bisecting cause commit starting from 8087b004bd099367c29d3a163950bc4b162ebc3c
building syzkaller on 7509bf360eba1461ac6059e4cacfbc29c9d2d4c7
testing commit 8087b004bd099367c29d3a163950bc4b162ebc3c with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Write in copy_net_ns
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0
all runs: OK
# git bisect start 8087b004bd099367c29d3a163950bc4b162ebc3c v5.1
Bisecting: 12617 revisions left to test after this (roughly 14 steps)
[39feaa3ff4453594297574e116a55bd6d5371f37] Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
testing commit 39feaa3ff4453594297574e116a55bd6d5371f37 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 39feaa3ff4453594297574e116a55bd6d5371f37
Bisecting: 5841 revisions left to test after this (roughly 13 steps)
[b4915a2a54f607f8746400118911f0a6620c9f47] Merge remote-tracking branch 'net-next/master'
testing commit b4915a2a54f607f8746400118911f0a6620c9f47 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good b4915a2a54f607f8746400118911f0a6620c9f47
Bisecting: 2929 revisions left to test after this (roughly 12 steps)
[5cd598e79b2465f0550f1d6a19c6f990992df991] Merge remote-tracking branch 'backlight/for-backlight-next'
testing commit 5cd598e79b2465f0550f1d6a19c6f990992df991 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 5cd598e79b2465f0550f1d6a19c6f990992df991
Bisecting: 1424 revisions left to test after this (roughly 11 steps)
[96a62f6386b13cbf1e9acbba558d4fefacee7f46] Merge remote-tracking branch 'char-misc/char-misc-next'
testing commit 96a62f6386b13cbf1e9acbba558d4fefacee7f46 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 96a62f6386b13cbf1e9acbba558d4fefacee7f46
Bisecting: 720 revisions left to test after this (roughly 10 steps)
[7394ef46f33b02a4fb9610a51cf0b7a88cf003fe] Merge remote-tracking branch 'rpmsg/for-next'
testing commit 7394ef46f33b02a4fb9610a51cf0b7a88cf003fe with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 7394ef46f33b02a4fb9610a51cf0b7a88cf003fe
Bisecting: 367 revisions left to test after this (roughly 9 steps)
[ef33ef849aae4d9355cac7f4fe559cd5cc2864a4] Merge remote-tracking branch 'pidfd/for-next'
testing commit ef33ef849aae4d9355cac7f4fe559cd5cc2864a4 with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Write in copy_net_ns
run #1: crashed: KASAN: use-after-free Write in copy_net_ns
run #2: crashed: KASAN: use-after-free Write in copy_net_ns
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad ef33ef849aae4d9355cac7f4fe559cd5cc2864a4
Bisecting: 183 revisions left to test after this (roughly 8 steps)
[eb13feed8a2b2d9ee34bd042c54efecd58f0826b] Merge remote-tracking branch 'pinctrl/for-next'
testing commit eb13feed8a2b2d9ee34bd042c54efecd58f0826b with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Write in copy_net_ns
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad eb13feed8a2b2d9ee34bd042c54efecd58f0826b
Bisecting: 84 revisions left to test after this (roughly 6 steps)
[d9c238c5a6aeee2706d5ace0b1aa005e6d1a482f] pinctrl: freescale: Add i.MX8MN pinctrl driver support
testing commit d9c238c5a6aeee2706d5ace0b1aa005e6d1a482f with gcc (GCC) 8.1.0
all runs: OK
# git bisect good d9c238c5a6aeee2706d5ace0b1aa005e6d1a482f
Bisecting: 42 revisions left to test after this (roughly 5 steps)
[42d9fc7176eb6b0ed4cd73bb66d28c8ea758a944] gpio: ftgpio: Pass irqchip when adding gpiochip
testing commit 42d9fc7176eb6b0ed4cd73bb66d28c8ea758a944 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 42d9fc7176eb6b0ed4cd73bb66d28c8ea758a944
Bisecting: 21 revisions left to test after this (roughly 5 steps)
[19cca7f21bcda140ab87166392583e894e309cd4] Merge branch 'devel' into for-next
testing commit 19cca7f21bcda140ab87166392583e894e309cd4 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 19cca7f21bcda140ab87166392583e894e309cd4
Bisecting: 9 revisions left to test after this (roughly 4 steps)
[8b887727a182c0a2cda5b34d6129efa213a7c827] Merge branch 'devel' into for-next
testing commit 8b887727a182c0a2cda5b34d6129efa213a7c827 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 8b887727a182c0a2cda5b34d6129efa213a7c827
Bisecting: 4 revisions left to test after this (roughly 2 steps)
[375b94246761816e2637fc8afd454d2b158213f7] gpio: max732x: use i2c_new_dummy_device()
testing commit 375b94246761816e2637fc8afd454d2b158213f7 with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 375b94246761816e2637fc8afd454d2b158213f7
Bisecting: 2 revisions left to test after this (roughly 1 step)
[690499d969bc5054ed43a9ef0c96f26d478fff6e] gpio: madera: Fixup SPDX headers
testing commit 690499d969bc5054ed43a9ef0c96f26d478fff6e with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 690499d969bc5054ed43a9ef0c96f26d478fff6e
Bisecting: 0 revisions left to test after this (roughly 1 step)
[e609269068f40eeef7532960ec7a5ec20fe62884] Merge remote-tracking branch 'gpio-brgl/gpio/for-next'
testing commit e609269068f40eeef7532960ec7a5ec20fe62884 with gcc (GCC) 8.1.0
run #0: crashed: KASAN: use-after-free Write in copy_net_ns
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
# git bisect bad e609269068f40eeef7532960ec7a5ec20fe62884
Bisecting: 0 revisions left to test after this (roughly 0 steps)
[9fa153ef27ac29757c8b0a4581449492391e347e] Merge remote-tracking branch 'gpio/for-next'
testing commit 9fa153ef27ac29757c8b0a4581449492391e347e with gcc (GCC) 8.1.0
all runs: OK
# git bisect good 9fa153ef27ac29757c8b0a4581449492391e347e
e609269068f40eeef7532960ec7a5ec20fe62884 is the first bad commit
revisions tested: 17, total time: 4h55m56.039053692s (build: 1h39m0.106223118s, test: 3h11m3.633486314s)
first bad commit: e609269068f40eeef7532960ec7a5ec20fe62884 Merge remote-tracking branch 'gpio-brgl/gpio/for-next'
cc: ["sfr@canb.auug.org.au"]
crash: KASAN: use-after-free Write in copy_net_ns
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff5ced5a6d4
R13: 00000000004c8a2c R14: 00000000004df7d0 R15: 0000000000000007
==================================================================
BUG: KASAN: use-after-free in atomic_set include/asm-generic/atomic-instrumented.h:44 [inline]
BUG: KASAN: use-after-free in refcount_set include/linux/refcount.h:32 [inline]
BUG: KASAN: use-after-free in copy_net_ns+0x1b6/0x380 net/core/net_namespace.c:466
Write of size 4 at addr ffff88808d838040 by task syz-executor.0/8045

CPU: 0 PID: 8045 Comm: syz-executor.0 Not tainted 5.2.0-rc6+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x113/0x167 lib/dump_stack.c:113
 print_address_description.cold.5+0x9/0x1ff mm/kasan/report.c:188
 __kasan_report.cold.6+0x1b/0x39 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/generic.c:191
 kasan_check_write+0x14/0x20 mm/kasan/common.c:100
 atomic_set include/asm-generic/atomic-instrumented.h:44 [inline]
 refcount_set include/linux/refcount.h:32 [inline]
 copy_net_ns+0x1b6/0x380 net/core/net_namespace.c:466
 create_new_namespaces+0x487/0x760 kernel/nsproxy.c:103
 unshare_nsproxy_namespaces+0x87/0x1a0 kernel/nsproxy.c:202
 ksys_unshare+0x31b/0x710 kernel/fork.c:2691
 __do_sys_unshare kernel/fork.c:2759 [inline]
 __se_sys_unshare kernel/fork.c:2757 [inline]
 __x64_sys_unshare+0x2c/0x40 kernel/fork.c:2757
 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459519
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ff5ced59c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007ff5ced59c90 RCX: 0000000000459519
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff5ced5a6d4
R13: 00000000004c8a2c R14: 00000000004df7d0 R15: 0000000000000007

Allocated by task 8045:
 save_stack+0x21/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc.constprop.8+0xc7/0xd0 mm/kasan/common.c:489
 kasan_slab_alloc+0x12/0x20 mm/kasan/common.c:497
 slab_post_alloc_hook mm/slab.h:437 [inline]
 slab_alloc mm/slab.c:3326 [inline]
 kmem_cache_alloc+0x11a/0x720 mm/slab.c:3488
 kmem_cache_zalloc include/linux/slab.h:732 [inline]
 net_alloc net/core/net_namespace.c:410 [inline]
 copy_net_ns+0xca/0x380 net/core/net_namespace.c:461
 create_new_namespaces+0x487/0x760 kernel/nsproxy.c:103
 unshare_nsproxy_namespaces+0x87/0x1a0 kernel/nsproxy.c:202
 ksys_unshare+0x31b/0x710 kernel/fork.c:2691
 __do_sys_unshare kernel/fork.c:2759 [inline]
 __se_sys_unshare kernel/fork.c:2757 [inline]
 __x64_sys_unshare+0x2c/0x40 kernel/fork.c:2757
 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 8045:
 save_stack+0x21/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
 __cache_free mm/slab.c:3432 [inline]
 kmem_cache_free+0x83/0x290 mm/slab.c:3698
 net_alloc net/core/net_namespace.c:427 [inline]
 copy_net_ns+0x315/0x380 net/core/net_namespace.c:461
 create_new_namespaces+0x487/0x760 kernel/nsproxy.c:103
 unshare_nsproxy_namespaces+0x87/0x1a0 kernel/nsproxy.c:202
 ksys_unshare+0x31b/0x710 kernel/fork.c:2691
 __do_sys_unshare kernel/fork.c:2759 [inline]
 __se_sys_unshare kernel/fork.c:2757 [inline]
 __x64_sys_unshare+0x2c/0x40 kernel/fork.c:2757
 do_syscall_64+0xd0/0x530 arch/x86/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff88808d838040
 which belongs to the cache net_namespace(49:syz0) of size 6784
The buggy address is located 0 bytes inside of
 6784-byte region [ffff88808d838040, ffff88808d839ac0)
The buggy address belongs to the page:
page:ffffea0002360e00 refcount:1 mapcount:0 mapping:ffff88808e58e6c0 index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea00020b2188 ffff88808e58f748 ffff88808e58e6c0
raw: 0000000000000000 ffff88808d838040 0000000100000001 ffff888099288b00
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff888099288b00

Memory state around the buggy address:
 ffff88808d837f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88808d837f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88808d838000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                           ^
 ffff88808d838080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88808d838100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================