_prepare, types: [ATOMIC_SLEEP] # git bisect good 8495c34dff0dfbbab18b1c2eb54673372fb366b0 Bisecting: 0 revisions left to test after this (roughly 1 step) [4b349c55bbd33c8918dbac13876d6842af571505] bpf: Do cleanup in bpf_bprintf_cleanup only when needed determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit 4b349c55bbd33c8918dbac13876d6842af571505 gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: ed80f3d875fc8f2cd8bf14920633339f91e16326a4a0228aed84b4d008af23bc all runs: OK false negative chance: 0.000 # git bisect bad 4b349c55bbd33c8918dbac13876d6842af571505 Bisecting: 0 revisions left to test after this (roughly 0 steps) [bcbaeb081ad846ae7f824ecf2df3d21de17608ea] bpf: Add struct for bin_args arg in bpf_bprintf_prepare determine whether the revision contains the guilty commit revision 458ce51d0356ee60c93f9f807d9827cf2a41643d crashed and is reachable testing commit bcbaeb081ad846ae7f824ecf2df3d21de17608ea gcc compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 3deada3fcad822d0822901736d9689812e8506734443f0a395b42a3bd8ebc678 run #0: crashed: BUG: scheduling while atomic in do_task_dead run #1: crashed: BUG: scheduling while atomic in bit_wait_io run #2: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #3: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #4: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #5: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #6: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #7: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #8: crashed: BUG: scheduling while atomic in exit_to_user_mode_prepare run #9: crashed: BUG: scheduling while atomic in do_task_dead run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: BUG: scheduling while atomic in do_task_dead, types: [ATOMIC_SLEEP] # git bisect good bcbaeb081ad846ae7f824ecf2df3d21de17608ea 4b349c55bbd33c8918dbac13876d6842af571505 is the first bad commit commit 4b349c55bbd33c8918dbac13876d6842af571505 Author: Jiri Olsa Date: Sat Feb 17 09:13:20 2024 -0300 bpf: Do cleanup in bpf_bprintf_cleanup only when needed commit f19a4050455aad847fb93f18dc1fe502eb60f989 upstream. Currently we always cleanup/decrement bpf_bprintf_nest_level variable in bpf_bprintf_cleanup if it's > 0. There's possible scenario where this could cause a problem, when bpf_bprintf_prepare does not get bin_args buffer (because num_args is 0) and following bpf_bprintf_cleanup call decrements bpf_bprintf_nest_level variable, like: in task context: bpf_bprintf_prepare(num_args != 0) increments 'bpf_bprintf_nest_level = 1' -> first irq : bpf_bprintf_prepare(num_args == 0) bpf_bprintf_cleanup decrements 'bpf_bprintf_nest_level = 0' -> second irq: bpf_bprintf_prepare(num_args != 0) bpf_bprintf_nest_level = 1 gets same buffer as task context above Adding check to bpf_bprintf_cleanup and doing the real cleanup only if we got bin_args data in the first place. Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20221215214430.1336195-3-jolsa@kernel.org [cascardo: there is no bpf_trace_vprintk in 5.15] Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Greg Kroah-Hartman include/linux/bpf.h | 2 +- kernel/bpf/helpers.c | 16 +++++++++------- kernel/trace/bpf_trace.c | 4 ++-- 3 files changed, 12 insertions(+), 10 deletions(-) accumulated error probability: 0.00 culprit signature: ed80f3d875fc8f2cd8bf14920633339f91e16326a4a0228aed84b4d008af23bc parent signature: 3deada3fcad822d0822901736d9689812e8506734443f0a395b42a3bd8ebc678 reproducer is flaky (0.45 repro chance estimate) revisions tested: 17, total time: 4h11m14.650599886s (build: 1h17m16.080057777s, test: 2h50m13.051911238s) first good commit: 4b349c55bbd33c8918dbac13876d6842af571505 bpf: Do cleanup in bpf_bprintf_cleanup only when needed recipients (to): ["cascardo@igalia.com" "daniel@iogearbox.net" "gregkh@linuxfoundation.org" "jolsa@kernel.org" "yhs@fb.com"] recipients (cc): []