ci2 starts bisection 2024-07-10 19:30:38.339268368 +0000 UTC m=+13110.863390963 bisecting fixing commit since 1b639e97b8fc9a60089ded544e103753a0a542a2 building syzkaller on cb976f63e0177b96eb9ce1c631cc5e2c4b4b0759 ensuring issue is reproducible on original commit 1b639e97b8fc9a60089ded544e103753a0a542a2 testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cdeb723926473f4c5d42b7537535960ce445c9eac0326518343ef16076fe2c28 run #0: crashed: general protection fault in hrtimer_try_to_cancel run #1: crashed: general protection fault in hrtimer_try_to_cancel run #2: crashed: general protection fault in hrtimer_try_to_cancel run #3: crashed: general protection fault in hrtimer_try_to_cancel run #4: crashed: general protection fault in hrtimer_try_to_cancel run #5: crashed: general protection fault in hrtimer_try_to_cancel run #6: crashed: general protection fault in hrtimer_try_to_cancel run #7: crashed: general protection fault in hrtimer_try_to_cancel run #8: crashed: general protection fault in hrtimer_try_to_cancel run #9: crashed: general protection fault in hrtimer_try_to_cancel run #10: crashed: general protection fault in hrtimer_try_to_cancel run #11: crashed: general protection fault in hrtimer_try_to_cancel run #12: crashed: general protection fault in hrtimer_try_to_cancel run #13: crashed: general protection fault in hrtimer_try_to_cancel run #14: crashed: general protection fault in hrtimer_try_to_cancel run #15: crashed: general protection fault in hrtimer_try_to_cancel run #16: crashed: no output from test machine run #17: crashed: no output from test machine run #18: crashed: no output from test machine run #19: crashed: no output from test machine representative crash: general protection fault in hrtimer_try_to_cancel, types: [UNKNOWN] check whether we can drop unnecessary instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e381f5282b4f0d857c53d04dd231062cf73dfc0382a9d54377f9ce92adf18df5 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] the bug reproduces without the instrumentation disabling configs for [KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK UBSAN BUG], they are not needed kconfig minimization: base=5179 full=6485 leaves diff=250 split chunks (needed=false): <250> split chunk #0 of len 250 into 5 parts testing without sub-chunk 1/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: b7cf53411128cd2dcfb041afe888de00ce74f9180c19a5c7f450b184e85aff53 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: no output from test machine run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 45bcc2d3dc920b33a13df5a6e9864da26c3c6e52c6b27c3d2bb46e90b9dbf912 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d8bcf674161bc336bbac44c7788836657ec37cbaa0bf0557aaced1983fd90fe2 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 11d41f2eb450c135dc7fadeb1c1845525e07327074862cb587fd77662e362b7b run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [HANG LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed testing commit 1b639e97b8fc9a60089ded544e103753a0a542a2 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 failed building 1b639e97b8fc9a60089ded544e103753a0a542a2: net/socket.c:1225: undefined reference to `wext_handle_ioctl' net/socket.c:3420: undefined reference to `compat_wext_handle_ioctl' net/core/net-procfs.c:329: undefined reference to `wext_proc_init' net/core/net-procfs.c:345: undefined reference to `wext_proc_exit' minimized to 50 configs; suspects: [HID_ZEROPLUS USB_NET_CDC_MBIM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_DM9601 USB_NET_GL620A USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD USB_OHCI_HCD_PCI USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_PRINTER USB_SERIAL_GENERIC USB_SERIAL_PL2303 USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_TRANCEVIBRATOR USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_WDM WLAN WLAN_VENDOR_ATH WLAN_VENDOR_ATMEL WLAN_VENDOR_BROADCOM WLAN_VENDOR_INTERSIL WLAN_VENDOR_MARVELL WLAN_VENDOR_MEDIATEK WLAN_VENDOR_MICROCHIP WLAN_VENDOR_PURELIFI WLAN_VENDOR_RALINK WLAN_VENDOR_REALTEK WLAN_VENDOR_RSI WLAN_VENDOR_SILABS WLAN_VENDOR_ZYDAS X86_X32_ABI ZEROPLUS_FF] disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP HANG LEAK], they are not needed testing current HEAD 96d66062d0767aeafb690ce014ec91785820d62b testing commit 96d66062d0767aeafb690ce014ec91785820d62b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f12431644bd0a6694cc4f29a972a431fc0f4407cdd3896629574c49faf35b3d3 all runs: OK false negative chance: 0.000 # git bisect start 96d66062d0767aeafb690ce014ec91785820d62b 1b639e97b8fc9a60089ded544e103753a0a542a2 Bisecting: 3715 revisions left to test after this (roughly 12 steps) [112792ad36c480392bfacaaceb92ff0131edc603] iavf: Handle ntuple on/off based on new state machines for flow director determine whether the revision contains the guilty commit checking the merge base 52a953d0934b17a88f403b4135eb3cdf83d19f91 no existing result, test the revision testing commit 52a953d0934b17a88f403b4135eb3cdf83d19f91 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a4944ae4bf5e86ab4badb4b0c2a12ec188e22c38e9a67c07f665100fc333070d all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] testing commit 112792ad36c480392bfacaaceb92ff0131edc603 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 81cef5e742d62bfa774ff323eabc001e839f4d71c8d37ca939481d3502cf4c9c run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] # git bisect good 112792ad36c480392bfacaaceb92ff0131edc603 Bisecting: 1858 revisions left to test after this (roughly 11 steps) [e30f82597bf64ad32f3b9718bb12791bf3926f3d] PCI: layerscape: Add the endpoint linkup notifier support determine whether the revision contains the guilty commit revision 112792ad36c480392bfacaaceb92ff0131edc603 crashed and is reachable testing commit e30f82597bf64ad32f3b9718bb12791bf3926f3d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 2f825de76f3130a731600bb3bdb67f45da3b91e43e50e8f87bb31f5f3e35896d run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: no output from test machine run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] # git bisect good e30f82597bf64ad32f3b9718bb12791bf3926f3d Bisecting: 929 revisions left to test after this (roughly 10 steps) [016119154981d81c9e8f2ea3f56b9e2b4ea14500] drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 016119154981d81c9e8f2ea3f56b9e2b4ea14500 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f3b84e45628d45cb7d506eb65b2328b93d3f0a8f48f3e1fb5a0cbc4e870dc167 all runs: OK false negative chance: 0.000 # git bisect bad 016119154981d81c9e8f2ea3f56b9e2b4ea14500 Bisecting: 464 revisions left to test after this (roughly 9 steps) [a83fdaeaea3677b83a53f72ace2d73a19bcd6d93] bpf: Fix hashtab overflow check on 32-bit arches determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: d5feee1ae547430b27d577ffe374432ff691be8ce4d75343033a865e081d226d all runs: OK false negative chance: 0.000 # git bisect bad a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 Bisecting: 231 revisions left to test after this (roughly 8 steps) [498f1d6da11ed6d736d655a2db14ee2d9569eecb] netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 498f1d6da11ed6d736d655a2db14ee2d9569eecb gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: aa74530ae16f9602d627222095da97f6966748b2ac45a191f442870051fadbc1 all runs: OK false negative chance: 0.000 # git bisect bad 498f1d6da11ed6d736d655a2db14ee2d9569eecb Bisecting: 115 revisions left to test after this (roughly 7 steps) [7bc9533e077e2553264b447189d13f83c47770a0] x86/efi: Make the deprecated EFI handover protocol optional determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 7bc9533e077e2553264b447189d13f83c47770a0 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 779eaf3aeff93bf7a20619053067777ce34bad0bd19b888ddda71eda0b48f072 all runs: OK false negative chance: 0.000 # git bisect bad 7bc9533e077e2553264b447189d13f83c47770a0 Bisecting: 57 revisions left to test after this (roughly 6 steps) [058ed71e0f7aa3b6694ca357e23d084e5d3f2470] afs: Fix endless loop in directory parsing determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 058ed71e0f7aa3b6694ca357e23d084e5d3f2470 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 402a2bc464fe338044ad9c214cc0e44f6d5b2a0e2fa754ce0f7f62e0ad9d042a all runs: OK false negative chance: 0.000 # git bisect bad 058ed71e0f7aa3b6694ca357e23d084e5d3f2470 Bisecting: 28 revisions left to test after this (roughly 5 steps) [aa5897232682c27ff731b083b40c879b0eb2c994] uapi: in6: replace temporary label with rfc9486 determine whether the revision contains the guilty commit revision e30f82597bf64ad32f3b9718bb12791bf3926f3d crashed and is reachable testing commit aa5897232682c27ff731b083b40c879b0eb2c994 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: f17ea607d73b32ed52ee01db426138e6312861e53fb37e9b78061346cae3a447 all runs: OK false negative chance: 0.000 # git bisect bad aa5897232682c27ff731b083b40c879b0eb2c994 Bisecting: 14 revisions left to test after this (roughly 4 steps) [afbf1a5cef46427241e76704991cc83c9b1a463b] RDMA/core: Fix multiple -Warray-bounds warnings determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit afbf1a5cef46427241e76704991cc83c9b1a463b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: e5add6f4cd15d0dbb19314c871a808415f09bd4283aaeaff955461e6cbdbf48f all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] # git bisect good afbf1a5cef46427241e76704991cc83c9b1a463b Bisecting: 7 revisions left to test after this (roughly 3 steps) [29360fd3288f3978ccde2f8f7eba22282c4a08a3] tun: Fix xdp_rxq_info's queue_index when detaching determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 29360fd3288f3978ccde2f8f7eba22282c4a08a3 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: cfb0052f725ea7eced487c214b8f980daef6a103c51493b7d7d380f770eb73ce run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] # git bisect good 29360fd3288f3978ccde2f8f7eba22282c4a08a3 Bisecting: 3 revisions left to test after this (roughly 2 steps) [c41548fede3d4b0305be2237ba7dbf657e9ff30b] lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected determine whether the revision contains the guilty commit revision 29360fd3288f3978ccde2f8f7eba22282c4a08a3 crashed and is reachable testing commit c41548fede3d4b0305be2237ba7dbf657e9ff30b gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: c807c08ddc0cb60033244d1ddaf63a84bb7c2bafa806b1034389f551525fbee6 all runs: OK false negative chance: 0.000 # git bisect bad c41548fede3d4b0305be2237ba7dbf657e9ff30b Bisecting: 1 revision left to test after this (roughly 1 step) [7985d73961bbb4e726c1be7b9cd26becc7be8325] net: veth: clear GRO when clearing XDP even when down determine whether the revision contains the guilty commit revision 52a953d0934b17a88f403b4135eb3cdf83d19f91 crashed and is reachable testing commit 7985d73961bbb4e726c1be7b9cd26becc7be8325 gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: a4169e68dcd727c579ffdec3fabed304f6632411e3e004fd8c13a80c98eee6ff all runs: OK false negative chance: 0.000 # git bisect bad 7985d73961bbb4e726c1be7b9cd26becc7be8325 Bisecting: 0 revisions left to test after this (roughly 0 steps) [e85b3c15398f6fa1f3941be8acbef79ae114744d] cpufreq: intel_pstate: fix pstate limits enforcement for adjust_perf call back determine whether the revision contains the guilty commit revision e30f82597bf64ad32f3b9718bb12791bf3926f3d crashed and is reachable testing commit e85b3c15398f6fa1f3941be8acbef79ae114744d gcc compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 kernel signature: 8b2955d696c069a4cc070ab77cf26a3897136f8c90fc0e303f0bcbb1f4695a1f run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel run #8: crashed: no output from test machine run #9: crashed: no output from test machine representative crash: BUG: unable to handle kernel NULL pointer dereference in hrtimer_try_to_cancel, types: [UNKNOWN] # git bisect good e85b3c15398f6fa1f3941be8acbef79ae114744d 7985d73961bbb4e726c1be7b9cd26becc7be8325 is the first bad commit commit 7985d73961bbb4e726c1be7b9cd26becc7be8325 Author: Jakub Kicinski Date: Wed Feb 21 15:12:10 2024 -0800 net: veth: clear GRO when clearing XDP even when down [ Upstream commit fe9f801355f0b47668419f30f1fac1cf4539e736 ] veth sets NETIF_F_GRO automatically when XDP is enabled, because both features use the same NAPI machinery. The logic to clear NETIF_F_GRO sits in veth_disable_xdp() which is called both on ndo_stop and when XDP is turned off. To avoid the flag from being cleared when the device is brought down, the clearing is skipped when IFF_UP is not set. Bringing the device down should indeed not modify its features. Unfortunately, this means that clearing is also skipped when XDP is disabled _while_ the device is down. And there's nothing on the open path to bring the device features back into sync. IOW if user enables XDP, disables it and then brings the device up we'll end up with a stray GRO flag set but no NAPI instances. We don't depend on the GRO flag on the datapath, so the datapath won't crash. We will crash (or hang), however, next time features are sync'ed (either by user via ethtool or peer changing its config). The GRO flag will go away, and veth will try to disable the NAPIs. But the open path never created them since XDP was off, the GRO flag was a stray. If NAPI was initialized before we'll hang in napi_disable(). If it never was we'll crash trying to stop uninitialized hrtimer. Move the GRO flag updates to the XDP enable / disable paths, instead of mixing them with the ndo_open / ndo_close paths. Fixes: d3256efd8e8b ("veth: allow enabling NAPI even without XDP") Reported-by: Thomas Gleixner Reported-by: syzbot+039399a9b96297ddedca@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski Reviewed-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin drivers/net/veth.c | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-) accumulated error probability: 0.00 culprit signature: a4169e68dcd727c579ffdec3fabed304f6632411e3e004fd8c13a80c98eee6ff parent signature: 8b2955d696c069a4cc070ab77cf26a3897136f8c90fc0e303f0bcbb1f4695a1f revisions tested: 21, total time: 4h33m18.002179245s (build: 1h7m3.33089936s, test: 3h19m16.481130133s) first good commit: 7985d73961bbb4e726c1be7b9cd26becc7be8325 net: veth: clear GRO when clearing XDP even when down recipients (to): ["davem@davemloft.net" "kuba@kernel.org" "sashal@kernel.org" "toke@redhat.com"] recipients (cc): []