On Mon, Mar 16, 2020 at 11:52 PM Will Deacon [off-list ref] wrote:

On Tue, Mar 10, 2020 at 09:01:18AM -0700, Kees Cook wrote:

quoted

On Tue, Mar 10, 2020 at 02:39:01AM -0700, syzbot wrote:

quoted

syzbot has bisected this bug to:

commit fb041bb7c0a918b95c6889fc965cdc4a75b4c0ca
Author: Will Deacon [off-list ref]
Date:   Thu Nov 21 11:59:00 2019 +0000

    locking/refcount: Consolidate implementations of refcount_t

I suspect this is just bisecting to here because it made the refcount
checks more strict?

Yes, this is the commit that enables full refcount checking for all
architectures unconditionally, so it's the canary in the coalmine rather
than the source of the problem.

Yes, I tracked it down. And sent out a fix:
https://lore.kernel.org/netdev/1584330804-18477-1-git-send-email-hqjagain@gmail.com (local)

Will