bisecting cause commit starting from 3dbdb38e286903ec220aaf1fb29a8d94297da246 building syzkaller on 8f5a7b8cde529e0a19a53f79bdf9c6cad306827b testing commit 3dbdb38e286903ec220aaf1fb29a8d94297da246 with gcc (GCC) 10.2.1 20210217 kernel signature: 0c918222f21b3682499f4b3d1f1264f91dcc6592d3670d266f17e60e95528b33 all runs: crashed: KASAN: use-after-free Read in em28xx_close_extension testing release v5.13 testing commit 62fb9874f5da54fdb243003b386128037319b219 with gcc (GCC) 10.2.1 20210217 kernel signature: 2da1b527de5368761b09a6f259401abd1c605ab1f94b71e4905ece00f8cea55a all runs: OK # git bisect start 3dbdb38e286903ec220aaf1fb29a8d94297da246 62fb9874f5da54fdb243003b386128037319b219 Bisecting: 4651 revisions left to test after this (roughly 12 steps) [a6eaf3850cb171c328a8b0db6d3c79286a1eba9d] Merge tag 'sched-urgent-2021-06-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip testing commit a6eaf3850cb171c328a8b0db6d3c79286a1eba9d with gcc (GCC) 10.2.1 20210217 kernel signature: 0c48853f2e1f7dc80ee5d2147c430b84a32cd1227212891b92ab1f5d544adbfe run #0: basic kernel testing failed: possible deadlock in fs_reclaim_acquire run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: KASAN: use-after-free Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad a6eaf3850cb171c328a8b0db6d3c79286a1eba9d Bisecting: 1489 revisions left to test after this (roughly 11 steps) [31e798fd6f0ff0acdc49c1a358b581730936a09a] Merge tag 'media/v5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media testing commit 31e798fd6f0ff0acdc49c1a358b581730936a09a with gcc (GCC) 10.2.1 20210217 kernel signature: a99e550541473e8a52c2d7bc94885f83a90ea4d10a21dbf529bd81669880122c run #0: crashed: KASAN: use-after-free Read in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: out-of-bounds Read in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: KASAN: use-after-free Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad 31e798fd6f0ff0acdc49c1a358b581730936a09a Bisecting: 723 revisions left to test after this (roughly 10 steps) [9840cfcb97fc8b6aa7b36cec3cc3fd763f14052e] Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux testing commit 9840cfcb97fc8b6aa7b36cec3cc3fd763f14052e with gcc (GCC) 10.2.1 20210217 kernel signature: 800d51dc34e0072f116a91716437ed568bab6a0319bf5e51c3a63123b32f9f4a all runs: OK # git bisect good 9840cfcb97fc8b6aa7b36cec3cc3fd763f14052e Bisecting: 361 revisions left to test after this (roughly 9 steps) [5d11e6aad1811ea293ee2996cec9124f7fccb661] media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx testing commit 5d11e6aad1811ea293ee2996cec9124f7fccb661 with gcc (GCC) 10.2.1 20210217 kernel signature: 74e7c72125715cf77c2c504c8070a51146f0d4480556f4587592bdb502e18100 all runs: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad 5d11e6aad1811ea293ee2996cec9124f7fccb661 Bisecting: 180 revisions left to test after this (roughly 8 steps) [2fb27551ba4053ae503ce6c3b7b5d87cd206b1fd] media: imx: imx7_mipi_csis: Update MAINTAINERS testing commit 2fb27551ba4053ae503ce6c3b7b5d87cd206b1fd with gcc (GCC) 10.2.1 20210217 kernel signature: 38602c7837780d6f8b52f12538c7fde1d80103523db53332bb8755cf6702ae23 all runs: OK # git bisect good 2fb27551ba4053ae503ce6c3b7b5d87cd206b1fd Bisecting: 90 revisions left to test after this (roughly 7 steps) [35c47f8d9a34cfa4b17109501526411d74341c8b] media: saa7134: drop a NO-BREAK SPACE testing commit 35c47f8d9a34cfa4b17109501526411d74341c8b with gcc (GCC) 10.2.1 20210217 kernel signature: 4f254f44e309877fbdd8b1152c9c7cdca541a11fdf7f26f8144fb73ac29c0743 run #0: crashed: KASAN: out-of-bounds Read in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: KASAN: use-after-free Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad 35c47f8d9a34cfa4b17109501526411d74341c8b Bisecting: 44 revisions left to test after this (roughly 6 steps) [4c6178f31e7d33c87f9f046e3bcbaa15a1802ff9] media: rcar-csi2: Enable support for r8a77961 testing commit 4c6178f31e7d33c87f9f046e3bcbaa15a1802ff9 with gcc (GCC) 10.2.1 20210217 kernel signature: 38a6f7ad01107dea71253160b4115f3ad46e9694c8408a3fc38f6729fb33b519 all runs: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad 4c6178f31e7d33c87f9f046e3bcbaa15a1802ff9 Bisecting: 22 revisions left to test after this (roughly 5 steps) [8f6a0eabb1f21a23a570b0986c8abe9fded3ad6f] media: dt-bindings: media: renesas,vin: Add r8a779a0 support testing commit 8f6a0eabb1f21a23a570b0986c8abe9fded3ad6f with gcc (GCC) 10.2.1 20210217 kernel signature: b43c704bef07c8de5fc628db3259f9533592627fd0c00b632158d9502c8d4424 all runs: OK # git bisect good 8f6a0eabb1f21a23a570b0986c8abe9fded3ad6f Bisecting: 11 revisions left to test after this (roughly 4 steps) [ac5688637144644f06ed1f3c6d4dd8bb7db96020] media: em28xx: Fix possible memory leak of em28xx struct testing commit ac5688637144644f06ed1f3c6d4dd8bb7db96020 with gcc (GCC) 10.2.1 20210217 kernel signature: 32139d366e47676fe845948229a772b59deb06fcef0612c19aa1d7bcc2e51e06 run #0: crashed: KASAN: use-after-free Read in em28xx_close_extension run #1: crashed: KASAN: use-after-free Read in em28xx_close_extension run #2: crashed: KASAN: use-after-free Read in em28xx_close_extension run #3: crashed: KASAN: use-after-free Read in em28xx_close_extension run #4: crashed: KASAN: use-after-free Read in em28xx_close_extension run #5: crashed: KASAN: use-after-free Read in em28xx_close_extension run #6: crashed: KASAN: use-after-free Read in em28xx_close_extension run #7: crashed: KASAN: use-after-free Read in em28xx_close_extension run #8: crashed: KASAN: out-of-bounds Read in em28xx_close_extension run #9: crashed: KASAN: use-after-free Read in em28xx_close_extension # git bisect bad ac5688637144644f06ed1f3c6d4dd8bb7db96020 Bisecting: 5 revisions left to test after this (roughly 3 steps) [6fc46680520f38af8425a447de5e0f84106512eb] media: venus: helpers: Delete an unneeded bool conversion testing commit 6fc46680520f38af8425a447de5e0f84106512eb with gcc (GCC) 10.2.1 20210217 kernel signature: b43c704bef07c8de5fc628db3259f9533592627fd0c00b632158d9502c8d4424 all runs: OK # git bisect good 6fc46680520f38af8425a447de5e0f84106512eb Bisecting: 2 revisions left to test after this (roughly 2 steps) [be6cdcf2c9c97c5a702adb95520d0268c8ecc1ae] media: dt-bindings: media: renesas,csi2: Add r8a77961 support testing commit be6cdcf2c9c97c5a702adb95520d0268c8ecc1ae with gcc (GCC) 10.2.1 20210217 kernel signature: b43c704bef07c8de5fc628db3259f9533592627fd0c00b632158d9502c8d4424 all runs: OK # git bisect good be6cdcf2c9c97c5a702adb95520d0268c8ecc1ae Bisecting: 0 revisions left to test after this (roughly 1 step) [a3a54bf4bddaecda8b5767209cfc703f0be2841d] media: bt878: do not schedule tasklet when it is not setup testing commit a3a54bf4bddaecda8b5767209cfc703f0be2841d with gcc (GCC) 10.2.1 20210217 kernel signature: b43c704bef07c8de5fc628db3259f9533592627fd0c00b632158d9502c8d4424 all runs: OK # git bisect good a3a54bf4bddaecda8b5767209cfc703f0be2841d ac5688637144644f06ed1f3c6d4dd8bb7db96020 is the first bad commit commit ac5688637144644f06ed1f3c6d4dd8bb7db96020 Author: Igor Matheus Andrade Torrente Date: Tue May 4 20:32:49 2021 +0200 media: em28xx: Fix possible memory leak of em28xx struct The em28xx struct kref isn't being decreased after an error in the em28xx_ir_init, leading to a possible memory leak. A kref_put and em28xx_shutdown_buttons is added to the error handler code. Signed-off-by: Igor Matheus Andrade Torrente Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/em28xx/em28xx-input.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) culprit signature: 32139d366e47676fe845948229a772b59deb06fcef0612c19aa1d7bcc2e51e06 parent signature: b43c704bef07c8de5fc628db3259f9533592627fd0c00b632158d9502c8d4424 revisions tested: 14, total time: 3h27m3.41739333s (build: 1h40m40.361218072s, test: 1h44m30.885613584s) first bad commit: ac5688637144644f06ed1f3c6d4dd8bb7db96020 media: em28xx: Fix possible memory leak of em28xx struct recipients (to): ["hverkuil-cisco@xs4all.nl" "igormtorrente@gmail.com" "mchehab+huawei@kernel.org"] recipients (cc): [] crash: KASAN: use-after-free Read in em28xx_close_extension em28xx 3-1:64.138: Closing input extension em28xx 3-1:64.138: Freeing device ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42 Read of size 8 at addr ffff888032e6c258 by task kworker/0:6/10115 CPU: 0 PID: 10115 Comm: kworker/0:6 Not tainted 5.13.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0xa5/0xe6 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436 __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42 __list_del_entry include/linux/list.h:132 [inline] list_del include/linux/list.h:146 [inline] em28xx_close_extension+0xd8/0x260 drivers/media/usb/em28xx/em28xx-core.c:1146 em28xx_usb_disconnect.cold+0x13c/0x211 drivers/media/usb/em28xx/em28xx-cards.c:4140 usb_unbind_interface+0x183/0x7e0 drivers/usb/core/driver.c:458 __device_release_driver+0x32f/0x660 drivers/base/dd.c:1181 device_release_driver_internal drivers/base/dd.c:1212 [inline] device_release_driver+0x21/0x30 drivers/base/dd.c:1235 bus_remove_device+0x298/0x550 drivers/base/bus.c:533 device_del+0x494/0xc10 drivers/base/core.c:3512 usb_disable_device+0x29c/0x660 drivers/usb/core/message.c:1413 usb_disconnect.cold+0x20c/0x681 drivers/usb/core/hub.c:2219 hub_port_connect drivers/usb/core/hub.c:5127 [inline] hub_port_connect_change drivers/usb/core/hub.c:5416 [inline] port_event drivers/usb/core/hub.c:5562 [inline] hub_event+0xb22/0x36d0 drivers/usb/core/hub.c:5644 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2276 process_scheduled_works kernel/workqueue.c:2338 [inline] worker_thread+0x733/0xf80 kernel/workqueue.c:2424 kthread+0x36f/0x450 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 The buggy address belongs to the page: page:ffffea0000cb9b00 refcount:1 mapcount:-512 mapping:0000000000000000 index:0x0 pfn:0x32e6c flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 ffff888017fb1600 00000001fffffdff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 4861, ts 77150632872, free_ts 76950073615 prep_new_page mm/page_alloc.c:2358 [inline] get_page_from_freelist+0x1033/0x2b60 mm/page_alloc.c:3994 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5200 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline] pte_alloc_one+0x11/0x190 arch/x86/mm/pgtable.c:33 __pte_alloc+0x15/0x240 mm/memory.c:440 copy_pte_range mm/memory.c:947 [inline] copy_pmd_range mm/memory.c:1064 [inline] copy_pud_range mm/memory.c:1101 [inline] copy_p4d_range mm/memory.c:1125 [inline] copy_page_range+0x11f1/0x31e0 mm/memory.c:1198 dup_mmap kernel/fork.c:598 [inline] dup_mm+0x7cc/0x1090 kernel/fork.c:1374 copy_mm kernel/fork.c:1426 [inline] copy_process+0x58a9/0x67c0 kernel/fork.c:2116 kernel_clone+0xb8/0x7f0 kernel/fork.c:2503 __do_sys_clone+0xaf/0xf0 kernel/fork.c:2620 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1298 [inline] __free_pages_ok+0x476/0xce0 mm/page_alloc.c:1572 em28xx_ir_fini.cold+0x72/0x115 drivers/media/usb/em28xx/em28xx-input.c:875 em28xx_close_extension+0xa4/0x260 drivers/media/usb/em28xx/em28xx-core.c:1143 em28xx_usb_disconnect.cold+0x13c/0x211 drivers/media/usb/em28xx/em28xx-cards.c:4140 usb_unbind_interface+0x183/0x7e0 drivers/usb/core/driver.c:458 __device_release_driver+0x32f/0x660 drivers/base/dd.c:1181 device_release_driver_internal drivers/base/dd.c:1212 [inline] device_release_driver+0x21/0x30 drivers/base/dd.c:1235 bus_remove_device+0x298/0x550 drivers/base/bus.c:533 device_del+0x494/0xc10 drivers/base/core.c:3512 usb_disable_device+0x29c/0x660 drivers/usb/core/message.c:1413 usb_disconnect.cold+0x20c/0x681 drivers/usb/core/hub.c:2219 hub_port_connect drivers/usb/core/hub.c:5127 [inline] hub_port_connect_change drivers/usb/core/hub.c:5416 [inline] port_event drivers/usb/core/hub.c:5562 [inline] hub_event+0xb22/0x36d0 drivers/usb/core/hub.c:5644 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2276 process_scheduled_works kernel/workqueue.c:2338 [inline] worker_thread+0x733/0xf80 kernel/workqueue.c:2424 kthread+0x36f/0x450 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Memory state around the buggy address: ffff888032e6c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888032e6c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888032e6c200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888032e6c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888032e6c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================