bisecting cause commit starting from 0462eaacee493f7e2d87551a35d38be93ca723f8 building syzkaller on 53c81ea5385ee17c68d0afa4e524b6aead37c903 testing commit 0462eaacee493f7e2d87551a35d38be93ca723f8 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb_list run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: crashed: KASAN: use-after-free Read in kfree_skb_list testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: OK # git bisect start 0462eaacee493f7e2d87551a35d38be93ca723f8 v5.1 Bisecting: 7206 revisions left to test after this (roughly 13 steps) [f4d9a23d3dad0252f375901bf4ff6523a2c97241] sparc64: simplify reduce_memory() function testing commit f4d9a23d3dad0252f375901bf4ff6523a2c97241 with gcc (GCC) 8.1.0 all runs: OK # git bisect good f4d9a23d3dad0252f375901bf4ff6523a2c97241 Bisecting: 3603 revisions left to test after this (roughly 12 steps) [21d89d151bb42bea1bcf0343f724ef62509d6161] mm: memcontrol: push down mem_cgroup_nr_lru_pages() testing commit 21d89d151bb42bea1bcf0343f724ef62509d6161 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 21d89d151bb42bea1bcf0343f724ef62509d6161 Bisecting: 1768 revisions left to test after this (roughly 11 steps) [dc413a90edbe715bebebe859dc072ef73d490d70] Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc testing commit dc413a90edbe715bebebe859dc072ef73d490d70 with gcc (GCC) 8.1.0 all runs: OK # git bisect good dc413a90edbe715bebebe859dc072ef73d490d70 Bisecting: 884 revisions left to test after this (roughly 10 steps) [46dfc3a54b4dcf9e8ff204280800f60618ec783b] net: stmmac: fix ethtool flow control not able to get/set testing commit 46dfc3a54b4dcf9e8ff204280800f60618ec783b with gcc (GCC) 8.1.0 all runs: OK # git bisect good 46dfc3a54b4dcf9e8ff204280800f60618ec783b Bisecting: 412 revisions left to test after this (roughly 9 steps) [036e34310931e64ce4f1edead435708cd517db10] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net testing commit 036e34310931e64ce4f1edead435708cd517db10 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 036e34310931e64ce4f1edead435708cd517db10 Bisecting: 207 revisions left to test after this (roughly 8 steps) [e89e899f3e3213a98ccf60d832f37ecef7000a5b] ice: Add a helper to trigger software interrupt testing commit e89e899f3e3213a98ccf60d832f37ecef7000a5b with gcc (GCC) 8.1.0 all runs: OK # git bisect good e89e899f3e3213a98ccf60d832f37ecef7000a5b Bisecting: 103 revisions left to test after this (roughly 7 steps) [fdad1d54d2c8ca784f8f9d04340ea942b92aaa85] iavf: update comments and file checks to match iavf testing commit fdad1d54d2c8ca784f8f9d04340ea942b92aaa85 with gcc (GCC) 8.1.0 ./include/linux/netfilter_ipv6.h:110:9: error: implicit declaration of function ‘nf_ct_frag6_gather’; did you mean ‘nf_ct_attach’? [-Werror=implicit-function-declaration] # git bisect skip fdad1d54d2c8ca784f8f9d04340ea942b92aaa85 Bisecting: 103 revisions left to test after this (roughly 7 steps) [f102154d3158c8fe9713f03bd3492f9cb8409a5e] libbpf: fix error code returned on corrupted ELF testing commit f102154d3158c8fe9713f03bd3492f9cb8409a5e with gcc (GCC) 8.1.0 all runs: OK # git bisect good f102154d3158c8fe9713f03bd3492f9cb8409a5e Bisecting: 66 revisions left to test after this (roughly 6 steps) [1b0b807dd7469e36b761f5bb4ee40b61331aeee8] Merge branch 'r8169-fw' testing commit 1b0b807dd7469e36b761f5bb4ee40b61331aeee8 with gcc (GCC) 8.1.0 ./include/linux/netfilter_ipv6.h:110:9: error: implicit declaration of function ‘nf_ct_frag6_gather’; did you mean ‘nf_ct_attach’? [-Werror=implicit-function-declaration] # git bisect skip 1b0b807dd7469e36b761f5bb4ee40b61331aeee8 Bisecting: 66 revisions left to test after this (roughly 6 steps) [aa1236cdfa898dc4d41cdae8e69d401a2cc7f7f5] tcp: add support for optional TFO backup key to net.ipv4.tcp_fastopen_key testing commit aa1236cdfa898dc4d41cdae8e69d401a2cc7f7f5 with gcc (GCC) 8.1.0 all runs: OK # git bisect good aa1236cdfa898dc4d41cdae8e69d401a2cc7f7f5 Bisecting: 42 revisions left to test after this (roughly 6 steps) [3dc215416673f9ba8f136aafbb0069ed9ebff376] iavf: Use printf instead of gnu_printf for iavf_debug_d testing commit 3dc215416673f9ba8f136aafbb0069ed9ebff376 with gcc (GCC) 8.1.0 ./include/linux/netfilter_ipv6.h:110:9: error: implicit declaration of function ‘nf_ct_frag6_gather’; did you mean ‘nf_ct_attach’? [-Werror=implicit-function-declaration] # git bisect skip 3dc215416673f9ba8f136aafbb0069ed9ebff376 Bisecting: 42 revisions left to test after this (roughly 6 steps) [7fdc455eef205ca580d38fed376efc7bc81f98cd] net: phylink: remove netdev from phylink mii ioctl emulation testing commit 7fdc455eef205ca580d38fed376efc7bc81f98cd with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb_list run #1: crashed: KASAN: use-after-free Read in kfree_skb_list run #2: crashed: KASAN: use-after-free Read in kfree_skb_list run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 7fdc455eef205ca580d38fed376efc7bc81f98cd Bisecting: 22 revisions left to test after this (roughly 5 steps) [07b0928918c694c845a387cc16256a8b63ced4fc] net: phy: enable interrupts when PHY is attached already testing commit 07b0928918c694c845a387cc16256a8b63ced4fc with gcc (GCC) 8.1.0 ./include/linux/netfilter_ipv6.h:110:9: error: implicit declaration of function ‘nf_ct_frag6_gather’; did you mean ‘nf_ct_attach’? [-Werror=implicit-function-declaration] # git bisect skip 07b0928918c694c845a387cc16256a8b63ced4fc Bisecting: 22 revisions left to test after this (roughly 5 steps) [3c171f496ef57774f8e5d509923372549734877f] netfilter: bridge: add connection tracking system testing commit 3c171f496ef57774f8e5d509923372549734877f with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb_list run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 3c171f496ef57774f8e5d509923372549734877f Bisecting: 4 revisions left to test after this (roughly 2 steps) [0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c] net: ipv6: add skbuff fraglist splitter testing commit 0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in kfree_skb_list run #1: crashed: KASAN: use-after-free Read in kfree_skb_list run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK # git bisect bad 0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c Bisecting: 2 revisions left to test after this (roughly 1 step) [10fbcdd12aa24fdb4b357a39abc03686d15f04fd] selftests/net: add TFO key rotation selftest testing commit 10fbcdd12aa24fdb4b357a39abc03686d15f04fd with gcc (GCC) 8.1.0 all runs: OK # git bisect good 10fbcdd12aa24fdb4b357a39abc03686d15f04fd Bisecting: 0 revisions left to test after this (roughly 1 step) [c8b17be0b7a45d707fc202c11d257c25bc3952b8] net: ipv4: add skbuff fraglist splitter testing commit c8b17be0b7a45d707fc202c11d257c25bc3952b8 with gcc (GCC) 8.1.0 all runs: OK # git bisect good c8b17be0b7a45d707fc202c11d257c25bc3952b8 0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c is the first bad commit commit 0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c Author: Pablo Neira Ayuso Date: Wed May 29 13:25:32 2019 +0200 net: ipv6: add skbuff fraglist splitter This patch adds the skbuff fraglist split iterator. This API provides an iterator to transform the fraglist into single skbuff objects, it consists of: * ip6_fraglist_init(), that initializes the internal state of the fraglist iterator. * ip6_fraglist_prepare(), that restores the IPv6 header on the fragment. * ip6_fraglist_next(), that retrieves the fragment from the fraglist and updates the internal state of the iterator to point to the next fragment in the fraglist. The ip6_fraglist_iter object stores the internal state of the iterator. This code has been extracted from ip6_fragment(). Symbols are also exported to allow to reuse this iterator from the bridge codepath to build its own refragmentation routine by reusing the existing codebase. Signed-off-by: Pablo Neira Ayuso Signed-off-by: David S. Miller :040000 040000 263d154cb0525c7f2395fcc40234eda1f072e743 e3b6efe030fcc9ad197da0b9ed169fdfe6e094cf M include :040000 040000 1bb7b0a3c4dd5ac2c7f4069cdb64ac12295d644d 6a61371b360262a79224da533e6f9b7f6d414bce M net revisions tested: 19, total time: 6h1m5.403334215s (build: 2h45m55.372262681s, test: 3h4m54.627738754s) first bad commit: 0feca6190f88a1b7c9a9b9cdf41824e3ea4ba02c net: ipv6: add skbuff fraglist splitter cc: ["davem@davemloft.net" "kuznet@ms2.inr.ac.ru" "linux-kernel@vger.kernel.org" "netdev@vger.kernel.org" "pablo@netfilter.org" "yoshfuji@linux-ipv6.org"] crash: KASAN: use-after-free Read in kfree_skb_list ================================================================== BUG: KASAN: use-after-free in kfree_skb_list+0x4c/0x50 net/core/skbuff.c:705 Read of size 8 at addr ffff888085ec3480 by task syz-executor.5/7463 CPU: 0 PID: 7463 Comm: syz-executor.5 Not tainted 5.2.0-rc1+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x113/0x167 lib/dump_stack.c:113 print_address_description.cold.5+0x9/0x1ff mm/kasan/report.c:188 __kasan_report.cold.6+0x1b/0x39 mm/kasan/report.c:317 kasan_report+0x12/0x20 mm/kasan/common.c:614 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 kfree_skb_list+0x4c/0x50 net/core/skbuff.c:705 ip6_fragment+0x1ed1/0x2e50 net/ipv6/ip6_output.c:778 ip6_finish_output+0x536/0xa50 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x1bf/0x630 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:433 [inline] ip6_local_out+0x78/0x130 net/ipv6/output_core.c:179 ip6_send_skb+0x92/0x2f0 net/ipv6/ip6_output.c:1757 ip6_push_pending_frames+0x94/0xb0 net/ipv6/ip6_output.c:1777 rawv6_push_pending_frames net/ipv6/raw.c:617 [inline] rawv6_sendmsg+0x240a/0x3250 net/ipv6/raw.c:947 inet_sendmsg+0x108/0x460 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:671 ___sys_sendmsg+0x647/0x950 net/socket.c:2292 __sys_sendmsg+0xd9/0x180 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2337 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459279 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007efcc4c0dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459279 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007efcc4c0e6d4 R13: 00000000004c6c94 R14: 00000000004dba90 R15: 00000000ffffffff Allocated by task 7463: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc.constprop.8+0xc7/0xd0 mm/kasan/common.c:489 kasan_slab_alloc+0x12/0x20 mm/kasan/common.c:497 slab_post_alloc_hook mm/slab.h:437 [inline] slab_alloc_node mm/slab.c:3269 [inline] kmem_cache_alloc_node+0x131/0x720 mm/slab.c:3579 __alloc_skb+0xa7/0x570 net/core/skbuff.c:198 alloc_skb include/linux/skbuff.h:1058 [inline] __ip6_append_data.isra.51+0x2397/0x37e0 net/ipv6/ip6_output.c:1480 ip6_append_data+0x165/0x2f0 net/ipv6/ip6_output.c:1649 rawv6_sendmsg+0x1934/0x3250 net/ipv6/raw.c:940 inet_sendmsg+0x108/0x460 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:671 ___sys_sendmsg+0x647/0x950 net/socket.c:2292 __sys_sendmsg+0xd9/0x180 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2337 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7463: save_stack+0x21/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kmem_cache_free+0x83/0x290 mm/slab.c:3698 kfree_skbmem+0x82/0xf0 net/core/skbuff.c:624 __kfree_skb net/core/skbuff.c:681 [inline] kfree_skb+0x9f/0x270 net/core/skbuff.c:698 ip6_tnl_start_xmit+0x270/0x1ec0 net/ipv6/ip6_tunnel.c:1423 __netdev_start_xmit include/linux/netdevice.h:4410 [inline] netdev_start_xmit include/linux/netdevice.h:4424 [inline] xmit_one net/core/dev.c:3292 [inline] dev_hard_start_xmit+0x144/0x750 net/core/dev.c:3308 __dev_queue_xmit+0x1feb/0x2ff0 net/core/dev.c:3881 dev_queue_xmit+0xb/0x10 net/core/dev.c:3914 neigh_direct_output+0xc/0x10 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:511 [inline] ip6_finish_output2+0xc68/0x22f0 net/ipv6/ip6_output.c:120 ip6_fragment+0x1ea7/0x2e50 net/ipv6/ip6_output.c:759 ip6_finish_output+0x536/0xa50 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip6_output+0x1bf/0x630 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:433 [inline] ip6_local_out+0x78/0x130 net/ipv6/output_core.c:179 ip6_send_skb+0x92/0x2f0 net/ipv6/ip6_output.c:1757 ip6_push_pending_frames+0x94/0xb0 net/ipv6/ip6_output.c:1777 rawv6_push_pending_frames net/ipv6/raw.c:617 [inline] rawv6_sendmsg+0x240a/0x3250 net/ipv6/raw.c:947 inet_sendmsg+0x108/0x460 net/ipv4/af_inet.c:802 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:671 ___sys_sendmsg+0x647/0x950 net/socket.c:2292 __sys_sendmsg+0xd9/0x180 net/socket.c:2330 __do_sys_sendmsg net/socket.c:2339 [inline] __se_sys_sendmsg net/socket.c:2337 [inline] __x64_sys_sendmsg+0x73/0xb0 net/socket.c:2337 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888085ec3480 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 0 bytes inside of 224-byte region [ffff888085ec3480, ffff888085ec3560) The buggy address belongs to the page: page:ffffea000217b0c0 refcount:1 mapcount:0 mapping:ffff88821b6f6540 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00024dd208 ffffea000240b808 ffff88821b6f6540 raw: 0000000000000000 ffff888085ec30c0 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888085ec3380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888085ec3400: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc >ffff888085ec3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888085ec3500: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888085ec3580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ==================================================================