bisecting cause commit starting from d7cc399e1227e74e44f78847d9732a228b46cc91 building syzkaller on b0e8efcb4b0aac61f4647a76bbe54a5d38a370ba testing commit d7cc399e1227e74e44f78847d9732a228b46cc91 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: OK run #8: OK run #9: OK testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: WARNING: locking bug in lock_sock_nested run #9: OK testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 all runs: crashed: WARNING: locking bug in lock_sock_nested testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: OK run #9: OK testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in reacquire_held_locks run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in reacquire_held_locks run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: OK run #9: OK testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: OK run #8: OK run #9: OK testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #1: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #2: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #3: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #4: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #7: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #8: crashed: KASAN: use-after-free Read in pppol2tp_session_init run #9: crashed: KASAN: use-after-free Read in pppol2tp_session_init testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in pppol2tp_session_init testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in lock_sock_nested run #1: crashed: KASAN: use-after-free Read in lock_sock_nested run #2: crashed: KASAN: use-after-free Read in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: KASAN: use-after-free Read in lock_sock_nested run #6: crashed: KASAN: use-after-free Read in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: refcount bug in l2tp_session_create run #4: crashed: KASAN: use-after-free Read in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: WARNING: locking bug in lock_sock_nested testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #1: crashed: KASAN: use-after-free Read in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 run #0: crashed: KASAN: use-after-free Read in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: KASAN: use-after-free Read in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: KASAN: use-after-free Read in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: KASAN: use-after-free Read in lock_sock_nested run #2: crashed: KASAN: use-after-free Read in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: KASAN: use-after-free Read in lock_sock_nested run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: KASAN: use-after-free Read in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 run #0: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #1: crashed: general protection fault in pppol2tp_connect run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #3: crashed: general protection fault in pppol2tp_connect run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #7: crashed: BUG: unable to handle kernel run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 run #0: crashed: KASAN: use-after-free Read in lock_sock_nested run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #6: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: KASAN: use-after-free Read in lock_sock_nested run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 run #0: crashed: KASAN: use-after-free Read in lock_sock_nested run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #2: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #5: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #6: crashed: KASAN: use-after-free Read in lock_sock_nested run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: KASAN: use-after-free Read in lock_sock_nested testing release v4.5 testing commit b562e44f507e863c6792946e4e1b1449fbbac85d with gcc (GCC) 5.5.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: WARNING: locking bug in lock_sock_nested run #9: crashed: WARNING: locking bug in lock_sock_nested testing release v4.4 testing commit afd2ff9b7e1b367172f18ba7f693dfb62bdcb2dc with gcc (GCC) 5.5.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: WARNING: locking bug in lock_sock_nested run #9: crashed: WARNING: locking bug in lock_sock_nested testing release v4.3 testing commit 6a13feb9c82803e2b815eca72fa7a9f5561d7861 with gcc (GCC) 5.5.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: WARNING: locking bug in lock_sock_nested run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: WARNING: locking bug in lock_sock_nested run #8: crashed: WARNING: locking bug in lock_sock_nested run #9: crashed: BUG: unable to handle kernel NULL pointer dereference in ep_unregister_pollwait testing release v4.2 testing commit 64291f7db5bd8150a74ad2036f1037e6a0428df2 with gcc (GCC) 5.5.0 run #0: crashed: WARNING: locking bug in lock_sock_nested run #1: crashed: WARNING: locking bug in lock_sock_nested run #2: crashed: WARNING: locking bug in lock_sock_nested run #3: crashed: BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:LINE run #4: crashed: WARNING: locking bug in lock_sock_nested run #5: crashed: WARNING: locking bug in lock_sock_nested run #6: crashed: WARNING: locking bug in lock_sock_nested run #7: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #8: crashed: BUG: unable to handle kernel NULL pointer dereference in l2tp_session_create run #9: crashed: WARNING: locking bug in lock_sock_nested testing release v4.1 testing commit b953c0d234bc72e8489d3bf51a276c5c4ec85345 with gcc (GCC) 5.5.0 all runs: crashed: WARNING: locking bug in lock_sock_nested revisions tested: 22, total time: 4h6m1.507267865s (build: 1h39m41.754922172s, test: 2h19m38.956785669s) the crash already happened on the oldest tested release crash: WARNING: locking bug in lock_sock_nested l2tp_core: tunl 4: fd 4 wrong protocol, got 1, expected 17 l2tp_core: tunl 4: fd 4 wrong protocol, got 1, expected 17 l2tp_core: tunl 4: fd 4 wrong protocol, got 1, expected 17 l2tp_core: tunl 4: fd 4 wrong protocol, got 1, expected 17 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 14811 at kernel/locking/lockdep.c:728 look_up_lock_class kernel/locking/lockdep.c:728 [inline]() WARNING: CPU: 0 PID: 14811 at kernel/locking/lockdep.c:728 register_lock_class kernel/locking/lockdep.c:750 [inline]() WARNING: CPU: 0 PID: 14811 at kernel/locking/lockdep.c:728 __lock_acquire+0xdbf/0x1c70 kernel/locking/lockdep.c:3101() Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 14811 Comm: syz-executor.1 Not tainted 4.1.0 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffffffff82e342a8 ffff88012a623a38 ffffffff8263906b 0000000000000032 ffffffff82e31403 ffff88012a623ab8 ffffffff82634efe ffff88012a623a58 ffffffff00000008 ffff88012a623ac8 ffff88012a623a68 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x4f/0x7b lib/dump_stack.c:50 [] panic+0xcd/0x211 kernel/panic.c:111 [] warn_slowpath_common+0xbb/0xc0 kernel/panic.c:442 [] warn_slowpath_null+0x15/0x20 kernel/panic.c:479 [] look_up_lock_class kernel/locking/lockdep.c:728 [inline] [] register_lock_class kernel/locking/lockdep.c:750 [inline] [] __lock_acquire+0xdbf/0x1c70 kernel/locking/lockdep.c:3101 [] lock_acquire+0xe6/0x310 kernel/locking/lockdep.c:3623 [] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:137 [inline] [] _raw_spin_lock_bh+0x3a/0x50 kernel/locking/spinlock.c:175 [] spin_lock_bh include/linux/spinlock.h:317 [inline] [] lock_sock_nested+0x32/0xa0 net/core/sock.c:2369 [] lock_sock include/net/sock.h:1486 [inline] [] do_ipv6_setsockopt.isra.7+0xb2/0x12b0 net/ipv6/ipv6_sockglue.c:165 [] ipv6_setsockopt+0x4a/0xb0 net/ipv6/ipv6_sockglue.c:885 [] udpv6_setsockopt+0x16/0x30 net/ipv6/udp.c:1422 [] sock_common_setsockopt+0xf/0x20 net/core/sock.c:2576 [] SYSC_setsockopt net/socket.c:1760 [inline] [] SyS_setsockopt+0x6c/0xd0 net/socket.c:1739 [] system_call_fastpath+0x16/0x7a Kernel Offset: disabled